fix: predicate for push secret and do not set tags if undefined

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

pkg/controllers/pushsecret/pushsecret_controller.go

@@ -39,9 +39,12 @@ import (
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	esapi "github.com/external-secrets/external-secrets/apis/externalsecrets/v1alpha1"
@@ -86,12 +89,24 @@ type Reconciler struct {
 	ControllerClass string
 }
 
+type generationChangedOrDeletionPredicate struct {
+	predicate.GenerationChangedPredicate
+}
+
+func (generationChangedOrDeletionPredicate) Update(e event.UpdateEvent) bool {
+	if e.ObjectNew.GetDeletionTimestamp() != nil {
+		return true
+	}
+	return e.ObjectNew.GetGeneration() != e.ObjectOld.GetGeneration()
+}
+
 // storeInfo holds the identifying attributes of a secret store for per-store processing.
 type storeInfo struct {
 	Name   string
 	Kind   string
 	Labels map[string]string
 }
+}
 
 // SetupWithManager sets up the controller with the Manager.
 // It configures the controller to watch PushSecret resources and
@@ -129,7 +144,7 @@ func (r *Reconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, opt
 
 	return ctrl.NewControllerManagedBy(mgr).
 		WithOptions(opts).
-		For(&esapi.PushSecret{}).
+		For(&esapi.PushSecret{}, builder.WithPredicates(generationChangedOrDeletionPredicate{})).
 		Complete(r)
 }
 

providers/v1/aws/secretsmanager/secretsmanager.go

@@ -658,8 +658,16 @@ func (sm *SecretsManager) putSecretValueWithContext(ctx context.Context, secretA
 	return err
 }
 
-func (sm *SecretsManager) patchTags(ctx context.Context, metadata *apiextensionsv1.JSON, secretID *string, tags map[string]string) error {
-	meta, err := sm.constructMetadataWithDefaults(metadata)
+func (sm *SecretsManager) patchTags(ctx context.Context, rawMetadata *apiextensionsv1.JSON, secretID *string, tags map[string]string) error {
+	rawMeta, err := metadata.ParseMetadataParameters[PushSecretMetadataSpec](rawMetadata)
+	if err != nil {
+		return err
+	}
+	if rawMeta == nil || len(rawMeta.Spec.Tags) == 0 {
+		return nil
+	}
+
+	meta, err := sm.constructMetadataWithDefaults(rawMetadata)
 	if err != nil {
 		return err
 	}