Merge branch 'main' into patch-k8s-dependency-vulnerability

k8-operator/api/v1alpha1/infisicalsecret_types.go

@@ -43,6 +43,21 @@ type KubeSecretReference struct {
 	SecretNamespace string `json:"secretNamespace"`
 }
 
+type MangedKubeSecretConfig struct {
+	// The name of the Kubernetes Secret
+	// +kubebuilder:validation:Required
+	SecretName string `json:"secretName"`
+
+	// The name space where the Kubernetes Secret is located
+	// +kubebuilder:validation:Required
+	SecretNamespace string `json:"secretNamespace"`
+
+	// The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default:=Opaque
+	SecretType string `json:"secretType"`
+}
+
 // InfisicalSecretSpec defines the desired state of InfisicalSecret
 type InfisicalSecretSpec struct {
 	// +kubebuilder:validation:Optional
@@ -52,7 +67,7 @@ type InfisicalSecretSpec struct {
 	Authentication Authentication `json:"authentication"`
 
 	// +kubebuilder:validation:Required
-	ManagedSecretReference KubeSecretReference `json:"managedSecretReference"`
+	ManagedSecretReference MangedKubeSecretConfig `json:"managedSecretReference"`
 
 	// +kubebuilder:default:=60
 	ResyncInterval int `json:"resyncInterval"`

k8-operator/api/v1alpha1/zz_generated.deepcopy.go

@@ -157,6 +157,21 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MangedKubeSecretConfig) DeepCopyInto(out *MangedKubeSecretConfig) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MangedKubeSecretConfig.
+func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(MangedKubeSecretConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) {
 	*out = *in

k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml

@@ -102,6 +102,11 @@ spec:
                   secretNamespace:
                     description: The name space where the Kubernetes Secret is located
                     type: string
+                  secretType:
+                    default: Opaque
+                    description: 'The Kubernetes Secret type (experimental feature).
+                      More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
+                    type: string
                 required:
                 - secretName
                 - secretNamespace

k8-operator/config/samples/sample.yaml

@@ -2,8 +2,12 @@ apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
   name: infisicalsecret-sample
+  labels:
+    label-to-be-passed-to-managed-secret: sample-value
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
 spec:
-  hostAPI: http://localhost:8764/api
+  hostAPI: https://app.infisical.com/api
   resyncInterval: 10
   authentication:
     serviceAccount:
@@ -22,6 +26,8 @@ spec:
   managedSecretReference:
     secretName: managed-secret
     secretNamespace: default
+    # secretType: kubernetes.io/dockerconfigjson
+
   # # To be depreciated soon
   # tokenSecretReference:
   #   secretName: service-token

k8-operator/controllers/infisicalsecret_helper.go

@@ -72,7 +72,6 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context.
 	// default to new secret ref structure
 	secretName := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretName
 	secretNamespace := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretNamespace
-
 	// fall back to previous secret ref
 	if secretName == "" {
 		secretName = infisicalSecret.Spec.TokenSecretReference.SecretName
@@ -129,20 +128,34 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub
 
 func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []model.SingleEnvironmentVariable, encryptedSecretsResponse api.GetEncryptedSecretsV3Response) error {
 	plainProcessedSecrets := make(map[string][]byte)
+	secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType
+
 	for _, secret := range secretsFromAPI {
 		plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process
 	}
 
+	// copy labels and annotations from InfisicalSecret CRD
+	labels := map[string]string{}
+	for k, v := range infisicalSecret.Labels {
+		labels[k] = v
+	}
+
+	annotations := map[string]string{}
+	for k, v := range infisicalSecret.Annotations {
+		annotations[k] = v
+	}
+
+	annotations[SECRET_VERSION_ANNOTATION] = encryptedSecretsResponse.ETag
+
 	// create a new secret as specified by the managed secret spec of CRD
 	newKubeSecretInstance := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      infisicalSecret.Spec.ManagedSecretReference.SecretName,
-			Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
-			Annotations: map[string]string{
-				SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag,
-			},
+			Name:        infisicalSecret.Spec.ManagedSecretReference.SecretName,
+			Namespace:   infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
+			Annotations: annotations,
+			Labels:      labels,
 		},
-		Type: "Opaque",
+		Type: corev1.SecretType(secretType),
 		Data: plainProcessedSecrets,
 	}
 
@@ -151,7 +164,7 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context
 		return fmt.Errorf("unable to create the managed Kubernetes secret : %w", err)
 	}
 
-	fmt.Println("Successfully created a managed Kubernetes secret with your Infisical secrets")
+	fmt.Printf("Successfully created a managed Kubernetes secret with your Infisical secrets. Type: %s\n", secretType)
 	return nil
 }
 

k8-operator/kubectl-install/install-secrets-operator.yaml

@@ -108,6 +108,10 @@ spec:
                   secretNamespace:
                     description: The name space where the Kubernetes Secret is located
                     type: string
+                  secretType:
+                    default: Opaque
+                    description: 'The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
+                    type: string
                 required:
                 - secretName
                 - secretNamespace