fix: helm changes

.github/workflows/release_docker_k8_operator.yaml

@@ -44,10 +44,7 @@ jobs:
 
             - name: Generate Helm Chart
               working-directory: k8-operator
-              run: make helm
+              run: make helm VERSION=${{ steps.extract_version.outputs.version }}
-
-            - name: Update Helm Chart Version
-              run: ./k8-operator/scripts/update-version.sh ${{ steps.extract_version.outputs.version }}
 
             - name: Debug - Check file changes
               run: |

helm-charts/secrets-operator/templates/clustergenerator-crd.yaml

@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   name: clustergenerators.secrets.infisical.com
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
@@ -22,14 +22,19 @@ spec:
         description: ClusterGenerator represents a cluster-wide generator
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
+            description: |-
-              of an object. Servers should convert recognized schemas to the latest
+              APIVersion defines the versioned schema of this representation of an object.
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
+            description: |-
-              object represents. Servers may infer this from the endpoint the client
+              Kind is a string value representing the REST resource this object represents.
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -47,27 +52,29 @@ spec:
                         description: set allowRepeat to true to allow repeating characters.
                         type: boolean
                       digits:
-                        description: digits specifies the number of digits in the generated
+                        description: |-
-                          password. If omitted it defaults to 25% of the length of the
+                          digits specifies the number of digits in the generated
-                          password
+                          password. If omitted it defaults to 25% of the length of the password
                         type: integer
                       length:
                         default: 24
-                        description: Length of the password to be generated. Defaults
+                        description: |-
-                          to 24
+                          Length of the password to be generated.
+                          Defaults to 24
                         type: integer
                       noUpper:
                         default: false
                         description: Set noUpper to disable uppercase characters
                         type: boolean
                       symbolCharacters:
-                        description: symbolCharacters specifies the special characters
+                        description: |-
-                          that should be used in the generated password.
+                          symbolCharacters specifies the special characters that should be used
+                          in the generated password.
                         type: string
                       symbols:
-                        description: symbols specifies the number of symbol characters
+                        description: |-
-                          in the generated password. If omitted it defaults to 25% of
+                          symbols specifies the number of symbol characters in the generated
-                          the length of the password
+                          password. If omitted it defaults to 25% of the length of the password
                         type: integer
                     type: object
                   uuidSpec:

helm-charts/secrets-operator/templates/deployment.yaml

@@ -3,62 +3,26 @@ kind: Deployment
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-controller-manager
   labels:
-    app.kubernetes.io/component: manager
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
     control-plane: controller-manager
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.controllerManager.replicas }}
   selector:
     matchLabels:
+      app.kubernetes.io/name: k8-operator
       control-plane: controller-manager
     {{- include "secrets-operator.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
+        app.kubernetes.io/name: k8-operator
         control-plane: controller-manager
       {{- include "secrets-operator.selectorLabels" . | nindent 8 }}
       annotations:
         kubectl.kubernetes.io/default-container: manager
     spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
-                - arm64
-                - ppc64le
-                - s390x
-              - key: kubernetes.io/os
-                operator: In
-                values:
-                - linux
       containers:
-      - args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
+      - args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
-        env:
-        - name: KUBERNETES_CLUSTER_DOMAIN
-          value: {{ quote .Values.kubernetesClusterDomain }}
-        image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag
-          | default .Chart.AppVersion }}
-        name: kube-rbac-proxy
-        ports:
-        - containerPort: 8443
-          name: https
-          protocol: TCP
-        resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent
-          10 }}
-        securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext
-          | nindent 10 }}
-      - args:
-        {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
-        {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
-        - --namespace={{ .Values.scopedNamespace }}
-        {{- end }}
         command:
         - /manager
         env:

helm-charts/secrets-operator/templates/infisicaldynamicsecret-admin-rbac.yaml

@@ -0,0 +1,49 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets
+  verbs:
+  - '*'
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-admin-role'

helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml

@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   name: infisicaldynamicsecrets.secrets.infisical.com
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
@@ -23,14 +23,19 @@ spec:
           API.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
+            description: |-
-              of an object. Servers should convert recognized schemas to the latest
+              APIVersion defines the versioned schema of this representation of an object.
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
+            description: |-
-              object represents. Servers may infer this from the endpoint the client
+              Kind is a string value representing the REST resource this object represents.
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -75,11 +80,9 @@ spec:
                   kubernetesAuth:
                     properties:
                       autoCreateServiceAccountToken:
-                        description: Optionally automatically create a service account
+                        description: |-
-                          token for the configured service account. If this is set to
+                          Optionally automatically create a service account token for the configured service account.
-                          `true`, the operator will automatically create a service account
+                          If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases.
-                          token for the configured service account. This field is recommended
-                          in most cases.
                         type: boolean
                       identityId:
                         type: string
@@ -170,11 +173,11 @@ spec:
                 properties:
                   creationPolicy:
                     default: Orphan
-                    description: 'The Kubernetes Secret creation policy. Enum with values:
+                    description: |-
-                      ''Owner'', ''Orphan''. Owner creates the secret and sets .metadata.ownerReferences
+                      The Kubernetes Secret creation policy.
-                      of the InfisicalSecret CRD that created it. Orphan will not set
+                      Enum with values: 'Owner', 'Orphan'.
-                      the secret owner. This will result in the secret being orphaned
+                      Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
-                      and not deleted when the resource is deleted.'
+                      Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
                     type: string
                   secretName:
                     description: The name of the Kubernetes Secret
@@ -196,9 +199,9 @@ spec:
                         description: The template key values
                         type: object
                       includeAllSecrets:
-                        description: This injects all retrieved secrets into the top
+                        description: |-
-                          level of your template. Secrets defined in the template will
+                          This injects all retrieved secrets into the top level of your template.
-                          take precedence over the injected ones.
+                          Secrets defined in the template will take precedence over the injected ones.
                         type: boolean
                     type: object
                 required:
@@ -239,44 +242,36 @@ spec:
             properties:
               conditions:
                 items:
-                  description: "Condition contains details for one aspect of the current
+                  description: Condition contains details for one aspect of the current
-                    state of this API Resource. --- This struct is intended for direct
+                    state of this API Resource.
-                    use as an array at the field path .status.conditions.  For example,
-                    \n type FooStatus struct{ // Represents the observations of a foo's
-                    current state. // Known .status.conditions.type are: \"Available\",
-                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
-                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
-                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
-                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
+                      description: |-
-                        transitioned from one status to another. This should be when
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        the underlying condition changed.  If that is not known, then
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                        using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating details
+                      description: |-
-                        about the transition. This may be an empty string.
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation
+                      description: |-
-                        that the condition was set based upon. For instance, if .metadata.generation
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        is currently 12, but the .status.conditions[x].observedGeneration
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        is 9, the condition is out of date with respect to the current
+                        with respect to the current state of the instance.
-                        state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating
+                      description: |-
-                        the reason for the condition's last transition. Producers of
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        specific condition types may define expected values and meanings
+                        Producers of specific condition types may define expected values and meanings for this field,
-                        for this field, and whether the values are considered a guaranteed
+                        and whether the values are considered a guaranteed API.
-                        API. The value should be a CamelCase string. This field may
+                        The value should be a CamelCase string.
-                        not be empty.
+                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
@@ -290,10 +285,6 @@ spec:
                       type: string
                     type:
                       description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        --- Many .condition.type values are consistent across resources
-                        like Available, but because arbitrary conditions can be useful
-                        (see .node.status.conditions), the ability to deconflict is
-                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

helm-charts/secrets-operator/templates/infisicaldynamicsecret-editor-rbac.yaml

@@ -0,0 +1,55 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-editor-role'

helm-charts/secrets-operator/templates/infisicaldynamicsecret-viewer-rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicaldynamicsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicaldynamicsecret-viewer-role'

helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml

@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   name: infisicalpushsecrets.secrets.infisical.com
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
@@ -23,14 +23,19 @@ spec:
           API
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
+            description: |-
-              of an object. Servers should convert recognized schemas to the latest
+              APIVersion defines the versioned schema of this representation of an object.
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
+            description: |-
-              object represents. Servers may infer this from the endpoint the client
+              Kind is a string value representing the REST resource this object represents.
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -75,11 +80,9 @@ spec:
                   kubernetesAuth:
                     properties:
                       autoCreateServiceAccountToken:
-                        description: Optionally automatically create a service account
+                        description: |-
-                          token for the configured service account. If this is set to
+                          Optionally automatically create a service account token for the configured service account.
-                          `true`, the operator will automatically create a service account
+                          If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases.
-                          token for the configured service account. This field is recommended
-                          in most cases.
                         type: boolean
                       identityId:
                         type: string
@@ -208,9 +211,9 @@ spec:
                             description: The template key values
                             type: object
                           includeAllSecrets:
-                            description: This injects all retrieved secrets into the
+                            description: |-
-                              top level of your template. Secrets defined in the template
+                              This injects all retrieved secrets into the top level of your template.
-                              will take precedence over the injected ones.
+                              Secrets defined in the template will take precedence over the injected ones.
                             type: boolean
                         type: object
                     required:
@@ -252,44 +255,36 @@ spec:
             properties:
               conditions:
                 items:
-                  description: "Condition contains details for one aspect of the current
+                  description: Condition contains details for one aspect of the current
-                    state of this API Resource. --- This struct is intended for direct
+                    state of this API Resource.
-                    use as an array at the field path .status.conditions.  For example,
-                    \n type FooStatus struct{ // Represents the observations of a foo's
-                    current state. // Known .status.conditions.type are: \"Available\",
-                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
-                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
-                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
-                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
+                      description: |-
-                        transitioned from one status to another. This should be when
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        the underlying condition changed.  If that is not known, then
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                        using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating details
+                      description: |-
-                        about the transition. This may be an empty string.
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation
+                      description: |-
-                        that the condition was set based upon. For instance, if .metadata.generation
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        is currently 12, but the .status.conditions[x].observedGeneration
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        is 9, the condition is out of date with respect to the current
+                        with respect to the current state of the instance.
-                        state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating
+                      description: |-
-                        the reason for the condition's last transition. Producers of
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        specific condition types may define expected values and meanings
+                        Producers of specific condition types may define expected values and meanings for this field,
-                        for this field, and whether the values are considered a guaranteed
+                        and whether the values are considered a guaranteed API.
-                        API. The value should be a CamelCase string. This field may
+                        The value should be a CamelCase string.
-                        not be empty.
+                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
@@ -303,10 +298,6 @@ spec:
                       type: string
                     type:
                       description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        --- Many .condition.type values are consistent across resources
-                        like Available, but because arbitrary conditions can be useful
-                        (see .node.status.conditions), the ability to deconflict is
-                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

helm-charts/secrets-operator/templates/infisicalpushsecretsecret-admin-rbac.yaml

@@ -0,0 +1,49 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets
+  verbs:
+  - '*'
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-admin-role'

helm-charts/secrets-operator/templates/infisicalpushsecretsecret-editor-rbac.yaml

@@ -0,0 +1,55 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-editor-role'

helm-charts/secrets-operator/templates/infisicalpushsecretsecret-viewer-rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalpushsecretsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalpushsecretsecret-viewer-role'

helm-charts/secrets-operator/templates/infisicalsecret-admin-rbac.yaml

@@ -0,0 +1,49 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets
+  verbs:
+  - '*'
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-admin-role'

helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml

@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   name: infisicalsecrets.secrets.infisical.com
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
@@ -22,14 +22,19 @@ spec:
         description: InfisicalSecret is the Schema for the infisicalsecrets API
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
+            description: |-
-              of an object. Servers should convert recognized schemas to the latest
+              APIVersion defines the versioned schema of this representation of an object.
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
+            description: |-
-              object represents. Servers may infer this from the endpoint the client
+              Kind is a string value representing the REST resource this object represents.
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -138,10 +143,9 @@ spec:
                   kubernetesAuth:
                     properties:
                       autoCreateServiceAccountToken:
-                        description: Optionally automatically create a service account
+                        description: |-
-                          token for the configured service account. If this is set to
+                          Optionally automatically create a service account token for the configured service account.
-                          `true`, the operator will automatically create a service account
+                          If this is set to `true`, the operator will automatically create a service account token for the configured service account.
-                          token for the configured service account.
                         type: boolean
                       identityId:
                         type: string
@@ -323,12 +327,11 @@ spec:
                       type: string
                     creationPolicy:
                       default: Orphan
-                      description: 'The Kubernetes ConfigMap creation policy. Enum with
+                      description: |-
-                        values: ''Owner'', ''Orphan''. Owner creates the config map
+                        The Kubernetes ConfigMap creation policy.
-                        and sets .metadata.ownerReferences of the InfisicalSecret CRD
+                        Enum with values: 'Owner', 'Orphan'.
-                        that created it. Orphan will not set the config map owner. This
+                        Owner creates the config map and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
-                        will result in the config map being orphaned and not deleted
+                        Orphan will not set the config map owner. This will result in the config map being orphaned and not deleted when the resource is deleted.
-                        when the resource is deleted.'
                       type: string
                     template:
                       description: The template to transform the secret data
@@ -339,9 +342,9 @@ spec:
                           description: The template key values
                           type: object
                         includeAllSecrets:
-                          description: This injects all retrieved secrets into the top
+                          description: |-
-                            level of your template. Secrets defined in the template
+                            This injects all retrieved secrets into the top level of your template.
-                            will take precedence over the injected ones.
+                            Secrets defined in the template will take precedence over the injected ones.
                           type: boolean
                       type: object
                   required:
@@ -354,12 +357,11 @@ spec:
                   properties:
                     creationPolicy:
                       default: Orphan
-                      description: 'The Kubernetes Secret creation policy. Enum with
+                      description: |-
-                        values: ''Owner'', ''Orphan''. Owner creates the secret and
+                        The Kubernetes Secret creation policy.
-                        sets .metadata.ownerReferences of the InfisicalSecret CRD that
+                        Enum with values: 'Owner', 'Orphan'.
-                        created it. Orphan will not set the secret owner. This will
+                        Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
-                        result in the secret being orphaned and not deleted when the
+                        Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
-                        resource is deleted.'
                       type: string
                     secretName:
                       description: The name of the Kubernetes Secret
@@ -381,9 +383,9 @@ spec:
                           description: The template key values
                           type: object
                         includeAllSecrets:
-                          description: This injects all retrieved secrets into the top
+                          description: |-
-                            level of your template. Secrets defined in the template
+                            This injects all retrieved secrets into the top level of your template.
-                            will take precedence over the injected ones.
+                            Secrets defined in the template will take precedence over the injected ones.
                           type: boolean
                       type: object
                   required:
@@ -395,11 +397,11 @@ spec:
                 properties:
                   creationPolicy:
                     default: Orphan
-                    description: 'The Kubernetes Secret creation policy. Enum with values:
+                    description: |-
-                      ''Owner'', ''Orphan''. Owner creates the secret and sets .metadata.ownerReferences
+                      The Kubernetes Secret creation policy.
-                      of the InfisicalSecret CRD that created it. Orphan will not set
+                      Enum with values: 'Owner', 'Orphan'.
-                      the secret owner. This will result in the secret being orphaned
+                      Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
-                      and not deleted when the resource is deleted.'
+                      Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
                     type: string
                   secretName:
                     description: The name of the Kubernetes Secret
@@ -421,9 +423,9 @@ spec:
                         description: The template key values
                         type: object
                       includeAllSecrets:
-                        description: This injects all retrieved secrets into the top
+                        description: |-
-                          level of your template. Secrets defined in the template will
+                          This injects all retrieved secrets into the top level of your template.
-                          take precedence over the injected ones.
+                          Secrets defined in the template will take precedence over the injected ones.
                         type: boolean
                     type: object
                 required:
@@ -474,44 +476,36 @@ spec:
             properties:
               conditions:
                 items:
-                  description: "Condition contains details for one aspect of the current
+                  description: Condition contains details for one aspect of the current
-                    state of this API Resource. --- This struct is intended for direct
+                    state of this API Resource.
-                    use as an array at the field path .status.conditions.  For example,
-                    \n type FooStatus struct{ // Represents the observations of a foo's
-                    current state. // Known .status.conditions.type are: \"Available\",
-                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
-                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
-                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
-                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
+                      description: |-
-                        transitioned from one status to another. This should be when
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        the underlying condition changed.  If that is not known, then
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                        using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating details
+                      description: |-
-                        about the transition. This may be an empty string.
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation
+                      description: |-
-                        that the condition was set based upon. For instance, if .metadata.generation
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        is currently 12, but the .status.conditions[x].observedGeneration
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        is 9, the condition is out of date with respect to the current
+                        with respect to the current state of the instance.
-                        state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating
+                      description: |-
-                        the reason for the condition's last transition. Producers of
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        specific condition types may define expected values and meanings
+                        Producers of specific condition types may define expected values and meanings for this field,
-                        for this field, and whether the values are considered a guaranteed
+                        and whether the values are considered a guaranteed API.
-                        API. The value should be a CamelCase string. This field may
+                        The value should be a CamelCase string.
-                        not be empty.
+                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
@@ -525,10 +519,6 @@ spec:
                       type: string
                     type:
                       description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        --- Many .condition.type values are consistent across resources
-                        like Available, but because arbitrary conditions can be useful
-                        (see .node.status.conditions), the ability to deconflict is
-                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

