From 377a79f17da8d9fa4f40c4e0ee5fc1d11cd5fd85 Mon Sep 17 00:00:00 2001 From: Alex Birca Date: Sat, 18 Nov 2023 10:09:00 +0200 Subject: [PATCH 1/4] Make secret type field configurable --- k8-operator/api/v1alpha1/infisicalsecret_types.go | 4 ++++ .../secrets.infisical.com_infisicalsecrets.yaml | 12 ++++++++++++ k8-operator/controllers/auto_redeployment.go | 2 ++ k8-operator/controllers/infisicalsecret_helper.go | 12 +++++++++--- 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index 3b61bd215..50a11e434 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -41,6 +41,10 @@ type KubeSecretReference struct { // The name space where the Kubernetes Secret is located // +kubebuilder:validation:Required SecretNamespace string `json:"secretNamespace"` + + // The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types + // +kubebuilder:validation:Optional + SecretType string `json:"secretType"` } // InfisicalSecretSpec defines the desired state of InfisicalSecret diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index 07433f781..eb170fb36 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -52,6 +52,9 @@ spec: description: The name space where the Kubernetes Secret is located type: string + secretType: + description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace @@ -82,6 +85,9 @@ spec: description: The name space where the Kubernetes Secret is located type: string + secretType: + description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace @@ -102,6 +108,9 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace @@ -117,6 +126,9 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace diff --git a/k8-operator/controllers/auto_redeployment.go b/k8-operator/controllers/auto_redeployment.go index e4fa6d00f..e63ac88af 100644 --- a/k8-operator/controllers/auto_redeployment.go +++ b/k8-operator/controllers/auto_redeployment.go @@ -36,6 +36,8 @@ func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx c var wg sync.WaitGroup // Iterate over the deployments and check if they use the managed secret for _, deployment := range listOfDeployments.Items { + // Adding bc of https://github.com/golang/go/issues/16520 + deployment := deployment if deployment.Annotations[AUTO_RELOAD_DEPLOYMENT_ANNOTATION] == "true" && r.IsDeploymentUsingManagedSecret(deployment, infisicalSecret) { // Start a goroutine to reconcile the deployment wg.Add(1) diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 509de94ac..066d0e24e 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -72,7 +72,6 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context. // default to new secret ref structure secretName := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretName secretNamespace := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretNamespace - // fall back to previous secret ref if secretName == "" { secretName = infisicalSecret.Spec.TokenSecretReference.SecretName @@ -129,6 +128,13 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []model.SingleEnvironmentVariable, encryptedSecretsResponse api.GetEncryptedSecretsV3Response) error { plainProcessedSecrets := make(map[string][]byte) + secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType + + // Set the default secret type to "Opaque" if not provided + if secretType == "" { + secretType = "Opaque" + } + for _, secret := range secretsFromAPI { plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process } @@ -142,7 +148,7 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag, }, }, - Type: "Opaque", + Type: corev1.SecretType(secretType), Data: plainProcessedSecrets, } @@ -151,7 +157,7 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context return fmt.Errorf("unable to create the managed Kubernetes secret : %w", err) } - fmt.Println("Successfully created a managed Kubernetes secret with your Infisical secrets") + fmt.Printf("Successfully created a managed Kubernetes secret with your Infisical secrets. Type: %s\n", secretType) return nil } From 13014b5345cbb603a40eae69360636649eda80e1 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 7 Dec 2023 19:26:48 -0500 Subject: [PATCH 2/4] create separate struct for managed secret + propagate lables/annotations --- .../templates/infisicalsecret-crd.yaml | 5 ++++ .../api/v1alpha1/infisicalsecret_types.go | 15 +++++++++-- .../api/v1alpha1/zz_generated.deepcopy.go | 15 +++++++++++ ...ecrets.infisical.com_infisicalsecrets.yaml | 13 +++------ k8-operator/config/samples/sample.yaml | 10 +++++-- .../controllers/infisicalsecret_helper.go | 27 ++++++++++++------- .../install-secrets-operator.yaml | 4 +++ 7 files changed, 65 insertions(+), 24 deletions(-) diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 51dd18a41..cfee98f81 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -102,6 +102,11 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index 50a11e434..2acad987c 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -41,9 +41,20 @@ type KubeSecretReference struct { // The name space where the Kubernetes Secret is located // +kubebuilder:validation:Required SecretNamespace string `json:"secretNamespace"` +} - // The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types +type MangedKubeSecretConfig