Add SecretRef to IgnitionConfig

go.mod

@@ -10,6 +10,7 @@ require (
 	github.com/gardener/gardener v1.103.0
 	github.com/gardener/machine-controller-manager v0.53.1
 	github.com/go-logr/logr v1.4.2
+	github.com/imdario/mergo v0.3.16
 	github.com/ironcore-dev/controller-utils v0.9.4
 	github.com/ironcore-dev/vgopath v0.1.7
 	github.com/onsi/ginkgo/v2 v2.21.0
@@ -30,6 +31,7 @@ require (
 	k8s.io/utils v0.0.0-20240902221715-702e33fdd3c3
 	sigs.k8s.io/controller-runtime v0.17.6
 	sigs.k8s.io/controller-tools v0.14.0
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
@@ -71,7 +73,6 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -130,5 +131,4 @@ require (
 	k8s.io/metrics v0.29.8 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
 )

hack/api-reference/api.md

@@ -341,6 +341,20 @@ string
 </tr>
 <tr>
 <td>
+<code>secretRef</code></br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#localobjectreference-v1-core">
+Kubernetes core/v1.LocalObjectReference
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>SecretRef is a reference to a secret containing the ignition config.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>override</code></br>
 <em>
 bool

hack/api-reference/config.md

@@ -46,7 +46,9 @@ string
 <td>
 <code>clientConnection</code></br>
 <em>
-invalid type
+<a href="https://godoc.org/k8s.io/component-base/config/v1alpha1#ClientConnectionConfiguration">
+Kubernetes v1alpha1.ClientConnectionConfiguration
+</a>
 </em>
 </td>
 <td>
@@ -72,7 +74,9 @@ ETCD
 <td>
 <code>healthCheckConfig</code></br>
 <em>
-invalid type
+<a href="https://github.com/gardener/gardener/extensions/pkg/apis/config">
+github.com/gardener/gardener/extensions/pkg/apis/config/v1alpha1.HealthCheckConfig
+</a>
 </em>
 </td>
 <td>
@@ -205,7 +209,9 @@ string
 <td>
 <code>capacity</code></br>
 <em>
-invalid type
+<a href="https://godoc.org/k8s.io/apimachinery/pkg/api/resource#Quantity">
+k8s.io/apimachinery/pkg/api/resource.Quantity
+</a>
 </em>
 </td>
 <td>

pkg/apis/metal/types_worker.go

@@ -4,6 +4,7 @@
 package metal
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -47,6 +48,7 @@ type MachineImage struct {
 
 // IgnitionConfig contains ignition settings.
 type IgnitionConfig struct {
-	Raw      string
-	Override bool
+	Raw       string
+	SecretRef *corev1.LocalObjectReference
+	Override  bool
 }

pkg/apis/metal/v1alpha1/types_worker.go

@@ -4,6 +4,7 @@
 package v1alpha1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -54,6 +55,10 @@ type IgnitionConfig struct {
 	// +optional
 	Raw string `json:"raw,omitempty"`
 
+	// SecretRef is a reference to a secret containing the ignition config.
+	// +optional
+	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`
+
 	// Override configures, if ignition keys set by the os-extension are overridden
 	// by extra ignition.
 	// +optional

pkg/controller/worker/machines.go

@@ -13,11 +13,13 @@ import (
 	v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
 	"github.com/gardener/gardener/pkg/apis/extensions/v1alpha1"
 	machinecontrollerv1alpha1 "github.com/gardener/machine-controller-manager/pkg/apis/machine/v1alpha1"
+	"github.com/imdario/mergo"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/yaml"
 