helm-charts/secrets-operator/templates/infisicalsecret-editor-rbac.yaml

@@ -0,0 +1,55 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-editor-role'

helm-charts/secrets-operator/templates/infisicalsecret-viewer-rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - secrets.infisical.com
+  resources:
+  - infisicalsecrets/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-infisicalsecret-viewer-role'

helm-charts/secrets-operator/templates/leader-election-rbac.yaml

@@ -3,9 +3,6 @@ kind: Role
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-leader-election-role
   labels:
-    app.kubernetes.io/component: rbac
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
   {{- include "secrets-operator.labels" . | nindent 4 }}
 rules:
 - apiGroups:
@@ -45,9 +42,6 @@ kind: RoleBinding
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-leader-election-rolebinding
   labels:
-    app.kubernetes.io/component: rbac
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
   {{- include "secrets-operator.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io

helm-charts/secrets-operator/templates/manager-rbac.yaml

@@ -16,6 +16,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - secrets
   verbs:
   - create
   - delete
@@ -30,17 +31,6 @@ rules:
   verbs:
   - get
   - list
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -55,17 +45,6 @@ rules:
   - serviceaccounts/token
   verbs:
   - create
-- apiGroups:
-  - apps
-  resources:
-  - daemonsets
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - apps
   resources:
@@ -85,69 +64,8 @@ rules:
   - secrets.infisical.com
   resources:
   - clustergenerators
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - secrets.infisical.com
-  resources:
   - infisicaldynamicsecrets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - secrets.infisical.com
-  resources:
-  - infisicaldynamicsecrets/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - secrets.infisical.com
-  resources:
-  - infisicaldynamicsecrets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - secrets.infisical.com
-  resources:
   - infisicalpushsecrets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - secrets.infisical.com
-  resources:
-  - infisicalpushsecrets/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - secrets.infisical.com
-  resources:
-  - infisicalpushsecrets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - secrets.infisical.com
-  resources:
   - infisicalsecrets
   verbs:
   - create
@@ -160,12 +78,16 @@ rules:
 - apiGroups:
   - secrets.infisical.com
   resources:
+  - infisicaldynamicsecrets/finalizers
+  - infisicalpushsecrets/finalizers
   - infisicalsecrets/finalizers
   verbs:
   - update
 - apiGroups:
   - secrets.infisical.com
   resources:
+  - infisicaldynamicsecrets/status
+  - infisicalpushsecrets/status
   - infisicalsecrets/status
   verbs:
   - get
@@ -184,9 +106,7 @@ metadata:
   namespace: {{ .Values.scopedNamespace | quote }}
   {{- end }}
   labels:
-    app.kubernetes.io/component: rbac
+
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
   {{- include "secrets-operator.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io

helm-charts/secrets-operator/templates/metrics-auth-rbac.yaml

@@ -0,0 +1,53 @@
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-metrics-auth-role
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+  name: {{ include "secrets-operator.fullname" . }}-metrics-auth-rolebinding
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  namespace: {{ .Values.scopedNamespace | quote }}
+  {{- end }}
+  labels:
+
+  {{- include "secrets-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+  kind: Role
+  {{- else }}
+  kind: ClusterRole
+  {{- end }}
+  name: '{{ include "secrets-operator.fullname" . }}-metrics-auth-role'
+subjects:
+- kind: ServiceAccount
+  name: '{{ include "secrets-operator.fullname" . }}-controller-manager'
+  namespace: '{{ .Release.Namespace }}'

helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml

@@ -4,9 +4,6 @@ kind: ClusterRole
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-metrics-reader
   labels:
-    app.kubernetes.io/component: kube-rbac-proxy
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
   {{- include "secrets-operator.labels" . | nindent 4 }}
 rules:
 - nonResourceURLs:

helm-charts/secrets-operator/templates/metrics-service.yaml

@@ -3,14 +3,12 @@ kind: Service
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service
   labels:
-    app.kubernetes.io/component: kube-rbac-proxy
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
     control-plane: controller-manager
   {{- include "secrets-operator.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.metricsService.type }}
   selector:
+    app.kubernetes.io/name: k8-operator
     control-plane: controller-manager
   {{- include "secrets-operator.selectorLabels" . | nindent 4 }}
   ports:

helm-charts/secrets-operator/templates/proxy-rbac.yaml

@@ -1,43 +0,0 @@
-{{- if not .Values.scopedNamespace }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "secrets-operator.fullname" . }}-proxy-role
-  labels:
-    app.kubernetes.io/component: kube-rbac-proxy
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
-  {{- include "secrets-operator.labels" . | nindent 4 }}
-rules:
-- apiGroups:
-  - authentication.k8s.io
-  resources:
-  - tokenreviews
-  verbs:
-  - create
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - subjectaccessreviews
-  verbs:
-  - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "secrets-operator.fullname" . }}-proxy-rolebinding
-  labels:
-    app.kubernetes.io/component: kube-rbac-proxy
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
-  {{- include "secrets-operator.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: '{{ include "secrets-operator.fullname" . }}-proxy-role'
-subjects:
-- kind: ServiceAccount
-  name: '{{ include "secrets-operator.fullname" . }}-controller-manager'
-  namespace: '{{ .Release.Namespace }}'
-
-{{- end }}

helm-charts/secrets-operator/templates/serviceaccount.yaml

@@ -3,9 +3,6 @@ kind: ServiceAccount
 metadata:
   name: {{ include "secrets-operator.fullname" . }}-controller-manager
   labels:
-    app.kubernetes.io/component: rbac
-    app.kubernetes.io/created-by: k8-operator
-    app.kubernetes.io/part-of: k8-operator
   {{- include "secrets-operator.labels" . | nindent 4 }}
   annotations:
     {{- toYaml .Values.controllerManager.serviceAccount.annotations | nindent 4 }}

helm-charts/secrets-operator/values.yaml

@@ -1,35 +1,15 @@
 controllerManager:
-  kubeRbacProxy:
-    args:
-    - --secure-listen-address=0.0.0.0:8443
-    - --upstream=http://127.0.0.1:8080/
-    - --logtostderr=true
-    - --v=0
-    containerSecurityContext:
-      allowPrivilegeEscalation: false
-      capabilities:
-        drop:
-        - ALL
-    image:
-      repository: gcr.io/kubebuilder/kube-rbac-proxy
-      tag: v0.15.0
-    resources:
-      limits:
-        cpu: 500m
-        memory: 128Mi
-      requests:
-        cpu: 5m
-        memory: 64Mi
   manager:
     args:
-    - --health-probe-bind-address=:8081
+    - --metrics-bind-address=:8443
-    - --metrics-bind-address=127.0.0.1:8080
     - --leader-elect
+    - --health-probe-bind-address=:8081
     containerSecurityContext:
       allowPrivilegeEscalation: false
       capabilities:
         drop:
         - ALL
+      readOnlyRootFilesystem: true
     image:
       repository: infisical/kubernetes-operator
       tag: v0.9.5
@@ -40,6 +20,8 @@ controllerManager:
       requests:
         cpu: 10m
         memory: 64Mi
+    seccompProfile:
+      type: RuntimeDefault
   replicas: 1
   serviceAccount:
     annotations: {}
@@ -50,7 +32,7 @@ metricsService:
   - name: https
     port: 8443
     protocol: TCP
-    targetPort: https
+    targetPort: 8443
   type: ClusterIP
 kubernetesClusterDomain: cluster.local
 scopedNamespace: ""

k8-operator/Makefile

@@ -1,5 +1,6 @@
 # Image URL to use all building/pushing image targets
-IMG ?= controller:latest
+VERSION ?= latest
+IMG ?= infisical/kubernetes-operator:${VERSION} # ${VERSION} will be replaced by the version in the CI step
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -24,6 +25,28 @@ all: build
 
