Secrets: Re-export and map domain errors into K8s API errors in ST client (#108226)

pkg/registry/apis/secret/contracts/secure_value.go

@@ -21,9 +21,8 @@ type DecryptSecureValue struct {
 }
 
 var (
-	ErrSecureValueNotFound            = errors.New("secure value not found")
-	ErrSecureValueAlreadyExists       = errors.New("secure value already exists")
-	ErrSecureValueOperationInProgress = errors.New("an operation is already in progress for the secure value")
+	ErrSecureValueNotFound      = errors.New("secure value not found")
+	ErrSecureValueAlreadyExists = errors.New("secure value already exists")
 )
 
 type ReadOpts struct {

pkg/registry/apis/secret/errors.go

@@ -0,0 +1,8 @@
+package secret
+
+import "github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
+
+var (
+	ErrSecureValueNotFound      = contracts.ErrSecureValueNotFound
+	ErrSecureValueAlreadyExists = contracts.ErrSecureValueAlreadyExists
+)

pkg/registry/apis/secret/secure_value_client.go

@@ -2,6 +2,7 @@ package secret
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	claims "github.com/grafana/authlib/types"
@@ -91,7 +92,7 @@ func (c *secureValueClient) Create(ctx context.Context, obj *unstructured.Unstru
 
 	createdSv, err := c.service.Create(ctx, sv, user.GetUID())
 	if err != nil {
-		return nil, err
+		return nil, c.mapError(err, sv.Name)
 	}
 
 	return toUnstructured(createdSv)
@@ -112,7 +113,7 @@ func (c *secureValueClient) Get(ctx context.Context, name string, _ metav1.GetOp
 
 	sv, err := c.service.Read(ctx, xkube.Namespace(c.namespace), name)
 	if err != nil {
-		return nil, err
+		return nil, c.mapError(err, name)
 	}
 
 	return toUnstructured(sv)
@@ -157,7 +158,7 @@ func (c *secureValueClient) Update(ctx context.Context, obj *unstructured.Unstru
 
 	updatedSv, _, err := c.service.Update(ctx, sv, user.GetUID())
 	if err != nil {
-		return nil, err
+		return nil, c.mapError(err, sv.Name)
 	}
 
 	return toUnstructured(updatedSv)
@@ -177,7 +178,7 @@ func (c *secureValueClient) Delete(ctx context.Context, name string, _ metav1.De
 	}
 
 	_, err := c.service.Delete(ctx, xkube.Namespace(c.namespace), name)
-	return err
+	return c.mapError(err, name)
 }
 
 // List all secure values in the namespace. Options and subresources are not supported and ignored.
@@ -192,7 +193,7 @@ func (c *secureValueClient) List(ctx context.Context, _ metav1.ListOptions) (*un
 
 	list, err := c.service.List(ctx, xkube.Namespace(c.namespace))
 	if err != nil {
-		return nil, err
+		return nil, c.mapError(err, "")
 	}
 
 	items := make([]unstructured.Unstructured, 0, len(list.Items))
@@ -240,6 +241,24 @@ func (c *secureValueClient) ApplyStatus(_ context.Context, _ string, _ *unstruct
 	return nil, fmt.Errorf("applyStatus is not supported")
 }
 
+// Maps an error from the domain to a K8s API Status error.
+func (c *secureValueClient) mapError(err error, name string) error {
+	if err == nil {
+		return nil
+	}
+
+	gr := secretv1beta1.SecureValuesResourceInfo.GroupResource()
+
+	switch {
+	case errors.Is(err, ErrSecureValueNotFound):
+		return apierrors.NewNotFound(gr, name)
+	case errors.Is(err, ErrSecureValueAlreadyExists):
+		return apierrors.NewAlreadyExists(gr, name)
+	}
+
+	return apierrors.NewInternalError(err)
+}
+
 func (c *secureValueClient) checkAccess(ctx context.Context, name, verb string) error {
 	gr := secretv1beta1.SecureValuesResourceInfo.GroupResource()
 

pkg/registry/apis/secret/secure_value_client_test.go

@@ -9,7 +9,6 @@ import (
 	"k8s.io/utils/ptr"
 
 	secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
-	"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
 	"github.com/grafana/grafana/pkg/registry/apis/secret/testutils"
 	"github.com/grafana/grafana/pkg/registry/apis/secret/validator"
 )
@@ -109,7 +108,9 @@ func TestIntegration_SecureValueClient_CRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	read, err = nsClient.Get(ctx, createdSv.Name, metav1.GetOptions{})
-	require.ErrorIs(t, err, contracts.ErrSecureValueNotFound)
+	var apiErr *apierrors.StatusError
+	require.ErrorAs(t, err, &apiErr)
+	require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonNotFound)
 	require.Nil(t, read)
 }