func (r *EncryptionKeysReconciler) triggerTemplateUpdate(
	ctx context.Context, clusterName string, secret *corev1.Secret,
) {
	log.Info(
		"Triggering template updates on all the managed cluster policies that use encryption", "cluster", clusterName,
	)

	policies := policyv1.PolicyList{}
	// Get all the policies in the cluster namespace
	err := retry.Do(
		func() error {
			return r.List(ctx, &policies, client.InNamespace(clusterName))
		},
		common.GetRetryOptions(log.V(1), "Retrying to list the managed cluster policy templates", retries+1)...,
	)
	if err != nil {
		log.Error(err, "Failed to trigger all the policies to be reprocessed after the key rotation")

		return
	}

	// Setting this value to something unique for this key rotation ensures the annotation will be updated to
	// a new value and thus trigger an update
	value := fmt.Sprintf("rotate-key-%s-%s", clusterName, secret.Annotations[propagator.LastRotatedAnnotation])
	patch := []byte(`{"metadata":{"annotations":{"` + propagator.TriggerUpdateAnnotation + `":"` + value + `"}}}`)

	for _, policy := range policies.Items {
		// If the policy does not have the initialization vector annotation, then encryption is not
		// used and thus doesn't need to be reprocessed
		if _, ok := policy.Annotations[propagator.IVAnnotation]; !ok {
			continue
		}

		// Find the root policy to patch with the annotation
		rootPlcName := policy.GetLabels()[common.RootPolicyLabel]
		if rootPlcName == "" {
			log.Info(
				"The replicated policy does not have the root policy label set",
				"policy", policy.ObjectMeta.Name,
				"label", common.RootPolicyLabel,
			)

			continue
		}

		rootPolicy := &policyv1.Policy{
			ObjectMeta: metav1.ObjectMeta{
				Namespace: strings.Split(rootPlcName, ".")[0],
				Name:      strings.Split(rootPlcName, ".")[1],
			},
		}

		err := retry.Do(
			func() error {
				return r.Patch(ctx, rootPolicy, client.RawPatch(types.MergePatchType, patch))
			},
			common.GetRetryOptions(
				log.V(1), "Retrying to trigger the policy templates to be reprocessed", retries+1,
			)...,
		)
		if err != nil {
			log.Error(
				err,
				"Failed to trigger the policy to be reprocessed after the key rotation",
				"policyName",
				rootPlcName,
			)
		}
	}
}
// triggerTemplateUpdate finds all the policies that this managed cluster uses that use encryption.
// It then updates those root policies with the trigger-update annotation to cause the policies to
// be reprocessed with the new key.
triggerTemplateUpdate finds all the policies that this managed cluster uses that use encryption.
It then updates those root policies with the trigger-update annotation to cause the policies to
be reprocessed with the new key.
// triggerTemplateUpdate finds all the policies that this managed cluster uses that use encryption . // It then updates those root policies with the trigger - update annotation to cause the policies to // be reprocessed with the new key .
func (r *EncryptionKeysReconciler) triggerTemplateUpdate(
	ctx context.Context, clusterName string, secret *corev1.Secret,
) {
	log.Info(
		"Triggering template updates on all the managed cluster policies that use encryption", "cluster", clusterName,
	)
	policies := policyv1.PolicyList{}
	err := retry.Do(
		func() error {
			return r.List(ctx, &policies, client.InNamespace(clusterName))
		},
		common.GetRetryOptions(log.V(1), "Retrying to list the managed cluster policy templates", retries+1)...,
	)
	if err != nil {
		log.Error(err, "Failed to trigger all the policies to be reprocessed after the key rotation")
		return
	}
	value := fmt.Sprintf("rotate-key-%s-%s", clusterName, secret.Annotations[propagator.LastRotatedAnnotation])
	patch := []byte(`{"metadata":{"annotations":{"` + propagator.TriggerUpdateAnnotation + `":"` + value + `"}}}`)
	for _, policy := range policies.Items {
		if _, ok := policy.Annotations[propagator.IVAnnotation]; !ok {
			continue
		}
		rootPlcName := policy.GetLabels()[common.RootPolicyLabel]
		if rootPlcName == "" {
			log.Info(
				"The replicated policy does not have the root policy label set",
				"policy", policy.ObjectMeta.Name,
				"label", common.RootPolicyLabel,
			)
			continue
		}
		rootPolicy := &policyv1.Policy{
			ObjectMeta: metav1.ObjectMeta{
				Namespace: strings.Split(rootPlcName, ".")[0],
				Name:      strings.Split(rootPlcName, ".")[1],
			},
		}
		err := retry.Do(
			func() error {
				return r.Patch(ctx, rootPolicy, client.RawPatch(types.MergePatchType, patch))
			},
			common.GetRetryOptions(
				log.V(1), "Retrying to trigger the policy templates to be reprocessed", retries+1,
			)...,
		)
		if err != nil {
			log.Error(
				err,
				"Failed to trigger the policy to be reprocessed after the key rotation",
				"policyName",
				rootPlcName,
			)
		}
	}
}
func ( r * EncryptionKeysReconciler ) triggerTemplateUpdate ( ctx context . Context , clusterName string , secret * corev1 . Secret , ) { log . Info ( " " , " " , clusterName , ) policies := policyv1 . PolicyList { } err := retry . Do ( func ( ) error { return r . List ( ctx , & policies , client . InNamespace ( clusterName ) ) } , common . GetRetryOptions ( log . V ( 1 ) , " " , retries + 1 ) ... , ) if err != nil { log . Error ( err , " " ) return } value := fmt . Sprintf ( " " , clusterName , secret . Annotations [ propagator . LastRotatedAnnotation ] ) patch := [ ] byte ( `{"metadata":{"annotations":{"` + propagator . TriggerUpdateAnnotation + `":"` + value + `"}}}` ) for _ , policy := range policies . Items { if _ , ok := policy . Annotations [ propagator . IVAnnotation ] ; ! ok { continue } rootPlcName := policy . GetLabels ( ) [ common . RootPolicyLabel ] if rootPlcName == " " { log . Info ( " " , " " , policy . ObjectMeta . Name , " " , common . RootPolicyLabel , ) continue } rootPolicy := & policyv1 . Policy { ObjectMeta : metav1 . ObjectMeta { Namespace : strings . Split ( rootPlcName , " " ) [ 0 ] , Name : strings . Split ( rootPlcName , " " ) [ 1 ] , } , } err := retry . Do ( func ( ) error { return r . Patch ( ctx , rootPolicy , client . RawPatch ( types . MergePatchType , patch ) ) } , common . GetRetryOptions ( log . V ( 1 ) , " " , retries + 1 , ) ... , ) if err != nil { log . Error ( err , " " , " " , rootPlcName , ) } } }
triggerTemplateUpdate finds all the policies that this managed cluster uses that use encryption.
triggerTemplateUpdate finds all the policies that this managed cluster uses that use encryption .
// Get all the policies in the cluster namespace // Setting this value to something unique for this key rotation ensures the annotation will be updated to // a new value and thus trigger an update // If the policy does not have the initialization vector annotation, then encryption is not // used and thus doesn't need to be reprocessed // Find the root policy to patch with the annotation