From 13014b5345cbb603a40eae69360636649eda80e1 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 7 Dec 2023 19:26:48 -0500 Subject: [PATCH] create separate struct for managed secret + propagate lables/annotations --- .../templates/infisicalsecret-crd.yaml | 5 ++++ .../api/v1alpha1/infisicalsecret_types.go | 15 +++++++++-- .../api/v1alpha1/zz_generated.deepcopy.go | 15 +++++++++++ ...ecrets.infisical.com_infisicalsecrets.yaml | 13 +++------ k8-operator/config/samples/sample.yaml | 10 +++++-- .../controllers/infisicalsecret_helper.go | 27 ++++++++++++------- .../install-secrets-operator.yaml | 4 +++ 7 files changed, 65 insertions(+), 24 deletions(-) diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 51dd18a41..cfee98f81 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -102,6 +102,11 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index 50a11e434..2acad987c 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -41,9 +41,20 @@ type KubeSecretReference struct { // The name space where the Kubernetes Secret is located // +kubebuilder:validation:Required SecretNamespace string `json:"secretNamespace"` +} - // The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types +type MangedKubeSecretConfig struct { + // The name of the Kubernetes Secret + // +kubebuilder:validation:Required + SecretName string `json:"secretName"` + + // The name space where the Kubernetes Secret is located + // +kubebuilder:validation:Required + SecretNamespace string `json:"secretNamespace"` + + // The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types // +kubebuilder:validation:Optional + // +kubebuilder:default:=Opaque SecretType string `json:"secretType"` } @@ -56,7 +67,7 @@ type InfisicalSecretSpec struct { Authentication Authentication `json:"authentication"` // +kubebuilder:validation:Required - ManagedSecretReference KubeSecretReference `json:"managedSecretReference"` + ManagedSecretReference MangedKubeSecretConfig `json:"managedSecretReference"` // +kubebuilder:default:=60 ResyncInterval int `json:"resyncInterval"` diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 01000431c..5b6befcbc 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -157,6 +157,21 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *MangedKubeSecretConfig) DeepCopyInto(out *MangedKubeSecretConfig) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MangedKubeSecretConfig. +func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig { + if in == nil { + return nil + } + out := new(MangedKubeSecretConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) { *out = *in diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index eb170fb36..c5a6beaa1 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -52,9 +52,6 @@ spec: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace @@ -85,9 +82,6 @@ spec: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace @@ -109,7 +103,9 @@ spec: description: The name space where the Kubernetes Secret is located type: string secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). + More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' type: string required: - secretName @@ -126,9 +122,6 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string - secretType: - description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' - type: string required: - secretName - secretNamespace diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 4c5059d9f..7ad164531 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -2,8 +2,12 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: http://localhost:8764/api + hostAPI: https://app.infisical.com/api resyncInterval: 10 authentication: serviceAccount: @@ -20,8 +24,10 @@ spec: envSlug: dev secretsPath: "/" managedSecretReference: - secretName: managed-secret + secretName: managed-token secretNamespace: default + # secretType: kubernetes.io/dockerconfigjson + # # To be depreciated soon # tokenSecretReference: # secretName: service-token diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 066d0e24e..2c291a46e 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -130,23 +130,30 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context plainProcessedSecrets := make(map[string][]byte) secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType - // Set the default secret type to "Opaque" if not provided - if secretType == "" { - secretType = "Opaque" - } - for _, secret := range secretsFromAPI { plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process } + // copy labels and annotations from InfisicalSecret CRD + labels := map[string]string{} + for k, v := range infisicalSecret.Labels { + labels[k] = v + } + + annotations := map[string]string{} + for k, v := range infisicalSecret.Annotations { + annotations[k] = v + } + + annotations[SECRET_VERSION_ANNOTATION] = encryptedSecretsResponse.ETag + // create a new secret as specified by the managed secret spec of CRD newKubeSecretInstance := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ - Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, - Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, - Annotations: map[string]string{ - SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag, - }, + Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, + Annotations: annotations, + Labels: labels, }, Type: corev1.SecretType(secretType), Data: plainProcessedSecrets, diff --git a/k8-operator/kubectl-install/install-secrets-operator.yaml b/k8-operator/kubectl-install/install-secrets-operator.yaml index dad6dcf3a..e052da854 100644 --- a/k8-operator/kubectl-install/install-secrets-operator.yaml +++ b/k8-operator/kubectl-install/install-secrets-operator.yaml @@ -108,6 +108,10 @@ spec: secretNamespace: description: The name space where the Kubernetes Secret is located type: string + secretType: + default: Opaque + description: 'The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types' + type: string required: - secretName - secretNamespace