 	metalv1alpha1 "github.com/ironcore-dev/gardener-extension-provider-metal/pkg/apis/metal/v1alpha1"
 	"github.com/ironcore-dev/gardener-extension-provider-metal/pkg/metal"
@@ -118,9 +120,14 @@ func (w *workerDelegate) generateMachineClassAndSecrets(ctx context.Context) ([]
 			metal.ImageFieldName:        machineImage,
 			metal.ServerLabelsFieldName: serverLabels,
 		}
+
 		if workerConfig.ExtraIgnition != nil {
-			machineClassProviderSpec[metal.IgnitionFieldName] = workerConfig.ExtraIgnition.Raw
-			machineClassProviderSpec[metal.IgnitionOverrideFieldName] = workerConfig.ExtraIgnition.Override
+			if mergedIgnition, err := w.mergeIgnitionConfig(ctx, workerConfig); err != nil {
+				return nil, nil, err
+			} else if mergedIgnition != "" {
+				machineClassProviderSpec[metal.IgnitionFieldName] = mergedIgnition
+				machineClassProviderSpec[metal.IgnitionOverrideFieldName] = workerConfig.ExtraIgnition.Override
+			}
 		}
 
 		for zoneIndex, zone := range pool.Zones {
@@ -227,3 +234,53 @@ func (w *workerDelegate) getServerLabelsForMachine(machineType string, workerCon
 	}
 	return combinedLabels, nil
 }
+
+func (w *workerDelegate) mergeIgnitionConfig(ctx context.Context, workerConfig *metalv1alpha1.WorkerConfig) (string, error) {
+	rawIgnition := &map[string]interface{}{}
+
+	if workerConfig.ExtraIgnition.Raw != "" {
+		if err := yaml.Unmarshal([]byte(workerConfig.ExtraIgnition.Raw), rawIgnition); err != nil {
+			return "", err
+		}
+	}
+
+	if workerConfig.ExtraIgnition.SecretRef != nil {
+		secret := &corev1.Secret{}
+		secretKey := client.ObjectKey{Namespace: w.worker.Namespace, Name: workerConfig.ExtraIgnition.SecretRef.Name}
+		if err := w.client.Get(ctx, secretKey, secret); err != nil {
+			return "", fmt.Errorf("failed to get ignition secret %s: %w", workerConfig.ExtraIgnition.SecretRef, err)
+		}
+
+		secretContent, ok := secret.Data[metal.IgnitionFieldName]
+		if !ok {
+			return "", fmt.Errorf("ignition key not found in secret %s", workerConfig.ExtraIgnition.SecretRef)
+		}
+
+		ignitionSecret := map[string]interface{}{}
+
+		if err := yaml.Unmarshal(secretContent, &ignitionSecret); err != nil {
+			return "", err
+		}
+
+		// append ignition
+		opt := mergo.WithAppendSlice
+
+		// merge both ignitions
+		err := mergo.Merge(rawIgnition, ignitionSecret, opt)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	// avoid converting empty string to an empty map with non-zero length
+	if len(*rawIgnition) == 0 {
+		return "", nil
+	}
+
+	mergedIgnition, err := yaml.Marshal(rawIgnition)
+	if err != nil {
+		return "", err
+	}
+
+	return string(mergedIgnition), nil
+}

pkg/controller/worker/machines_test.go

@@ -35,6 +35,15 @@ var _ = Describe("Machines", func() {
 			workerDelegate     genericworkeractuator.WorkerDelegate
 		)
 
+		dataYml := map[string]any{
+			"a": map[string]any{
+				"b": "foo",
+				"c": "bar",
+			},
+		}
+		yamlString, err := mapToString(dataYml)
+		Expect(err).NotTo(HaveOccurred())
+
 		BeforeEach(func(ctx SpecContext) {
 			// TODO: Fix machine pool hashing
 			workerPoolHash, err := worker.WorkerPoolHash(pool, testCluster, nil, nil)
@@ -76,7 +85,7 @@ var _ = Describe("Machines", func() {
 					"foo":  "bar",
 					"foo1": "bar1",
 				},
-				metal.IgnitionFieldName:         "abc",
+				metal.IgnitionFieldName:         yamlString,
 				metal.IgnitionOverrideFieldName: true,
 			}