From 2d68f9aa16a23f48e832c0088af448e55d04a478 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 6 Aug 2025 18:29:19 +0400 Subject: [PATCH] fix: helm changes --- .../workflows/release_docker_k8_operator.yaml | 5 +- .../templates/clustergenerator-crd.yaml | 41 ++-- .../templates/deployment.yaml | 42 +--- .../infisicaldynamicsecret-admin-rbac.yaml | 49 +++++ .../templates/infisicaldynamicsecret-crd.yaml | 91 ++++---- .../infisicaldynamicsecret-editor-rbac.yaml | 55 +++++ .../infisicaldynamicsecret-viewer-rbac.yaml | 51 +++++ .../templates/infisicalpushsecret-crd.yaml | 81 ++++--- .../infisicalpushsecretsecret-admin-rbac.yaml | 49 +++++ ...infisicalpushsecretsecret-editor-rbac.yaml | 55 +++++ ...infisicalpushsecretsecret-viewer-rbac.yaml | 51 +++++ .../templates/infisicalsecret-admin-rbac.yaml | 49 +++++ .../templates/infisicalsecret-crd.yaml | 124 +++++------ .../infisicalsecret-editor-rbac.yaml | 55 +++++ .../infisicalsecret-viewer-rbac.yaml | 51 +++++ .../templates/leader-election-rbac.yaml | 6 - .../templates/manager-rbac.yaml | 92 +------- .../templates/metrics-auth-rbac.yaml | 53 +++++ .../templates/metrics-reader-rbac.yaml | 3 - .../templates/metrics-service.yaml | 4 +- .../templates/proxy-rbac.yaml | 43 ---- .../templates/serviceaccount.yaml | 3 - helm-charts/secrets-operator/values.yaml | 30 +-- k8-operator/Makefile | 25 ++- k8-operator/config/manager/manager.yaml | 72 +++---- k8-operator/scripts/generate-helm.sh | 199 +++++++++++------- 26 files changed, 873 insertions(+), 506 deletions(-) create mode 100644 helm-charts/secrets-operator/templates/infisicaldynamicsecret-admin-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicaldynamicsecret-editor-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicaldynamicsecret-viewer-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalpushsecretsecret-admin-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalpushsecretsecret-editor-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalpushsecretsecret-viewer-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalsecret-admin-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalsecret-editor-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalsecret-viewer-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/metrics-auth-rbac.yaml delete mode 100644 helm-charts/secrets-operator/templates/proxy-rbac.yaml diff --git a/.github/workflows/release_docker_k8_operator.yaml b/.github/workflows/release_docker_k8_operator.yaml index 1f894df47..81472bf88 100644 --- a/.github/workflows/release_docker_k8_operator.yaml +++ b/.github/workflows/release_docker_k8_operator.yaml @@ -44,10 +44,7 @@ jobs: - name: Generate Helm Chart working-directory: k8-operator - run: make helm - - - name: Update Helm Chart Version - run: ./k8-operator/scripts/update-version.sh ${{ steps.extract_version.outputs.version }} + run: make helm VERSION=${{ steps.extract_version.outputs.version }} - name: Debug - Check file changes run: | diff --git a/helm-charts/secrets-operator/templates/clustergenerator-crd.yaml b/helm-charts/secrets-operator/templates/clustergenerator-crd.yaml index 8da166a5e..2085502c9 100644 --- a/helm-charts/secrets-operator/templates/clustergenerator-crd.yaml +++ b/helm-charts/secrets-operator/templates/clustergenerator-crd.yaml @@ -4,7 +4,7 @@ kind: CustomResourceDefinition metadata: name: clustergenerators.secrets.infisical.com annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.18.0 labels: {{- include "secrets-operator.labels" . | nindent 4 }} spec: @@ -22,14 +22,19 @@ spec: description: ClusterGenerator represents a cluster-wide generator properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -47,27 +52,29 @@ spec: description: set allowRepeat to true to allow repeating characters. type: boolean digits: - description: digits specifies the number of digits in the generated - password. If omitted it defaults to 25% of the length of the - password + description: |- + digits specifies the number of digits in the generated + password. If omitted it defaults to 25% of the length of the password type: integer length: default: 24 - description: Length of the password to be generated. Defaults - to 24 + description: |- + Length of the password to be generated. + Defaults to 24 type: integer noUpper: default: false description: Set noUpper to disable uppercase characters type: boolean symbolCharacters: - description: symbolCharacters specifies the special characters - that should be used in the generated password. + description: |- + symbolCharacters specifies the special characters that should be used + in the generated password. type: string symbols: - description: symbols specifies the number of symbol characters - in the generated password. If omitted it defaults to 25% of - the length of the password + description: |- + symbols specifies the number of symbol characters in the generated + password. If omitted it defaults to 25% of the length of the password type: integer type: object uuidSpec: diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml index 8a99e104e..ca7b16401 100644 --- a/helm-charts/secrets-operator/templates/deployment.yaml +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -3,62 +3,26 @@ kind: Deployment metadata: name: {{ include "secrets-operator.fullname" . }}-controller-manager labels: - app.kubernetes.io/component: manager - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator control-plane: controller-manager {{- include "secrets-operator.labels" . | nindent 4 }} spec: replicas: {{ .Values.controllerManager.replicas }} selector: matchLabels: + app.kubernetes.io/name: k8-operator control-plane: controller-manager {{- include "secrets-operator.selectorLabels" . | nindent 6 }} template: metadata: labels: + app.kubernetes.io/name: k8-operator control-plane: controller-manager {{- include "secrets-operator.selectorLabels" . | nindent 8 }} annotations: kubectl.kubernetes.io/default-container: manager spec: - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/arch - operator: In - values: - - amd64 - - arm64 - - ppc64le - - s390x - - key: kubernetes.io/os - operator: In - values: - - linux containers: - - args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }} - env: - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag - | default .Chart.AppVersion }} - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent - 10 }} - securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext - | nindent 10 }} - - args: - {{- toYaml .Values.controllerManager.manager.args | nindent 8 }} - {{- if and .Values.scopedNamespace .Values.scopedRBAC }} - - --namespace={{ .Values.scopedNamespace }} - {{- end }} + - args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }} command: - /manager env: diff --git a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-admin-rbac.yaml b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-admin-rbac.yaml new file mode 100644 index 000000000..1e8e0fb22 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-admin-rbac.yaml @@ -0,0 +1,49 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets + verbs: + - '*' +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-role' diff --git a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml index 179305957..fe1ab4481 100644 --- a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml @@ -4,7 +4,7 @@ kind: CustomResourceDefinition metadata: name: infisicaldynamicsecrets.secrets.infisical.com annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.18.0 labels: {{- include "secrets-operator.labels" . | nindent 4 }} spec: @@ -23,14 +23,19 @@ spec: API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -75,11 +80,9 @@ spec: kubernetesAuth: properties: autoCreateServiceAccountToken: - description: Optionally automatically create a service account - token for the configured service account. If this is set to - `true`, the operator will automatically create a service account - token for the configured service account. This field is recommended - in most cases. + description: |- + Optionally automatically create a service account token for the configured service account. + If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases. type: boolean identityId: type: string @@ -170,11 +173,11 @@ spec: properties: creationPolicy: default: Orphan - description: 'The Kubernetes Secret creation policy. Enum with values: - ''Owner'', ''Orphan''. Owner creates the secret and sets .metadata.ownerReferences - of the InfisicalSecret CRD that created it. Orphan will not set - the secret owner. This will result in the secret being orphaned - and not deleted when the resource is deleted.' + description: |- + The Kubernetes Secret creation policy. + Enum with values: 'Owner', 'Orphan'. + Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it. + Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted. type: string secretName: description: The name of the Kubernetes Secret @@ -196,9 +199,9 @@ spec: description: The template key values type: object includeAllSecrets: - description: This injects all retrieved secrets into the top - level of your template. Secrets defined in the template will - take precedence over the injected ones. + description: |- + This injects all retrieved secrets into the top level of your template. + Secrets defined in the template will take precedence over the injected ones. type: boolean type: object required: @@ -239,44 +242,36 @@ spec: properties: conditions: items: - description: "Condition contains details for one aspect of the current - state of this API Resource. --- This struct is intended for direct - use as an array at the field path .status.conditions. For example, - \n type FooStatus struct{ // Represents the observations of a foo's - current state. // Known .status.conditions.type are: \"Available\", - \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge - // +listType=map // +listMapKey=type Conditions []metav1.Condition - `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" - protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + description: Condition contains details for one aspect of the current + state of this API Resource. properties: lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: - description: message is a human readable message indicating details - about the transition. This may be an empty string. + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers of - specific condition types may define expected values and meanings - for this field, and whether the values are considered a guaranteed - API. The