Skip to content

Commit 7e9d571

Browse files
faizanahmad055faizanahmad055
committed
Readme update and change SHA1 to SHA512
Signed-off-by: faizanahmad055 <faizan.ahmad55@outlook.com>
1 parent 0f1d02e commit 7e9d571

5 files changed

Lines changed: 44 additions & 25 deletions

File tree

‎README.md‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -263,10 +263,33 @@ Reloader watches these updates and triggers a rollout when a change is detected.
263263

264264
#### Annotations for CSI-mounted Secrets
265265

266-
| Annotation | Description |
267-
|--------------------------------------------|----------------------------------------------------------------------|
268-
| `reloader.stakater.com/auto: "true"` | Reloads workload when CSI-mounted secrets change |
269-
| `secretproviderclass.reloader.stakater.com/reload: "my-spc"` | Reloads when specific SecretProviderClass changes |
266+
| Annotation | Description |
267+
|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
268+
| `reloader.stakater.com/auto: "true"` | Global Discovery: Automatically discovers and reloads the workload when any mounted ConfigMap or Secret is updated. |
269+
| `secretproviderclass.reloader.stakater.com/auto: 'true'` | CSI Discovery: Specifically watches for updates to all SecretProviderClasses used by the workload (CSI driver integration). |
270+
| `secretproviderclass.reloader.stakater.com/reload: "my-secretproviderclass"` | Targeted Reload: Only reloads the workload when the specifically named SecretProviderClass(es) are updated. |
271+
272+
Reloader monitors changes at the **per-secret level** by watching the `SecretProviderClassPodStatus`. Make sure each secret you want to monitor is properly defined with a `secretKey` in your `SecretProviderClass`:
273+
274+
```yaml
275+
apiVersion: secrets-store.csi.x-k8s.io/v1
276+
kind: SecretProviderClass
277+
metadata:
278+
name: vault-reloader-demo
279+
namespace: test
280+
spec:
281+
provider: vault
282+
parameters:
283+
vaultAddress: "http://vault.vault.svc:8200"
284+
vaultSkipTLSVerify: "true"
285+
roleName: "demo-role"
286+
objects: |
287+
- objectName: "password"
288+
secretPath: "secret/data/reloader-demo"
289+
secretKey: "password"
290+
```
291+
***Important***: Reloader tracks changes to individual secrets (identified by secretKey). If your SecretProviderClass doesn't specify secretKey for each object, Reloader may not detect updates correctly.
292+
270293

271294
#### Notes & Limitations
272295

‎docs/How-it-works.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ Note: Rolling upgrade also works in the same way for secrets.
7676

7777
### Hash Value Computation
7878

79-
Reloader uses SHA1 to compute hash value. SHA1 is used because it is efficient and less prone to collision.
79+
Reloader uses SHA512 to compute hash value. SHA1 is used because it is efficient and less prone to collision.
8080

8181
## Monitor All Namespaces
8282

@@ -90,4 +90,4 @@ The output file can then be used to deploy Reloader in specific namespace.
9090

9191
## Compatibility With Helm Install and Upgrade
9292

93-
Reloader has no impact on helm deployment cycle. Reloader only injects an environment variable in `deployment`, `daemonset` or `statefulset`. The environment variable contains the SHA1 value of `ConfigMaps` or `Secrets` data. So if a deployment is created using Helm and Reloader updates the deployment, then next time you upgrade the helm release, Reloader will do nothing except changing that environment variable value in `deployment` , `daemonset` or `statefulset`.
93+
Reloader has no impact on helm deployment cycle. Reloader only injects an environment variable in `deployment`, `daemonset` or `statefulset`. The environment variable contains the SHA512 value of `ConfigMaps` or `Secrets` data. So if a deployment is created using Helm and Reloader updates the deployment, then next time you upgrade the helm release, Reloader will do nothing except changing that environment variable value in `deployment` , `daemonset` or `statefulset`.

