How to reconsile User Credentails when using secret reference

[rowi1de]

I'm using a similar setup as described here: https://www.rabbitmq.com/kubernetes/operator/using-topology-operator.html#users-permissions

apiVersion: v1
kind: Secret
metadata:
  name: credentials-secret
type: Opaque
stringData:
  username: import-user-sample # Note that Messaging Topology Operator does not watch this secret. Updating this secret object won't update actual user credentials.
  password: whyareyoulookinghere # As a workaround, you can add a label or annotation to the User object to trigger a Reconile loop and credentials will be updated.
---
apiVersion: rabbitmq.com/v1beta1
kind: User
metadata:
  name: import-user-sample
spec:
  tags:
  - management # available tags are 'management', 'policymaker', 'monitoring' and 'administrator'
  - policymaker
  rabbitmqClusterReference:
    name: test # rabbitmqCluster must exist in the same namespace as this resource
  importCredentialsSecret:
    name: credentials-secret

https://github.com/rabbitmq/messaging-topology-operator/tree/main/docs/examples/users
https://github.com/rabbitmq/messaging-topology-operator/blob/main/docs/examples/users/userPreDefinedCreds.yaml#L8C17-L8C17

Note that the Operator does not monitor the generated secret object and updating the secret object won't update the credentials. As a workaround, add a label or annotation to users.rabbitmq.com object to trigger the Operator to reconcile.

The docs or examples don't specify what annotation or label needs to be added to the user to allow reconcile?
I wasn't able to find it in examples or docs

[rowi1de]

I misunderstood the documentation, the workaround is just to modify the User object so the operator while reconcile including the credentials.

To trigger the Operator to reconcile and update the credentials, you can add a label or annotation to the users.rabbitmq.com object. Labels and annotations are metadata that can be attached to Kubernetes resources to provide additional information. By modifying the users.rabbitmq.com object with a label or annotation, you signal to the Operator that changes have occurred and it needs to reconcile the credentials.

[Zerpet]

As you figured, any label would do the trick.

Note that the Operator does not monitor the generated secret object and updating the secret object won't update the credentials. As a workaround, add a label or annotation to users.rabbitmq.com object to trigger the Operator to reconcile.

This is slightly outdated. It is true that the Operator does not monitor the Secret object and it won't update the User based on updates to the Secret; however, I believe that if configured to perform periodic reconcile, it will update the User. You can configure the Topology Operator to perform periodic reconcile using the SYNC_PERIOD environment variable in the Topology manifest.

https://rabbitmq.com/kubernetes/operator/install-topology-operator.html#parameters