value should be a CamelCase string. This field may - not be empty. + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ @@ -290,10 +285,6 @@ spec: type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string diff --git a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-editor-rbac.yaml b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-editor-rbac.yaml new file mode 100644 index 000000000..117f9aa1a --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-editor-rbac.yaml @@ -0,0 +1,55 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-role' diff --git a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-viewer-rbac.yaml b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-viewer-rbac.yaml new file mode 100644 index 000000000..3df918d21 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-viewer-rbac.yaml @@ -0,0 +1,51 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets + verbs: + - get + - list + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicaldynamicsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-role' diff --git a/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml index 8c8091d8a..2738ef581 100644 --- a/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml @@ -4,7 +4,7 @@ kind: CustomResourceDefinition metadata: name: infisicalpushsecrets.secrets.infisical.com annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.18.0 labels: {{- include "secrets-operator.labels" . | nindent 4 }} spec: @@ -23,14 +23,19 @@ spec: API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -75,11 +80,9 @@ spec: kubernetesAuth: properties: autoCreateServiceAccountToken: - description: Optionally automatically create a service account - token for the configured service account. If this is set to - `true`, the operator will automatically create a service account - token for the configured service account. This field is recommended - in most cases. + description: |- + Optionally automatically create a service account token for the configured service account. + If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases. type: boolean identityId: type: string @@ -208,9 +211,9 @@ spec: description: The template key values type: object includeAllSecrets: - description: This injects all retrieved secrets into the - top level of your template. Secrets defined in the template - will take precedence over the injected ones. + description: |- + This injects all retrieved secrets into the top level of your template. + Secrets defined in the template will take precedence over the injected ones. type: boolean type: object required: @@ -252,44 +255,36 @@ spec: properties: conditions: items: - description: "Condition contains details for one aspect of the current - state of this API Resource. --- This struct is intended for direct - use as an array at the field path .status.conditions. For example, - \n type FooStatus struct{ // Represents the observations of a foo's - current state. // Known .status.conditions.type are: \"Available\", - \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge - // +listType=map // +listMapKey=type Conditions []metav1.Condition - `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" - protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + description: Condition contains details for one aspect of the current + state of this API Resource. properties: lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: - description: message is a human readable message indicating details - about the transition. This may be an empty string. + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers of - specific condition types may define expected values and meanings - for this field, and whether the values are considered a guaranteed - API. The value should be a CamelCase string. This field may - not be empty. + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ @@ -303,10 +298,6 @@ spec: type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string diff --git a/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-admin-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-admin-rbac.yaml new file mode 100644 index 000000000..6bc381e02 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-admin-rbac.yaml @@ -0,0 +1,49 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets + verbs: + - '*' +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-role' diff --git a/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-editor-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-editor-rbac.yaml new file mode 100644 index 000000000..b279cf179 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-editor-rbac.yaml @@ -0,0 +1,55 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-role' diff --git a/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-viewer-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-viewer-rbac.yaml new file mode 100644 index 000000000..12fea8635 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalpushsecretsecret-viewer-rbac.yaml @@ -0,0 +1,51 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets + verbs: + - get + - list + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalpushsecretsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-role' diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-admin-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-admin-rbac.yaml