Moving secrets from management cluster to target

[Stringls]

Hi! I have a use case when I need to move some secrets from management cluster to workload clusters. I discovered a label clusterctl.cluster.x-k8s.io/move which you use to move hetzner secret to kube-system namespace onto workload cluster. I am not able to find code that does this. Could you please explain is it possible to move any secrets from management cluster to workload clusters using this label or it's being defined on provider level and I can move only secrets you defined in CAPH controller? Thanks

[guettli]

This "magic move" is part of cluster API.

Here are the details:

https://cluster-api.sigs.k8s.io/clusterctl/provider-contract.html#move

You can move other secrets the same way.

In the Makefile you find an example "patch" command.

Does this answers your question?

[Stringls]

@guettli Thank you for your quick response.
I tried to attach the label to other secrets that I create during cluster creation (alongside with cluster) but they are not being moved to the target cluster. The secret's manifest looks like this

apiVersion: v1
data:
  foo: YmFy
kind: Secret
metadata:
  labels:
    app.kubernetes.io/component: secret-sync
    app.kubernetes.io/managed-by: hashicorp-vso
    app.kubernetes.io/name: vault-secrets-operator
    clusterctl.cluster.x-k8s.io/move: ""
  name: vault-token
  namespace: capi-poc-clusterctl-move-secrets-cluster
  ownerReferences:
  - apiVersion: secrets.hashicorp.com/v1alpha1
    kind: VaultStaticSecret
    name: vault-kv-vault-token
type: Opaque

One interesting thing. hetzner secret gets a special label called caph.environment=owned. It does this function

cluster-api-provider-hetzner/pkg/secrets/label.go

Line 36 in 28c897e

secret := &corev1.Secret{}

but it does not do it to other secrets e.g. robot-ssh that you patch as well. It's not moved to the target cluster and does not have this label.

So my questions are:

1. If I move my secret to the target (workload) cluster, it's being deployed in the default namespace or in the namespace of the secret?
2. hetzner secret is being deployed to kube-system namespace but I do not specify it anywhere.
3. What's wrong with my secret? Why it's not being moved?
4. Why robot-ssh secret it not being moved as well?
5. Does this label is crucial and I need it for controllers to move my secret to the target cluster?

[guettli]

clusterctl move is implemented by cluster-api. I don't know the implementation. For caph we did not implement a special hook. So the current behaviour should be according to the docs of clusterctl move.

But maybe the secret you see in the wl-cluster was not created by clusterctl move, but by the caph controller in the mgt-cluster?
The caph controller creates the secret in the wl-cluster, so that for example the ccm (in the wl-cluster) can connect to the api of the infra provider.

cluster-api-provider-hetzner/controllers/hetznercluster_controller.go

Line 410 in f3ea17a

func reconcileTargetSecret(ctx context.Context, clusterScope *scope.ClusterScope) error {

[Stringls]

I do not know, but clusterctl move is just not working for me :)
Yes, it seems that hetzner secret is being created by CAPH controller following this line

cluster-api-provider-hetzner/controllers/hetznercluster_controller.go

Line 486 in f3ea17a

newSecret := corev1.Secret{

Anyway, I'll close the issue as my problem is related to CAPI in general. Thank you for answers!

[guettli]

@Stringls you can reach the cluster-api people in the Kube slack #cluster-api. Maybe someone has an answer for you.