enable opt-in to redact Secret data from Object status

[ravilr]

Description of your changes

Fixes #178

• Adds a new flag --sanitize-secrets when set in controllerConfig/deploymentRuntimeConfig of provider-kubernetes, redacts the Secret data from Object status.atProvider.manifest.

• the new redact behavior is off by default so as to not break any existing compositions relying on status.atProvider.manifest.data for patches. Usages meant to shuttling observed secret data to/from remote/control-plane clusters can be updated to use spec.references[].patchesFrom or spec.connectionDetails and avoid leaking secret data to Object MR status resources.

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

• make test and make e2e

Updating the provider-kubernetes's deploymentRuntimeConfig with below additional arg:

         args:
           ......
+          - '--sanitize-secrets'

$ kubectl get provider.pkg provider-kubernetes
NAME                  INSTALLED   HEALTHY   PACKAGE                                           
provider-kubernetes   True        True      ravilr/provider-kubernetes:v0.11.6

will reconcile any existing and new Object resources managing Secrets to have their status.atProvider.manifest.data redacted:

apiVersion: kubernetes.crossplane.io/v1alpha2
kind: Object
metadata:
  annotations:
    crossplane.io/composition-resource-name: credential-secret
    crossplane.io/external-create-pending: "2024-02-07T07:29:20Z"
    crossplane.io/external-create-succeeded: "2024-02-07T07:29:20Z"
    crossplane.io/external-name: provider-token-nkm7s-9wlpl
  creationTimestamp: "2024-02-07T07:29:21Z"
  finalizers:
  - finalizer.managedresource.crossplane.io
  generateName: provider-token-nkm7s-
  generation: 2
  labels:
    crossplane.io/claim-name: provider-token
    crossplane.io/claim-namespace: awsuswest2-admin
    crossplane.io/composite: provider-token-nkm7s
  name: provider-token-nkm7s-9wlpl
  ownerReferences:
  - apiVersion: security.example.com/v1
    blockOwnerDeletion: true
    controller: true
    kind: XCredential
    name: provider-token-nkm7s
    uid: 1569a117-9227-4567-8db3-259e18171da5
  resourceVersion: "86940719"
  uid: 7ce9094d-f06a-4c9d-8e66-3f1a41544893
spec:
  deletionPolicy: Delete
  forProvider:
    manifest:
      apiVersion: v1
      kind: Secret
      metadata:
        name: provider-token
        namespace: awsuswest2-admin
      stringData:
        createdBy: provider-token-nkm7s
      type: Opaque
  managementPolicies:
  - '*'
  providerConfigRef:
    name: example
  readiness:
    policy: SuccessfulCreate
status:
  atProvider:
    manifest:
      apiVersion: v1
      data:
        redacted: null      #<<<<<<<<<======== this is the impact of this change.
      kind: Secret
      metadata:
        ......
      type: Opaque
  conditions:
  - lastTransitionTime: "2024-02-07T07:29:21Z"
    reason: Available
    status: "True"
    type: Ready
  - lastTransitionTime: "2024-02-07T07:29:21Z"
    reason: ReconcileSuccess
    status: "True"
    type: Synced

[ravilr]

@lsviben @bobh66 PTAL.

[turkenh]

Looking great, thanks @ravilr 🙌

[ravilr]

@turkenh looks like the CI jobs are failing since minimum go version in go.mod was updated to 1.21. Does https://github.com/crossplane-contrib/provider-kubernetes/blob/main/.github/workflows/ci.yml#L13 needs update to 1.21.7 ? Thanks.

[turkenh]

Yes, I think I forgot it in my previous PR. It would be great if you could do it here 🙏

[ravilr]

Yes, I think I forgot it in my previous PR. It would be great if you could do it here 🙏

Done.