User password not updated when rotated

[PaulusTM]

Describe the bug

We use Azure Keyvault to store the rabbitmq user secret so our application can connect to the rabbitmq cluster, however, after the initial generation of the user with the User object, the password does not get updated when its rotated.

To Reproduce

Steps to reproduce the behavior:

1. rabbitmq-secrets is available as k8s secret from Azure Keyvault
2. Rabbitmq user is created, also rabbitmq-user-user-credentials is created
3. Rotate secret in Keyvault that updates password value in rabbitmq-secrets
4. Rabbitmq user doesn't get updated.

Include any YAML or manifest necessary to reproduce the problem.

apiVersion: rabbitmq.com/v1beta1
kind: User
metadata:
  name: rabbitmq-user
spec:
  tags:
    - management
    - policymaker
  rabbitmqClusterReference:
    name: app-rabbitmq
  importCredentialsSecret:
    name: rabbitmq-secrets

Expected behavior
After the password value in rabbitmq-secrets is updated I expect the operator to update the field in rabbitmq-user-user-credentials as well and update the Rabbitmq user.

Version and environment information

• Messaging Topology Operator: 1.7.1
• RabbitMQ: 3.10.1
• RabbitMQ Cluster Operator: 1.14.0
• Kubernetes: v1.22.6
• Cloud provider or hardware configuration: Azure AKS

[ChunyiLyu]

Hi @PaulusTM, this is a miss from our documentation side that we forgot to document this behavior. I've now updated the docs and the users.rabbitmq.com example. Thanks for catching it!

In the mean time, as workarounds, you can:

1. when you would like to update user creds, add a label or annotation to users.rabbitmq.com to trigger a Reconcile look
2. configure time based reconciliation (this will be applied to all objects, not just users.rabbitmq.com). See: https://www.rabbitmq.com/kubernetes/operator/using-topology-operator.html#sync-period

Feel free to submit a PR to implement this feature if workarounds are not sufficient.

[PaulusTM]

Hi @ChunyiLyu,

Thnx! can the label or annotation be any key/value or do we need to use specifics here?

[ChunyiLyu]

@PaulusTM any key will do. The Operator will reconcile when it observes any update to objects (users.rabbitmq.com in this case) it watches. Labels/annotations are the easiest way to update the object without actually updating any configurations.

[ChunyiLyu]

Closing this issue now since there is a workaround. @PaulusTM let me know if you would let me to reopen the issue!