fix: strip managed fields from cached Secrets as well

Author: Herbaert

cmd/manager/main.go

@@ -63,19 +63,23 @@ func init() {
 // controllers watch Secrets — credentials, bootstrap data and the bastion
 // cloud-init — and a watch only needs an object's identity to enqueue a
 // reconcile, never its contents, so caching credential bytes in memory buys
-// nothing and exposes them to anything that can read the process.
+// nothing and exposes them to anything that can read the process. Managed
+// fields go with them: nothing here reads them, and they are usually the
+// largest part of what is left once the data is gone.
 //
 // Deliberately no label selector on the entry, unlike Cluster API's own
-// equivalent in internal/setup: the Secrets this provider watches carry no
-// common label, so restricting the cache by one would silently stop the
-// watches from firing rather than only hardening them.
+// equivalent in internal/setup. Cluster API only watches Secrets it stamps
+// itself, whereas the credentials and bastion cloud-init Secrets here are
+// created by the user and carry no labels, so a selector would silently stop
+// those watches from firing rather than only hardening the cache.
 func managerCacheOptions() cache.Options {
 	return cache.Options{
 		ByObject: map[client.Object]cache.ByObject{
 			&corev1.Secret{}: {
 				Transform: func(in any) (any, error) {
 					if secret, ok := in.(*corev1.Secret); ok {
 						secret.Data = nil
+						secret.SetManagedFields(nil)
 					}
 					return in, nil
 				},

cmd/manager/main_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 )
 
@@ -40,6 +41,9 @@ func TestManagerCacheOptionsStripsSecretData(t *testing.T) {
 	}
 
 	out, err := transform(&corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			ManagedFields: []metav1.ManagedFieldsEntry{{Manager: "kubectl", Operation: metav1.ManagedFieldsOperationUpdate}},
+		},
 		Data: map[string][]byte{"credentials": []byte("service-account-key")},
 	})
 	if err != nil {
@@ -52,6 +56,9 @@ func TestManagerCacheOptionsStripsSecretData(t *testing.T) {
 	if secret.Data != nil {
 		t.Errorf("Transform left Secret data in the cache: %v", secret.Data)
 	}
+	if secret.ManagedFields != nil {
+		t.Errorf("Transform left managed fields in the cache: %v", secret.ManagedFields)
+	}
 }
 
 // The Transform runs on everything committed to the Secret informer, including