struct { + // The name of the Kubernetes Secret + // +kubebuilder:validation:Required + SecretName string `json:"secretName"` + + // The name space where the Kubernetes Secret is located + // +kubebuilder:validation:Required + SecretNamespace string `json:"secretNamespace"` + + // The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types // +kubebuilder:validation:Optional + // +kubebuilder:default:=Opaque SecretType string `json:"secretType"` } @@ -56,7 +67,7 @@ type InfisicalSecretSpec struct { Authentication Authentication `json:"authentication"` // +kubebuilder:validation:Required - ManagedSecretReference KubeSecretReference `json:"managedSecretReference"` + ManagedSecretReference MangedKubeSecretConfig `json:"managedSecretReference"` // +kubebuilder:default:=60 ResyncInterval int `json:"resyncInterval"` diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 01000431c..5b6befcbc 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -157,6 +157,21 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *MangedKubeSecretConfig) DeepCopyInto(out *MangedKubeSecretConfig) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MangedKubeSecretConfig. +func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig { + if in == nil { + return nil + } + out := new(MangedKubeSecretConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) { *out = *in diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index eb170fb36..c5a6beaa1 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -52,9 +52,6 @@ spec: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace @@ -85,9 +82,6 @@ spec: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace @@ -109,7 +103,9 @@ spec: description: The name space where the Kubernetes Secret is located type: string secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' type: string required: - secretName @@ -126,9 +122,6 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 4c5059d9f..7ad164531 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -2,8 +2,12 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: http://localhost:8764/api + hostAPI: https://app.infisical.com/api resyncInterval: 10 authentication: serviceAccount: @@ -20,8 +24,10 @@ spec: envSlug: dev secretsPath: "/" managedSecretReference: - secretName: managed-secret + secretName: managed-token secretNamespace: default + # secretType: kubernetes.io/dockerconfigjson + # # To be depreciated soon # tokenSecretReference: # secretName: service-token diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 066d0e24e..2c291a46e 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -130,23 +130,30 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context plainProcessedSecrets := make(map[string][]byte) secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType - // Set the default secret type to "Opaque" if not provided - if secretType == "" { - secretType = "Opaque" - } - for _, secret := range secretsFromAPI { plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process } + // copy labels and annotations from InfisicalSecret CRD + labels := map[string]string{} + for k, v := range infisicalSecret.Labels { + labels[k] = v + } + + annotations := map[string]string{} + for k, v := range infisicalSecret.Annotations { + annotations[k] = v + } + + annotations[SECRET_VERSION_ANNOTATION] = encryptedSecretsResponse.ETag + // create a new secret as specified by the managed secret spec of CRD newKubeSecretInstance := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ - Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, - Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, - Annotations: map[string]string{ - SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag, - }, + Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, + Annotations: annotations, + Labels: labels, }, Type: corev1.SecretType(secretType), Data: plainProcessedSecrets, diff --git a/k8-operator/kubectl-install/install-secrets-operator.yaml b/k8-operator/kubectl-install/install-secrets-operator.yaml index dad6dcf3a..e052da854 100644 --- a/k8-operator/kubectl-install/install-secrets-operator.yaml +++ b/k8-operator/kubectl-install/install-secrets-operator.yaml @@ -108,6 +108,10 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace From df0bec8a68acaee2b48f380a09b342a0274f3a43 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 7 Dec 2023 19:28:57 -0500 Subject: [PATCH 3/4] update chart version --- helm-charts/secrets-operator/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 53afe79e4..fab37cf22 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.2.1 +version: 0.3.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. From 0eeef9a66c53c1f5af1d0698474da150e98ee9fc Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 7 Dec 2023 19:30:43 -0500 Subject: [PATCH 4/4] revert managed secret name --- k8-operator/config/samples/sample.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 7ad164531..82addeb4e 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -24,7 +24,7 @@ spec: envSlug: dev secretsPath: "/" managedSecretReference: - secretName: managed-token + secretName: managed-secret secretNamespace: default # secretType: kubernetes.io/dockerconfigjson