new file mode 100644 index 000000000..1016dbe56 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalsecret-admin-rbac.yaml @@ -0,0 +1,49 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - '*' +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-role' diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 6002bbe36..117197686 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -4,7 +4,7 @@ kind: CustomResourceDefinition metadata: name: infisicalsecrets.secrets.infisical.com annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.18.0 labels: {{- include "secrets-operator.labels" . | nindent 4 }} spec: @@ -22,14 +22,19 @@ spec: description: InfisicalSecret is the Schema for the infisicalsecrets API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -138,10 +143,9 @@ spec: kubernetesAuth: properties: autoCreateServiceAccountToken: - description: Optionally automatically create a service account - token for the configured service account. If this is set to - `true`, the operator will automatically create a service account - token for the configured service account. + description: |- + Optionally automatically create a service account token for the configured service account. + If this is set to `true`, the operator will automatically create a service account token for the configured service account. type: boolean identityId: type: string @@ -323,12 +327,11 @@ spec: type: string creationPolicy: default: Orphan - description: 'The Kubernetes ConfigMap creation policy. Enum with - values: ''Owner'', ''Orphan''. Owner creates the config map - and sets .metadata.ownerReferences of the InfisicalSecret CRD - that created it. Orphan will not set the config map owner. This - will result in the config map being orphaned and not deleted - when the resource is deleted.' + description: |- + The Kubernetes ConfigMap creation policy. + Enum with values: 'Owner', 'Orphan'. + Owner creates the config map and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it. + Orphan will not set the config map owner. This will result in the config map being orphaned and not deleted when the resource is deleted. type: string template: description: The template to transform the secret data @@ -339,9 +342,9 @@ spec: description: The template key values type: object includeAllSecrets: - description: This injects all retrieved secrets into the top - level of your template. Secrets defined in the template - will take precedence over the injected ones. + description: |- + This injects all retrieved secrets into the top level of your template. + Secrets defined in the template will take precedence over the injected ones. type: boolean type: object required: @@ -354,12 +357,11 @@ spec: properties: creationPolicy: default: Orphan - description: 'The Kubernetes Secret creation policy. Enum with - values: ''Owner'', ''Orphan''. Owner creates the secret and - sets .metadata.ownerReferences of the InfisicalSecret CRD that - created it. Orphan will not set the secret owner. This will - result in the secret being orphaned and not deleted when the - resource is deleted.' + description: |- + The Kubernetes Secret creation policy. + Enum with values: 'Owner', 'Orphan'. + Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it. + Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted. type: string secretName: description: The name of the Kubernetes Secret @@ -381,9 +383,9 @@ spec: description: The template key values type: object includeAllSecrets: - description: This injects all retrieved secrets into the top - level of your template. Secrets defined in the template - will take precedence over the injected ones. + description: |- + This injects all retrieved secrets into the top level of your template. + Secrets defined in the template will take precedence over the injected ones. type: boolean type: object required: @@ -395,11 +397,11 @@ spec: properties: creationPolicy: default: Orphan - description: 'The Kubernetes Secret creation policy. Enum with values: - ''Owner'', ''Orphan''. Owner creates the secret and sets .metadata.ownerReferences - of the InfisicalSecret CRD that created it. Orphan will not set - the secret owner. This will result in the secret being orphaned - and not deleted when the resource is deleted.' + description: |- + The Kubernetes Secret creation policy. + Enum with values: 'Owner', 'Orphan'. + Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it. + Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted. type: string secretName: description: The name of the Kubernetes Secret @@ -421,9 +423,9 @@ spec: description: The template key values type: object includeAllSecrets: - description: This injects all retrieved secrets into the top - level of your template. Secrets defined in the template will - take precedence over the injected ones. + description: |- + This injects all retrieved secrets into the top level of your template. + Secrets defined in the template will take precedence over the injected ones. type: boolean type: object required: @@ -474,44 +476,36 @@ spec: properties: conditions: items: - description: "Condition contains details for one aspect of the current - state of this API Resource. --- This struct is intended