create separate struct for managed secret + propagate lables/annotations

helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml

@@ -102,6 +102,11 @@ spec:
                   secretNamespace:
                     description: The name space where the Kubernetes Secret is located
                     type: string
+                  secretType:
+                    default: Opaque
+                    description: 'The Kubernetes Secret type (experimental feature).
+                      More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
+                    type: string
                 required:
                 - secretName
                 - secretNamespace

k8-operator/api/v1alpha1/infisicalsecret_types.go

@@ -41,9 +41,20 @@ type KubeSecretReference struct {
 	// The name space where the Kubernetes Secret is located
 	// +kubebuilder:validation:Required
 	SecretNamespace string `json:"secretNamespace"`
+}
 
-	// The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
+type MangedKubeSecretConfig struct {
+	// The name of the Kubernetes Secret
+	// +kubebuilder:validation:Required
+	SecretName string `json:"secretName"`
+
+	// The name space where the Kubernetes Secret is located
+	// +kubebuilder:validation:Required
+	SecretNamespace string `json:"secretNamespace"`
+
+	// The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
 	// +kubebuilder:validation:Optional
+	// +kubebuilder:default:=Opaque
 	SecretType string `json:"secretType"`
 }
 
@@ -56,7 +67,7 @@ type InfisicalSecretSpec struct {
 	Authentication Authentication `json:"authentication"`
 
 	// +kubebuilder:validation:Required
-	ManagedSecretReference KubeSecretReference `json:"managedSecretReference"`
+	ManagedSecretReference MangedKubeSecretConfig `json:"managedSecretReference"`
 
 	// +kubebuilder:default:=60
 	ResyncInterval int `json:"resyncInterval"`

k8-operator/api/v1alpha1/zz_generated.deepcopy.go

@@ -157,6 +157,21 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MangedKubeSecretConfig) DeepCopyInto(out *MangedKubeSecretConfig) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MangedKubeSecretConfig.
+func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(MangedKubeSecretConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) {
 	*out = *in

k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml

@@ -52,9 +52,6 @@ spec:
                             description: The name space where the Kubernetes Secret
                               is located
                             type: string
-                          secretType:
-                            description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
-                            type: string
                         required:
                         - secretName
                         - secretNamespace
@@ -85,9 +82,6 @@ spec:
                             description: The name space where the Kubernetes Secret
                               is located
                             type: string
-                          secretType:
-                            description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
-                            type: string
                         required:
                         - secretName
                         - secretNamespace
@@ -109,7 +103,9 @@ spec:
                     description: The name space where the Kubernetes Secret is located
                     type: string
                   secretType:
-                    description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
+                    default: Opaque
+                    description: 'The Kubernetes Secret type (experimental feature).
+                      More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
                     type: string
                 required:
                 - secretName
@@ -126,9 +122,6 @@ spec:
                   secretNamespace:
                     description: The name space where the Kubernetes Secret is located
                     type: string
-                  secretType:
-                    description: 'The Kubernetes Secret type. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
-                    type: string
                 required:
                 - secretName
                 - secretNamespace

k8-operator/config/samples/sample.yaml

@@ -2,8 +2,12 @@ apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
   name: infisicalsecret-sample
+  labels:
+    label-to-be-passed-to-managed-secret: sample-value
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
 spec:
-  hostAPI: http://localhost:8764/api
+  hostAPI: https://app.infisical.com/api
   resyncInterval: 10
   authentication:
     serviceAccount:
@@ -20,8 +24,10 @@ spec:
         envSlug: dev
         secretsPath: "/"
   managedSecretReference:
-    secretName: managed-secret
+    secretName: managed-token
     secretNamespace: default
+    # secretType: kubernetes.io/dockerconfigjson
+
   # # To be depreciated soon
   # tokenSecretReference:
   #   secretName: service-token

k8-operator/controllers/infisicalsecret_helper.go

@@ -130,23 +130,30 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context
 	plainProcessedSecrets := make(map[string][]byte)
 	secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType
 
-	// Set the default secret type to "Opaque" if not provided
-	if secretType == "" {
-		secretType = "Opaque"
-	}
-
 	for _, secret := range secretsFromAPI {
 		plainProcessedSecrets[secret.Key] = []byte(secret.Value) // plain process
 	}
 
+	// copy labels and annotations from InfisicalSecret CRD
+	labels := map[string]string{}
+	for k, v := range infisicalSecret.Labels {
+		labels[k] = v
+	}
+
+	annotations := map[string]string{}
+	for k, v := range infisicalSecret.Annotations {
+		annotations[k] = v
+	}
+
+	annotations[SECRET_VERSION_ANNOTATION] = encryptedSecretsResponse.ETag
+
 	// create a new secret as specified by the managed secret spec of CRD
 	newKubeSecretInstance := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      infisicalSecret.Spec.ManagedSecretReference.SecretName,
+			Name:        infisicalSecret.Spec.ManagedSecretReference.SecretName,
-			Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
+			Namespace:   infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
-			Annotations: map[string]string{
+			Annotations: annotations,
-				SECRET_VERSION_ANNOTATION: encryptedSecretsResponse.ETag,
+			Labels:      labels,
-			},
 		},
 		Type: corev1.SecretType(secretType),
 		Data: plainProcessedSecrets,

k8-operator/kubectl-install/install-secrets-operator.yaml

@@ -108,6 +108,10 @@ spec:
                   secretNamespace:
                     description: The name space where the Kubernetes Secret is located
                     type: string
+                  secretType:
+                    default: Opaque
+                    description: 'The Kubernetes Secret type (experimental feature). More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
+                    type: string
                 required:
                 - secretName
                 - secretNamespace