Set LTPA Job to match wlapp leader's config

controllers/ltpa_keys_sharing.go

@@ -237,7 +237,17 @@ func (r *ReconcileWebSphereLiberty) generateLTPAKeys(instance *wlv1.WebSphereLib
 					if err != nil {
 						return fmt.Errorf("Failed to create Job " + generateLTPAKeysJob.Name), ""
 					}
-				} else if err != nil {
+				} else if err == nil {
+					// If the LTPA Secret is not yet created (LTPA Job has not successfully completed)
+					// and the LTPA Job's configuration is outdated, retry LTPA generation with the new configuration
+					if lutils.IsLTPAJobConfigurationOutdated(generateLTPAKeysJob, instance) {
+						// Delete the Job request to restart the entire LTPA generation process (i.e. reloading the script, ltpa.xml, and Job)
+						err = r.DeleteResource(ltpaJobRequest)
+						if err != nil {
+							return err, ltpaSecret.Name
+						}
+					}
+				} else {
 					return fmt.Errorf("Failed to get Job " + generateLTPAKeysJob.Name), ""
 				}
 			}

utils/utils.go

@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"reflect"
 	"sort"
 	"strconv"
 	"strings"
@@ -661,6 +662,34 @@ func CustomizeLTPAServerXML(xmlSecret *corev1.Secret, la *wlv1.WebSphereLibertyA
 	xmlSecret.StringData[ltpaXMLFileName] = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<server>\n    <ltpa keysFileName=\"" + keysFileName + "/" + ltpaKeysFileName + "\" keysPassword=\"" + encryptedPassword + "\" />\n</server>"
 }
 
+// Returns true if the WebSphereApplication leader's state has changed, causing existing LTPA Jobs to need a configuration update, otherwise return false
+func IsLTPAJobConfigurationOutdated(job *v1.Job, appLeaderInstance *wlv1.WebSphereLibertyApplication) bool {
+	// The Job contains the leader's pull secret
+	if appLeaderInstance.GetPullSecret() != nil && *appLeaderInstance.GetPullSecret() != "" {
+		ltpaJobHasLeaderPullSecret := false
+		for _, objectReference := range job.Spec.Template.Spec.ImagePullSecrets {
+			if objectReference.Name == *appLeaderInstance.GetPullSecret() {
+				ltpaJobHasLeaderPullSecret = true
+			}
+		}
+		if !ltpaJobHasLeaderPullSecret {
+			return true
+		}
+	}
+	if len(job.Spec.Template.Spec.Containers) != 1 {
+		return true
+	}
+	// The Job matches the leader's pull policy
+	if job.Spec.Template.Spec.Containers[0].ImagePullPolicy != *appLeaderInstance.GetPullPolicy() {
+		return true
+	}
+	// The Job matches the leader's security context
+	if !reflect.DeepEqual(*job.Spec.Template.Spec.Containers[0].SecurityContext, *rcoutils.GetSecurityContext(appLeaderInstance)) {
+		return true
+	}
+	return false
+}
+
 func CustomizeLTPAJob(job *v1.Job, la *wlv1.WebSphereLibertyApplication, ltpaSecretName string, serviceAccountName string, ltpaScriptName string) {
 	encodingType := "aes" // the password encoding type for securityUtility (one of "xor", "aes", or "hash")
 	job.Spec.Template.ObjectMeta.Name = "liberty"