Slightly change spec

api/v1alpha1/sealedvolume_types.go

@@ -26,8 +26,7 @@ import (
 // SealedVolumeSpec defines the desired state of SealedVolume
 type SealedVolumeSpec struct {
 	TPMHash     string                 `json:"TPMHash,omitempty"`
-	Label       string      `json:"label,omitempty"`
-	Passphrase  *SecretSpec `json:"passphraseRef,omitempty"`
+	Passphrase  map[string]*SecretSpec `json:"partitionSecrets,omitempty"`
 	Quarantined bool                   `json:"quarantined,omitempty"`
 }
 

api/v1alpha1/zz_generated.deepcopy.go

@@ -89,9 +89,19 @@ func (in *SealedVolumeSpec) DeepCopyInto(out *SealedVolumeSpec) {
 	*out = *in
 	if in.Passphrase != nil {
 		in, out := &in.Passphrase, &out.Passphrase
+		*out = make(map[string]*SecretSpec, len(*in))
+		for key, val := range *in {
+			var outVal *SecretSpec
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
 				*out = new(SecretSpec)
 				**out = **in
 			}
+			(*out)[key] = outVal
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SealedVolumeSpec.

examples/sealedvolume.yaml

@@ -15,8 +15,8 @@ metadata:
     namespace: default
 spec:
   TPMHash: "something"
-  label: "label"
-  passphraseRef: 
+  partitionSecrets:
+    LABEL:
       name: mysecret
       path: pass
   quarantined: false

pkg/challenger/challenger.go

@@ -87,10 +87,16 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
 
 			found := false
 			var volume keyserverv1alpha1.SealedVolume
+			var passsecret *keyserverv1alpha1.SecretSpec
 			for _, v := range volumeList.Items {
-				if hashEncoded == v.Spec.TPMHash && v.Spec.Label == label {
+				if hashEncoded == v.Spec.TPMHash {
+					for l, secretRef := range v.Spec.Passphrase {
+						if l == label {
 							found = true
 							volume = v
+							passsecret = secretRef
+						}
+					}
 				}
 			}
 
@@ -119,11 +125,10 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
 			writer, _ := conn.NextWriter(websocket.BinaryMessage)
 
 			if !volume.Spec.Quarantined {
-				secret, err := kclient.CoreV1().Secrets(namespace).Get(ctx, volume.Spec.Passphrase.Name, v1.GetOptions{})
+				secret, err := kclient.CoreV1().Secrets(namespace).Get(ctx, passsecret.Name, v1.GetOptions{})
 				if err == nil {
-					passphrase := secret.Data[volume.Spec.Passphrase.Path]
+					passphrase := secret.Data[passsecret.Path]
 					json.NewEncoder(writer).Encode(map[string]string{"passphrase": string(passphrase)})
-
 				}
 			} else {
 				conn.Close()