 ##@ General
 
+HELMIFY ?= $(LOCALBIN)/helmify
+
+.PHONY: helmify
+helmify: $(HELMIFY) ## Download helmify locally if necessary.
+$(HELMIFY): $(LOCALBIN)
+	test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/helmify@latest
+    
+legacy-helm: manifests kustomize helmify
+	$(KUSTOMIZE) build config/default | $(HELMIFY) ../helm-charts/secrets-operator
+
+helm: manifests kustomize helmify
+	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	./scripts/generate-helm.sh
+	cd config/manager && $(KUSTOMIZE) edit set image controller=controller:latest  # reset back
+
+## Yaml for Kubectl 
+kubectl-install: manifests kustomize
+	mkdir -p kubectl-install
+	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	$(KUSTOMIZE) build config/default > kubectl-install/install-secrets-operator.yaml
+
+
 # The help target prints out all targets with their descriptions organized
 # beneath their categories. The categories are represented by '##@' and the
 # target descriptions by '##'. The awk command is responsible for reading the

k8-operator/scripts/generate-helm.sh

@@ -50,17 +50,38 @@ for crd_file in "${HELM_DIR}"/templates/*crd.yaml; do
   echo "Completed processing for: ${crd_file}"
 done
 
-# ? NOTE: Processes only the manager-rbac.yaml file
+# ? NOTE: Processes all files ending in -rbac.yaml, except metrics-reader-rbac.yaml
-if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then
+for rbac_file in "${HELM_DIR}/templates"/*-rbac.yaml; do
-  echo "Processing manager-rbac.yaml file specifically"
+  if [ -f "$rbac_file" ]; then
+    if [[ "$(basename "$rbac_file")" == "metrics-reader-rbac.yaml" ]]; then
+      echo "Skipping metrics-reader-rbac.yaml"
+      continue
+    fi
 
+    if [[ "$(basename "$rbac_file")" == "leader-election-rbac.yaml" ]]; then
+      echo "Skipping infisicaldynamicsecret-admin-rbac.yaml"
+      continue
+    fi
 
-  cp "${HELM_DIR}/templates/manager-rbac.yaml" "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
+    filename=$(basename "$rbac_file")
+    base_name="${filename%-rbac.yaml}"
+
+    echo "Processing $(basename "$rbac_file") file specifically"
+
+    cp "${rbac_file}" "${rbac_file}.bkp"
     
     # extract the rules section from the original file
-  rules_section=$(sed -n '/^rules:/,/^---/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | sed '$d')
+    # Extract from 'rules:' until we hit a document separator or another top-level key
+
+    if grep -q "^---" "${rbac_file}.bkp"; then
+    # File has document separator, extract until ---
+      rules_section=$(sed -n '/^rules:/,/^---/p' "${rbac_file}.bkp" | sed '$d')
+    else
+      # Simple file, extract everything from rules to end
+      rules_section=$(sed -n '/^rules:/,$ p' "${rbac_file}.bkp")
+    fi
     # extract the original label lines
-  original_labels=$(sed -n '/^  labels:/,/^roleRef:/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | grep "app.kubernetes.io")
+    original_labels=$(sed -n '/^  labels:/,/^roleRef:/p' "${HELM_DIR}/templates/${rbac_file}.bkp" | grep "app.kubernetes.io" || true)
     