for direct - use as an array at the field path .status.conditions. For example, - \n type FooStatus struct{ // Represents the observations of a foo's - current state. // Known .status.conditions.type are: \"Available\", - \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge - // +listType=map // +listMapKey=type Conditions []metav1.Condition - `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" - protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + description: Condition contains details for one aspect of the current + state of this API Resource. properties: lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: - description: message is a human readable message indicating details - about the transition. This may be an empty string. + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers of - specific condition types may define expected values and meanings - for this field, and whether the values are considered a guaranteed - API. The value should be a CamelCase string. This field may - not be empty. + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ @@ -525,10 +519,6 @@ spec: type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-editor-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-editor-rbac.yaml new file mode 100644 index 000000000..6f74acba1 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalsecret-editor-rbac.yaml @@ -0,0 +1,55 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-role' diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-viewer-rbac.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-viewer-rbac.yaml new file mode 100644 index 000000000..2f63b44ef --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalsecret-viewer-rbac.yaml @@ -0,0 +1,51 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - get + - list + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-role' diff --git a/helm-charts/secrets-operator/templates/leader-election-rbac.yaml b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml index 8299d35f6..b4ecb9357 100644 --- a/helm-charts/secrets-operator/templates/leader-election-rbac.yaml +++ b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml @@ -3,9 +3,6 @@ kind: Role metadata: name: {{ include "secrets-operator.fullname" . }}-leader-election-role labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator {{- include "secrets-operator.labels" . | nindent 4 }} rules: - apiGroups: @@ -45,9 +42,6 @@ kind: RoleBinding metadata: name: {{ include "secrets-operator.fullname" . }}-leader-election-rolebinding labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator {{- include "secrets-operator.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml index 93289ca67..9cd79264a 100644 --- a/helm-charts/secrets-operator/templates/manager-rbac.yaml +++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml @@ -16,6 +16,7 @@ rules: - "" resources: - configmaps + - secrets verbs: - create - delete @@ -30,17 +31,6 @@ rules: verbs: - get - list -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - update - - watch - apiGroups: - "" resources: @@ -55,17 +45,6 @@ rules: - serviceaccounts/token verbs: - create -- apiGroups: - - apps - resources: - - daemonsets - - deployments - - statefulsets - verbs: - - get - - list - - update - - watch - apiGroups: - apps resources: @@ -85,69 +64,8 @@ rules: - secrets.infisical.com resources: - clustergenerators - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - secrets.infisical.com - resources: - infisicaldynamicsecrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - secrets.infisical.com - resources: - - infisicaldynamicsecrets/finalizers - verbs: - - update -- apiGroups: - - secrets.infisical.com - resources: - - infisicaldynamicsecrets/status - verbs: - - get - - patch - - update -- apiGroups: - - secrets.infisical.com - resources: - infisicalpushsecrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - secrets.infisical.com - resources: - - infisicalpushsecrets/finalizers - verbs: - - update -- apiGroups: - - secrets.infisical.com - resources: - - infisicalpushsecrets/status - verbs: - - get - - patch - - update -- apiGroups: - - secrets.infisical.com - resources: - infisicalsecrets verbs: - create @@ -160,12 +78,16 @@ rules: - apiGroups: - secrets.infisical.com resources: + - infisicaldynamicsecrets/finalizers + - infisicalpushsecrets/finalizers - infisicalsecrets/finalizers verbs: - update - apiGroups: - secrets.infisical.com resources: + - infisicaldynamicsecrets/status + - infisicalpushsecrets/status - infisicalsecrets/status verbs: - get @@ -184,9 +106,7 @@ metadata: namespace: {{ .Values.scopedNamespace | quote }} {{- end }} labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/helm-charts/secrets-operator/templates/metrics-auth-rbac.yaml b/helm-charts/secrets-operator/templates/metrics-auth-rbac.yaml new file mode 100644 index 000000000..e5638b4e2 --- /dev/null +++ b/helm-charts/secrets-operator/templates/metrics-auth-rbac.yaml @@ -0,0 +1,53 @@ +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-metrics-auth-role + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +{{- if and .Values.scopedNamespace .Values.scopedRBAC }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +metadata: + name: {{ include "secrets-operator.fullname" . }}-metrics-auth-rolebinding + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + namespace: {{ .Values.scopedNamespace | quote }} + {{- end }} + labels: + + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if and .Values.scopedNamespace .Values.scopedRBAC }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: '{{ include "secrets-operator.fullname" . }}-metrics-auth-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' diff --git a/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml index 7843dac3d..c9eb371b0 100644 --- a/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml +++ b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml @@ -4,9 +4,6 @@ kind: ClusterRole metadata: name: {{ include "secrets-operator.fullname" . }}-metrics-reader labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator {{- include "secrets-operator.labels" . | nindent 4 }} rules: - nonResourceURLs: diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml index fab9523cf..833117d05 100644 --- a/helm-charts/secrets-operator/templates/metrics-service.yaml +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -3,14 +3,12 @@ kind: Service metadata: name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator control-plane: controller-manager {{- include "secrets-operator.labels" . | nindent 4 }} spec: type: {{ .Values.metricsService.type }} selector: + app.kubernetes.io/name: k8-operator control-plane: controller-manager {{- include "secrets-operator.selectorLabels" . | nindent 4 }} ports: diff --git a/helm-charts/secrets-operator/templates/proxy-rbac.yaml b/helm-charts/secrets-operator/templates/proxy-rbac.yaml deleted file mode 100644 index cc23b0856..000000000 --- a/helm-charts/secrets-operator/templates/proxy-rbac.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if not .Values.scopedNamespace }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "secrets-operator.fullname" . }}-proxy-role - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator - {{- include "secrets-operator.labels" . | nindent 4 }} -rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "secrets-operator.fullname" . }}-proxy-rolebinding - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator - {{- include "secrets-operator.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: '{{ include "secrets-operator.fullname" . }}-proxy-role' -subjects: -- kind: ServiceAccount - name: '{{ include "secrets-operator.fullname" . }}-controller-manager' - namespace: '{{ .Release.Namespace }}' - -{{- end }} diff --git a/helm-charts/secrets-operator/templates/serviceaccount.yaml b/helm-charts/secrets-operator/templates/serviceaccount.yaml index 57af4c162..70443c366 100644 --- a/helm-charts/secrets-operator/templates/serviceaccount.yaml +++ b/helm-charts/secrets-operator/templates/serviceaccount.yaml @@ -3,9 +3,6 @@ kind: ServiceAccount metadata: name: {{ include "secrets-operator.fullname" . }}-controller-manager labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: k8-operator - app.kubernetes.io/part-of: k8-operator {{- include "secrets-operator.labels" . | nindent 4 }} annotations: {{- toYaml .Values.controllerManager.serviceAccount.annotations | nindent 4 }} diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml index 1f56c666c..896c93f60 100644 --- a/helm-charts/secrets-operator/values.yaml +++ b/helm-charts/secrets-operator/values.yaml @@ -1,35 +1,15 @@ controllerManager: - kubeRbacProxy: - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - containerSecurityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - image: - repository: gcr.io/kubebuilder/kube-rbac-proxy - tag: v0.15.0 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi manager: args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 + - --metrics-bind-address=:8443 - --leader-elect + - --health-probe-bind-address=:8081 containerSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL + readOnlyRootFilesystem: true image: repository: infisical/kubernetes-operator tag: v0.9.5 @@ -40,6 +20,8 @@ controllerManager: requests: cpu: 10m memory: 64Mi + seccompProfile: + type: RuntimeDefault replicas: 1 serviceAccount: annotations: {} @@ -50,7 +32,7 @@ metricsService: - name: https port: 8443 protocol: TCP - targetPort: https + targetPort: 8443 type: ClusterIP kubernetesClusterDomain: cluster.local scopedNamespace: "" diff --git a/k8-operator/Makefile b/k8-operator/Makefile index b776cf7a9..463b1537c 100644 --- a/k8-operator/Makefile +++ b/k8-operator/Makefile @@ -1,5 +1,6 @@ # Image URL to use all building/pushing image targets -IMG ?= controller:latest +VERSION ?= latest +IMG ?= infisical/kubernetes-operator:${VERSION} # ${VERSION} will be replaced by the version in the CI step # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set) ifeq (,$(shell go env GOBIN)) @@ -24,6 +25,28 @@ all: build ##@ General +HELMIFY ?