func newUserSecret(cr *v1alpha1.RethinkDBCluster, username string) (*corev1.Secret, error) {
	psswd, err := password.Generate(16, 4, 0, false, false)
	if err != nil {
		return nil, err
	}
	secret := newSecret(cr)
	secret.ObjectMeta.Name = fmt.Sprintf("%s-%s", cr.ObjectMeta.Name, username)
	secret.Data = map[string][]byte{
		RethinkDBUsernameKey: []byte(username),
		RethinkDBPasswordKey: []byte(psswd),
	}
	return secret, nil
}
newUserSecret creates a new Opaque secret for the given username and RethinkDBCluster.
package rethinkdbcluster
import (
	"crypto/rsa"
	"crypto/x509"
	"fmt"
	"github.com/jmckind/rethinkdb-operator/pkg/apis/rethinkdb/v1alpha1"
	tlsutil "github.com/operator-framework/operator-sdk/pkg/tls"
	"github.com/sethvargo/go-password/password"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
func newCASecret(cr *v1alpha1.RethinkDBCluster, name string) (*corev1.Secret, error) {
	secret := newTLSSecret(cr, name)
	key, err := newPrivateKey()
	if err != nil {
		return nil, err
	}
	cert, err := newSelfSignedCACertificate(key)
	if err != nil {
		return nil, err
	}
	secret.Data = map[string][]byte{
		corev1.TLSCertKey:       encodeCertificatePEM(cert),
		corev1.TLSPrivateKeyKey: encodePrivateKeyPEM(key),
	}
	return secret, nil
}
func newCertificateSecret(cr *v1alpha1.RethinkDBCluster, name string, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*corev1.Secret, error) {
	secret := newTLSSecret(cr, name)
	key, err := newPrivateKey()
	if err != nil {
		return nil, err
	}
	cfg := &tlsutil.CertConfig{
		CertName:     name,
		CertType:     tlsutil.ClientAndServingCert,
		CommonName:   name,
		Organization: []string{cr.ObjectMeta.Namespace},
	}
	dnsNames := []string{
		cr.ObjectMeta.Name,
		fmt.Sprintf("%s.%s.svc.cluster.local", cr.ObjectMeta.Name, cr.ObjectMeta.Namespace),
	}
	cert, err := newSignedCertificate(cfg, dnsNames, key, caCert, caKey)
	if err != nil {
		return nil, err
	}
	secret.Data = map[string][]byte{
		corev1.TLSCertKey:       encodeCertificatePEM(cert),
		corev1.TLSPrivateKeyKey: encodePrivateKeyPEM(key),
	}
	return secret, nil
}
func newSecret(cr *v1alpha1.RethinkDBCluster) *corev1.Secret {
	return &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      cr.Name,
			Namespace: cr.Namespace,
			Labels:    labelsForCluster(cr),
		},
		Type: corev1.SecretTypeOpaque,
	}
}
func newTLSSecret(cr *v1alpha1.RethinkDBCluster, name string) *corev1.Secret {
	secret := newSecret(cr)
	secret.ObjectMeta.Name = name
	secret.Type = corev1.SecretTypeTLS
	return secret
}