fix(secret): stop pulp-server Secret churn from nondeterministic map iteration

controllers/repo_manager/secret.go

@@ -620,24 +620,19 @@ func debugLogging(resources controllers.FunctionResources, pulpSettings *string)
 // needsMigrationSetting defines settings.py with some specific configurations that when changed will
 // also trigger a migration job
 func needsMigrationSetting(resources controllers.FunctionResources, pulpSettings *string, customSettings map[string]struct{}) {
-	for operatorFieldName, pulpFieldName := range controllers.MigrationSettingsList() {
-		customSettingsFound := false
-		if _, exists := customSettings[pulpFieldName]; exists {
-			logMessage := fmt.Sprintf("%v should not be defined in custom_pulp_settings. Use pulp.Spec.%v instead", pulpFieldName, strings.ToLower(pulpFieldName))
+	for _, s := range controllers.MigrationSettingsList() {
+		if _, exists := customSettings[s.PulpField]; exists {
+			logMessage := fmt.Sprintf("%v should not be defined in custom_pulp_settings. Use pulp.Spec.%v instead", s.PulpField, strings.ToLower(s.PulpField))
 			controllers.CustomZapLogger().Warn(logMessage)
-			customSettingsFound = true
-		}
-		if customSettingsFound {
 			continue
 		}
 
-		config := reflect.ValueOf(resources.Pulp.Spec).FieldByName(operatorFieldName).Bool()
+		config := reflect.ValueOf(resources.Pulp.Spec).FieldByName(s.OperatorField).Bool()
 		if !config {
-			return
+			continue
 		}
 		configCapitalized := cases.Title(language.English, cases.Compact).String(strconv.FormatBool(config))
-		*pulpSettings = *pulpSettings + fmt.Sprintf("%v = %v\n", pulpFieldName, configCapitalized)
-
+		*pulpSettings = *pulpSettings + fmt.Sprintf("%v = %v\n", s.PulpField, configCapitalized)
 	}
 }
 

controllers/utils.go

@@ -297,25 +297,33 @@ func StorageTypeChanged(pulp *pulpv1.Pulp) bool {
 	return currentStorageType != definedStorageType[0]
 }
 
-// MigrationSettingsList returns a map[string]string of configurations that should trigger a migration job
-// note: in the current implementation, all fields should be boolean. Trying to add a non-bool field
+// MigrationSetting pairs a Pulp CR field name (on Spec/Status) with the
+// corresponding setting key written to settings.py.
+type MigrationSetting struct {
+	OperatorField string
+	PulpField     string
+}
+
+// MigrationSettingsList returns the configurations that should trigger a migration job,
+// in a stable, deterministic order.
+// Note: in the current implementation, all fields should be boolean. Trying to add a non-bool field
 // to the list will fail SettingNeedsMigrationChanged execution.
-func MigrationSettingsList() map[string]string {
-	return map[string]string{
-		"RedirectToObjectStorage":  "REDIRECT_TO_OBJECT_STORAGE",
-		"HideGuardedDistributions": "HIDE_GUARDED_DISTRIBUTIONS",
+func MigrationSettingsList() []MigrationSetting {
+	return []MigrationSetting{
+		{"HideGuardedDistributions", "HIDE_GUARDED_DISTRIBUTIONS"},
+		{"RedirectToObjectStorage", "REDIRECT_TO_OBJECT_STORAGE"},
 	}
 }
 
 // SettingNeedsMigrationChanged verifies if a Pulp setting that needs migration has been modified
 // returns a list with the settings modified
 func SettingNeedsMigrationChanged(pulp *pulpv1.Pulp) []string {
 	settingsChanged := []string{}
-	for setting := range MigrationSettingsList() {
-		currentSpec := reflect.ValueOf(pulp.Spec).FieldByName(setting).Bool()
-		oldSpec := reflect.ValueOf(pulp.Status).FieldByName(setting).Bool()
+	for _, s := range MigrationSettingsList() {
+		currentSpec := reflect.ValueOf(pulp.Spec).FieldByName(s.OperatorField).Bool()
+		oldSpec := reflect.ValueOf(pulp.Status).FieldByName(s.OperatorField).Bool()
 		if currentSpec != oldSpec {
-			settingsChanged = append(settingsChanged, setting)
+			settingsChanged = append(settingsChanged, s.OperatorField)
 		}
 	}
 	return settingsChanged