= $(LOCALBIN)/helmify + +.PHONY: helmify +helmify: $(HELMIFY) ## Download helmify locally if necessary. +$(HELMIFY): $(LOCALBIN) + test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/helmify@latest + +legacy-helm: manifests kustomize helmify + $(KUSTOMIZE) build config/default | $(HELMIFY) ../helm-charts/secrets-operator + +helm: manifests kustomize helmify + cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} + ./scripts/generate-helm.sh + cd config/manager && $(KUSTOMIZE) edit set image controller=controller:latest # reset back + +## Yaml for Kubectl +kubectl-install: manifests kustomize + mkdir -p kubectl-install + cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} + $(KUSTOMIZE) build config/default > kubectl-install/install-secrets-operator.yaml + + # The help target prints out all targets with their descriptions organized # beneath their categories. The categories are represented by '##@' and the # target descriptions by '##'. The awk command is responsible for reading the diff --git a/k8-operator/config/manager/manager.yaml b/k8-operator/config/manager/manager.yaml index eb41eff84..eae496083 100644 --- a/k8-operator/config/manager/manager.yaml +++ b/k8-operator/config/manager/manager.yaml @@ -58,42 +58,42 @@ spec: seccompProfile: type: RuntimeDefault containers: - - command: - - /manager - args: - - --leader-elect - - --health-probe-bind-address=:8081 - image: controller:latest - name: manager - ports: [] - securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: - - "ALL" - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - # TODO(user): Configure the resources accordingly based on the project requirements. - # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - volumeMounts: [] + - command: + - /manager + args: + - --leader-elect + - --health-probe-bind-address=:8081 + image: controller:latest + name: manager + ports: [] + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + # TODO(user): Configure the resources accordingly based on the project requirements. + # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + volumeMounts: [] volumes: [] serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 diff --git a/k8-operator/scripts/generate-helm.sh b/k8-operator/scripts/generate-helm.sh index b50c31052..2b6fe642d 100755 --- a/k8-operator/scripts/generate-helm.sh +++ b/k8-operator/scripts/generate-helm.sh @@ -50,77 +50,99 @@ for crd_file in "${HELM_DIR}"/templates/*crd.yaml; do echo "Completed processing for: ${crd_file}" done -# ? NOTE: Processes only the manager-rbac.yaml file -if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then - echo "Processing manager-rbac.yaml file specifically" +# ? NOTE: Processes all files ending in -rbac.yaml, except metrics-reader-rbac.yaml +for rbac_file in "${HELM_DIR}/templates"/*-rbac.yaml; do + if [ -f "$rbac_file" ]; then + if [[ "$(basename "$rbac_file")" == "metrics-reader-rbac.yaml" ]]; then + echo "Skipping metrics-reader-rbac.yaml" + continue + fi + if [[ "$(basename "$rbac_file")" == "leader-election-rbac.yaml" ]]; then + echo "Skipping infisicaldynamicsecret-admin-rbac.yaml" + continue + fi - cp "${HELM_DIR}/templates/manager-rbac.yaml" "${HELM_DIR}/templates/manager-rbac.yaml.bkp" - - # extract the rules section from the original file - rules_section=$(sed -n '/^rules:/,/^---/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | sed '$d') - # extract the original label lines - original_labels=$(sed -n '/^ labels:/,/^roleRef:/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | grep "app.kubernetes.io") - - # create a new file from scratch with exactly what we want - { - # first section: Role/ClusterRole - echo "apiVersion: rbac.authorization.k8s.io/v1" - echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}" - echo "kind: Role" - echo "{{- else }}" - echo "kind: ClusterRole" - echo "{{- end }}" - echo "metadata:" - echo " name: {{ include \"secrets-operator.fullname\" . }}-manager-role" - echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" - echo " namespace: {{ .Values.scopedNamespace | quote }}" - echo " {{- end }}" - echo " labels:" - echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}" - - # add the existing rules section from helm-generated file - echo "$rules_section" - - # second section: RoleBinding/ClusterRoleBinding - echo "---" - echo "apiVersion: rbac.authorization.k8s.io/v1" - echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}" - echo "kind: RoleBinding" - echo "{{- else }}" - echo "kind: ClusterRoleBinding" - echo "{{- end }}" - echo "metadata:" - echo " name: {{ include \"secrets-operator.fullname\" . }}-manager-rolebinding" - echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" - echo " namespace: {{ .Values.scopedNamespace | quote }}" - echo " {{- end }}" - echo " labels:" - echo "$original_labels" - echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}" - - # add the roleRef section with custom logic - echo "roleRef:" - echo " apiGroup: rbac.authorization.k8s.io" - echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" - echo " kind: Role" - echo " {{- else }}" - echo " kind: ClusterRole" - echo " {{- end }}" - echo " name: '{{ include \"secrets-operator.fullname\" . }}-manager-role'" - - # add the subjects section - sed -n '/^subjects:/,$ p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" - } > "${HELM_DIR}/templates/manager-rbac.yaml.new" - - mv "${HELM_DIR}/templates/manager-rbac.yaml.new" "${HELM_DIR}/templates/manager-rbac.yaml" - rm "${HELM_DIR}/templates/manager-rbac.yaml.bkp" - - echo "Completed processing for manager-rbac.yaml with both role conditions and metadata applied" -fi + filename=$(basename "$rbac_file") + base_name="${filename%-rbac.yaml}" -# ? NOTE(Daniel): Processes