‎docs/Reloader-vs-ConfigmapController.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22

33
Reloader is inspired from [`configmapcontroller`](https://github.com/fabric8io/configmapcontroller) but there are many ways in which it differs from `configmapcontroller`. Below is the small comparison between these two controllers.
44

5-
| Reloader | ConfigMap |
6-
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
7-
| Reloader can watch both `Secrets` and `ConfigMaps`. | `configmapcontroller` can only watch changes in `ConfigMaps`. It cannot detect changes in other resources like `Secrets`. |
8-
| Reloader can perform rolling upgrades on `deployments` as well as on `statefulsets` and `daemonsets` | `configmapcontroller` can only perform rolling upgrades on `deployments`. It currently does not support rolling upgrades on `statefulsets` and `daemonsets` |
9-
| Reloader provides both unit test cases and end to end integration test cases for future updates. So one can make sure that new changes do not break any old functionality. | Currently there are not any unit test cases or end to end integration test cases in `configmap-controller`. It add difficulties for any additional updates in `configmap-controller` and one can not know for sure whether new changes breaks any old functionality or not. |
10-
| Reloader uses SHA1 to encode the change in `ConfigMap` or `Secret`. It then saves the SHA1 value in `STAKATER_FOO_CONFIGMAP` or `STAKATER_FOO_SECRET` environment variable depending upon where the change has happened. The use of SHA1 provides a concise 40 characters encoded value that is very less prone to collision. | `configmap-controller` uses `FABRICB_FOO_REVISION` environment variable to store any change in `ConfigMap` controller. It does not encode it or convert it in suitable hash value to avoid data pollution in deployment. |
11-
| Reloader allows you to customize your own annotation (for both `Secrets` and `ConfigMaps`) using command line flags | `configmap-controller` restricts you to only their provided annotation |
5+
| Reloader | ConfigMap |
6+
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
7+
| Reloader can watch both `Secrets` and `ConfigMaps`. | `configmapcontroller` can only watch changes in `ConfigMaps`. It cannot detect changes in other resources like `Secrets`. |
8+
| Reloader can perform rolling upgrades on `deployments` as well as on `statefulsets` and `daemonsets` | `configmapcontroller` can only perform rolling upgrades on `deployments`. It currently does not support rolling upgrades on `statefulsets` and `daemonsets` |
9+
| Reloader provides both unit test cases and end to end integration test cases for future updates. So one can make sure that new changes do not break any old functionality. | Currently there are not any unit test cases or end to end integration test cases in `configmap-controller`. It add difficulties for any additional updates in `configmap-controller` and one can not know for sure whether new changes breaks any old functionality or not. |
10+
| Reloader uses SHA512 to encode the change in `ConfigMap` or `Secret`. It then saves the SHA1 value in `STAKATER_FOO_CONFIGMAP` or `STAKATER_FOO_SECRET` environment variable depending upon where the change has happened. The use of SHA1 provides a concise 40 characters encoded value that is very less prone to collision. | `configmap-controller` uses `FABRICB_FOO_REVISION` environment variable to store any change in `ConfigMap` controller. It does not encode it or convert it in suitable hash value to avoid data pollution in deployment. |
11+
| Reloader allows you to customize your own annotation (for both `Secrets` and `ConfigMaps`) using command line flags | `configmap-controller` restricts you to only their provided annotation |

‎docs/Reloader-vs-k8s-trigger-controller.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Reloader and k8s-trigger-controller are both built for same purpose. So there ar
66

77
- Both controllers support change detection in `ConfigMaps` and `Secrets`
88
- Both controllers support deployment `rollout`
9-
- Both controllers use SHA1 for hashing
9+
- Reloader controller use SHA512 for hashing
1010
- Both controllers have end to end as well as unit test cases.
1111

1212
## Differences

‎internal/pkg/crypto/sha.go‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,16 @@
11
package crypto
22

33
import (
4-
"crypto/sha1"
5-
"fmt"
6-
"io"
7-
8-
"github.com/sirupsen/logrus"
4+
"crypto/sha512"
5+
"encoding/hex"
96
)
107

118
// GenerateSHA generates SHA from string
129
func GenerateSHA(data string) string {
13-
hasher := sha1.New()
14-
_, err := io.WriteString(hasher, data)
15-
if err != nil {
16-
logrus.Errorf("Unable to write data in hash writer %v", err)
10+
if data == "" {
11+
return ""
1712
}
18-
sha := hasher.Sum(nil)
19-
return fmt.Sprintf("%x", sha)
13+
14+
hash := sha512.Sum512_256([]byte(data))
15+
return hex.EncodeToString(hash[:])
2016
}

0 commit comments

Comments
 (0)