diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 53afe79e4..fab37cf22 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.2.1 +version: 0.3.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 51dd18a41..cfee98f81 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -102,6 +102,11 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index 3b61bd215..2acad987c 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -43,6 +43,21 @@ type KubeSecretReference struct { SecretNamespace string `json:"secretNamespace"` } +type MangedKubeSecretConfig struct { + // The name of the Kubernetes Secret + // +kubebuilder:validation:Required + SecretName string `json:"secretName"` + + // The name space where the Kubernetes Secret is located + // +kubebuilder:validation:Required + SecretNamespace string `json:"secretNamespace"` + + // The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types + // +kubebuilder:validation:Optional + // +kubebuilder:default:=Opaque + SecretType string `json:"secretType"` +} + // InfisicalSecretSpec defines the desired state of InfisicalSecret type InfisicalSecretSpec struct { // +kubebuilder:validation:Optional @@ -52,7 +67,7 @@ type InfisicalSecretSpec struct { Authentication Authentication `json:"authentication"` // +kubebuilder:validation:Required - ManagedSecretReference KubeSecretReference `json:"managedSecretReference"` + ManagedSecretReference MangedKubeSecretConfig `json:"managedSecretReference"` // +kubebuilder:default:=60 ResyncInterval int `json:"resyncInterval"` diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 01000431c..5b6befcbc 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -157,6 +157,21 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *MangedKubeSecretConfig) DeepCopyInto(out *MangedKubeSecretConfig) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MangedKubeSecretConfig. +func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig { + if in == nil { + return nil + } + out := new(MangedKubeSecretConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) { *out = *in diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index 07433f781..c5a6beaa1 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -102,6 +102,11 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 4c5059d9f..82addeb4e 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -2,8 +2,12 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: http://localhost:8764/api + hostAPI: https://app.infisical.com/api resyncInterval: 10 authentication: serviceAccount: @@ -22,6 +26,8 @@ spec: managedSecretReference: secretName: managed-secret secretNamespace: default + # secretType: kubernetes.io/dockerconfigjson + # # To be depreciated soon # tokenSecretReference: # secretName: service-token diff --git a/k8-operator/controllers/auto_redeployment.go b/k8-operator/controllers/auto_redeployment.go index e4fa6d00f..e63ac88af 100644 --- a/k8-operator/controllers/auto_redeployment.go +++ b/k8-operator/controllers/auto_redeployment.go @@ -36,6 +36,8 @@ func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx c var wg sync.WaitGroup // Iterate over the deployments and check if they use the managed secret for _, deployment := range listOfDeployments.Items { + // Adding bc of https://github.com/golang/go/issues/16520 + deployment := deployment if deployment.Annotations[AUTO_RELOAD_DEPLOYMENT_ANNOTATION] == "true" && r.IsDeploymentUsingManagedSecret(deployment, infisicalSecret) { // Start a goroutine to reconcile the deployment wg.Add(1) diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 509de94ac..2c291a46e 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -72,7 +72,6 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context. // default to new secret ref structure secretName := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretName secretNamespace := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretNamespace - // fall back to previous secret ref if secretName == "" { secretName = infisicalSecret.Spec.TokenSecretReference.SecretName @@ -129,20 +128,34 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []model.SingleEnvironmentVariable, encryptedSecretsResponse api.GetEncryptedSecretsV3Response) error { plainProcessedSecrets := make(map[string][]byte) + secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType + for _, secret := range secretsFromAPI { plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process } + // copy labels and annotations from InfisicalSecret CRD + labels := map[string]string{} + for k, v := range infisicalSecret.Labels { + labels[k] = v + } + + annotations := map[string]string{} + for k, v := range infisicalSecret.Annotations { + annotations[k] = v + } + + annotations[SECRET_VERSION_ANNOTATION] = encryptedSecretsResponse.ETag + // create a new secret as specified by the managed secret spec of CRD newKubeSecretInstance := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ - Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, - Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, - Annotations: map[string]string{ - SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag, - }, + Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, + Annotations: annotations, + Labels: labels, }, - Type: "Opaque", + Type: corev1.SecretType(secretType), Data: plainProcessedSecrets, } @@ -151,7 +164,7 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context return fmt.Errorf("unable to create the managed Kubernetes secret : %w", err) } - fmt.Println("Successfully created a managed Kubernetes secret with your Infisical secrets") + fmt.Printf("Successfully created a managed Kubernetes secret with your Infisical secrets. Type: %s\n", secretType) return nil } diff --git a/k8-operator/kubectl-install/install-secrets-operator.yaml b/k8-operator/kubectl-install/install-secrets-operator.yaml index dad6dcf3a..e052da854 100644 --- a/k8-operator/kubectl-install/install-secrets-operator.yaml +++ b/k8-operator/kubectl-install/install-secrets-operator.yaml @@ -108,6 +108,10 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace