Feat: Expand secret references with Machine Identity

k8-operator/packages/api/api.go

@@ -163,6 +163,9 @@ func CallGetDecryptedSecretsV3(httpClient *resty.Client, request GetDecryptedSec
 	if request.Recursive {
 		req.SetQueryParam("recursive", "true")
 	}
+	if request.ExpandSecretReferences {
+		req.SetQueryParam("expandSecretReferences", "true")
+	}
 
 	response, err := req.Get(fmt.Sprintf("%v/v3/secrets/raw", API_HOST_URL))
 

k8-operator/packages/api/models.go

@@ -98,11 +98,12 @@ type GetDecryptedSecretsV3Response struct {
 }
 
 type GetDecryptedSecretsV3Request struct {
-	ProjectSlug string `json:"workspaceSlug"`
-	Environment string `json:"environment"`
-	SecretPath  string `json:"secretPath"`
-	Recursive   bool   `json:"recursive"`
-	ETag        string `json:"etag,omitempty"`
+	ProjectSlug            string `json:"workspaceSlug"`
+	Environment            string `json:"environment"`
+	SecretPath             string `json:"secretPath"`
+	Recursive              bool   `json:"recursive"`
+	ExpandSecretReferences bool   `json:"expandSecretReferences"`
+	ETag                   string `json:"etag,omitempty"`
 }
 
 type GetServiceTokenDetailsResponse struct {

k8-operator/packages/util/secrets.go

@@ -58,11 +58,12 @@ func GetPlainTextSecretsViaUniversalAuth(accessToken string, etag string, secret
 	httpClient.SetAuthToken(accessToken)
 
 	secretsResponse, err := api.CallGetDecryptedSecretsV3(httpClient, api.GetDecryptedSecretsV3Request{
-		ProjectSlug: secretScope.ProjectSlug,
-		Environment: secretScope.EnvSlug,
-		Recursive:   secretScope.Recursive,
-		SecretPath:  secretScope.SecretsPath,
-		ETag:        etag,
+		ProjectSlug:            secretScope.ProjectSlug,
+		Environment:            secretScope.EnvSlug,
+		Recursive:              secretScope.Recursive,
+		SecretPath:             secretScope.SecretsPath,
+		ExpandSecretReferences: true,
+		ETag:                   etag,
 	})
 
 	if err != nil {