proxy-rbac.yaml and metrics-reader-rbac.yaml -for rbac_file in "${HELM_DIR}/templates/proxy-rbac.yaml" "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do + echo "Processing $(basename "$rbac_file") file specifically" + + cp "${rbac_file}" "${rbac_file}.bkp" + + # extract the rules section from the original file + # Extract from 'rules:' until we hit a document separator or another top-level key + + if grep -q "^---" "${rbac_file}.bkp"; then + # File has document separator, extract until --- + rules_section=$(sed -n '/^rules:/,/^---/p' "${rbac_file}.bkp" | sed '$d') + else + # Simple file, extract everything from rules to end + rules_section=$(sed -n '/^rules:/,$ p' "${rbac_file}.bkp") + fi + # extract the original label lines + original_labels=$(sed -n '/^ labels:/,/^roleRef:/p' "${HELM_DIR}/templates/${rbac_file}.bkp" | grep "app.kubernetes.io" || true) + + # create a new file from scratch with exactly what we want + { + # first section: Role/ClusterRole + echo "apiVersion: rbac.authorization.k8s.io/v1" + echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}" + echo "kind: Role" + echo "{{- else }}" + echo "kind: ClusterRole" + echo "{{- end }}" + echo "metadata:" + echo " name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-role" + echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" + echo " namespace: {{ .Values.scopedNamespace | quote }}" + echo " {{- end }}" + echo " labels:" + echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}" + + # add the existing rules section from helm-generated file + echo "$rules_section" + + # second section: RoleBinding/ClusterRoleBinding + echo "---" + echo "apiVersion: rbac.authorization.k8s.io/v1" + echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}" + echo "kind: RoleBinding" + echo "{{- else }}" + echo "kind: ClusterRoleBinding" + echo "{{- end }}" + echo "metadata:" + echo " name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-rolebinding" + echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" + echo " namespace: {{ .Values.scopedNamespace | quote }}" + echo " {{- end }}" + echo " labels:" + echo "$original_labels" + echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}" + + # add the roleRef section with custom logic + echo "roleRef:" + echo " apiGroup: rbac.authorization.k8s.io" + echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}" + echo " kind: Role" + echo " {{- else }}" + echo " kind: ClusterRole" + echo " {{- end }}" + echo " name: '{{ include \"secrets-operator.fullname\" . }}-${base_name}-role'" + + # add the subjects section + sed -n '/^subjects:/,$ p' "${rbac_file}.bkp" + } > "${rbac_file}.new" + + mv "${rbac_file}.new" "${rbac_file}" + rm "${rbac_file}.bkp" + + echo "Completed processing for $(basename "$rbac_file") with both role conditions and metadata applied" + fi +done + +# ? NOTE(Daniel): Processes and metrics-reader-rbac.yaml +for rbac_file in "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do if [ -f "$rbac_file" ]; then echo "Adding scopedNamespace condition to $(basename "$rbac_file")" @@ -172,9 +194,39 @@ if [ -f "${HELM_DIR}/templates/deployment.yaml" ]; then securityContext_replaced=0 in_first_securityContext=0 first_securityContext_found=0 + containers_fixed=0 + next_line_needs_dash=0 # process the file line by line while IFS= read -r line; do + # Fix containers array syntax issue + if [[ "$line" =~ ^[[:space:]]*containers:[[:space:]]*$ ]] && [ "$containers_fixed" -eq 0 ]; then + echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new" + next_line_needs_dash=1 + containers_fixed=1 + continue + fi + + # Add dash to first container item if missing + if [ "$next_line_needs_dash" -eq 1 ]; then + # Check if line already starts with a dash (after whitespace) + if [[ "$line" =~ ^[[:space:]]*-[[:space:]] ]]; then + # Already has dash, just add the line + echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new" + elif [[ "$line" =~ ^[[:space:]]*[a-zA-Z] ]]; then + # No dash but has content, add dash before the content + # Extract indentation and content + indent=$(echo "$line" | sed 's/^\([[:space:]]*\).*/\1/') + content=$(echo "$line" | sed 's/^[[:space:]]*\(.*\)/\1/') + echo "${indent}- ${content}" >> "${HELM_DIR}/templates/deployment.yaml.new" + else + # Empty line or other, just add as-is + echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new" + fi + next_line_needs_dash=0 + continue + fi + # check if this is the first securityContext line (for kube-rbac-proxy) if [[ "$line" =~ securityContext.*Values.controllerManager.kubeRbacProxy ]] && [ "$first_securityContext_found" -eq 0 ]; then echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new" @@ -240,17 +292,6 @@ if [ -f "${HELM_DIR}/values.yaml" ]; then previous_line="" # Process the file line by line while IFS= read -r line; do - - # Check if previous line includes infisical/kubernetes-operator and this line includes tag: - if [[ "$previous_line" =~ infisical/kubernetes-operator ]] && [[ "$line" =~ ^[[:space:]]*tag: ]]; then - # Get the indentation - indent=$(echo "$line" | sed 's/\(^[[:space:]]*\).*/\1/') - # Replace with our custom tag - echo "${indent}tag: " >> "${HELM_DIR}/values.yaml.new" - continue - fi - - if [[ "$line" =~ resources: ]]; then in_resources_section=1 fi