perf(operator): stop caching the content of every Secret in the cluster

cmd/main.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -121,11 +122,7 @@ func main() {
 		// runs when a secret's content actually changed.
 		Client: client.Options{
 			Cache: &client.CacheOptions{
-				DisableFor: []client.Object{
-					&appsv1.Deployment{},
-					&appsv1.StatefulSet{},
-					&appsv1.DaemonSet{},
-				},
+				DisableFor: uncachedReadKinds(),
 			},
 		},
 	})
@@ -191,6 +188,15 @@ func fmtNs(ns string) string {
 	return fmt.Sprintf("%q", ns)
 }
 
+func uncachedReadKinds() []client.Object {
+	return []client.Object{
+		&appsv1.Deployment{},
+		&appsv1.StatefulSet{},
+		&appsv1.DaemonSet{},
+		&corev1.Secret{},
+	}
+}
+
 func validateReconcileTimeout(d time.Duration) error {
 	floor := ferrvault.DefaultRetryPolicy().LongestCall(ferrvault.RequestTimeout)
 	if d < floor {

cmd/main_test.go

@@ -3,6 +3,8 @@ package main
 import (
 	"testing"
 	"time"
+
+	corev1 "k8s.io/api/core/v1"
 )
 
 func TestReconcileTimeoutCannotDisableTheGuardrail(t *testing.T) {
@@ -18,3 +20,12 @@ func TestTheDefaultReconcileTimeoutIsAccepted(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestSecretsAreNeverServedFromTheTypedCache(t *testing.T) {
+	for _, obj := range uncachedReadKinds() {
+		if _, ok := obj.(*corev1.Secret); ok {
+			return
+		}
+	}
+	t.Fatal("Secret reads go through the cache, which holds every Secret in the cluster in memory")
+}

internal/controller/ferrvaultconnection_controller.go

@@ -239,7 +239,7 @@ func (r *FerrVaultConnectionReconciler) SetupWithManager(mgr ctrl.Manager) error
 				}
 				return reqs
 			}),
-			builder.WithPredicates(),
+			builder.OnlyMetadata,
 		).
 		Named("ferrvaultconnection").
 		Complete(r)

internal/controller/ferrvaultsecret_controller.go

@@ -278,14 +278,15 @@ func (r *FerrVaultSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&fvv1alpha1.FerrVaultSecret{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})).
-		Owns(&corev1.Secret{}).
+		Owns(&corev1.Secret{}, builder.OnlyMetadata).
 		Watches(
 			&fvv1alpha1.FerrVaultConnection{},
 			handler.EnqueueRequestsFromMapFunc(r.secretsReferencingConnection),
 		).
 		Watches(
 			&corev1.Secret{},
 			handler.EnqueueRequestsFromMapFunc(r.secretsReferencingTokenSecret),
+			builder.OnlyMetadata,
 		).
 		Named("ferrvaultsecret").
 		Complete(r)