     # create a new file from scratch with exactly what we want
     {
@@ -72,7 +93,7 @@ if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then
       echo "kind: ClusterRole"
       echo "{{- end }}"
       echo "metadata:"
-    echo "  name: {{ include \"secrets-operator.fullname\" . }}-manager-role"
+      echo "  name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-role"
       echo "  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
       echo "  namespace: {{ .Values.scopedNamespace | quote }}"
       echo "  {{- end }}"
@@ -91,7 +112,7 @@ if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then
       echo "kind: ClusterRoleBinding"
       echo "{{- end }}"
       echo "metadata:"
-    echo "  name: {{ include \"secrets-operator.fullname\" . }}-manager-rolebinding"
+      echo "  name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-rolebinding"
       echo "  {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
       echo "  namespace: {{ .Values.scopedNamespace | quote }}"
       echo "  {{- end }}"
@@ -107,20 +128,21 @@ if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then
       echo "  {{- else }}"
       echo "  kind: ClusterRole"
       echo "  {{- end }}"
-    echo "  name: '{{ include \"secrets-operator.fullname\" . }}-manager-role'"
+      echo "  name: '{{ include \"secrets-operator.fullname\" . }}-${base_name}-role'"
       
       # add the subjects section
-    sed -n '/^subjects:/,$ p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
+      sed -n '/^subjects:/,$ p' "${rbac_file}.bkp"
-  } > "${HELM_DIR}/templates/manager-rbac.yaml.new"
+    } > "${rbac_file}.new"
 
-  mv "${HELM_DIR}/templates/manager-rbac.yaml.new" "${HELM_DIR}/templates/manager-rbac.yaml"
+    mv "${rbac_file}.new" "${rbac_file}"
-  rm "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
+    rm "${rbac_file}.bkp"
     
-  echo "Completed processing for manager-rbac.yaml with both role conditions and metadata applied"
+    echo "Completed processing for $(basename "$rbac_file") with both role conditions and metadata applied"
-fi
+  fi
+done
 
-# ? NOTE(Daniel): Processes proxy-rbac.yaml and metrics-reader-rbac.yaml
+# ? NOTE(Daniel): Processes and metrics-reader-rbac.yaml
-for rbac_file in "${HELM_DIR}/templates/proxy-rbac.yaml" "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do
+for rbac_file in "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do
   if [ -f "$rbac_file" ]; then
     echo "Adding scopedNamespace condition to $(basename "$rbac_file")"
     
@@ -172,9 +194,39 @@ if [ -f "${HELM_DIR}/templates/deployment.yaml" ]; then
   securityContext_replaced=0
   in_first_securityContext=0
   first_securityContext_found=0
+  containers_fixed=0
+  next_line_needs_dash=0
   
   # process the file line by line
   while IFS= read -r line; do
+    # Fix containers array syntax issue
+    if [[ "$line" =~ ^[[:space:]]*containers:[[:space:]]*$ ]] && [ "$containers_fixed" -eq 0 ]; then
+      echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
+      next_line_needs_dash=1
+      containers_fixed=1
+      continue
+    fi
+    
+    # Add dash to first container item if missing
+    if [ "$next_line_needs_dash" -eq 1 ]; then
+      # Check if line already starts with a dash (after whitespace)
+      if [[ "$line" =~ ^[[:space:]]*-[[:space:]] ]]; then
+        # Already has dash, just add the line
+        echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
+      elif [[ "$line" =~ ^[[:space:]]*[a-zA-Z] ]]; then
+        # No dash but has content, add dash before the content
+        # Extract indentation and content
+        indent=$(echo "$line" | sed 's/^\([[:space:]]*\).*/\1/')
+        content=$(echo "$line" | sed 's/^[[:space:]]*\(.*\)/\1/')
+        echo "${indent}- ${content}" >> "${HELM_DIR}/templates/deployment.yaml.new"
+      else
+        # Empty line or other, just add as-is
+        echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
+      fi
+      next_line_needs_dash=0
+      continue
+    fi
+    
     # check if this is the first securityContext line (for kube-rbac-proxy)
     if [[ "$line" =~ securityContext.*Values.controllerManager.kubeRbacProxy ]] && [ "$first_securityContext_found" -eq 0 ]; then
       echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
@@ -240,17 +292,6 @@ if [ -f "${HELM_DIR}/values.yaml" ]; then
   previous_line=""
   # Process the file line by line
   while IFS= read -r line; do
-
-    # Check if previous line includes infisical/kubernetes-operator and this line includes tag:
-    if [[ "$previous_line" =~ infisical/kubernetes-operator ]] && [[ "$line" =~ ^[[:space:]]*tag: ]]; then
-      # Get the indentation
-      indent=$(echo "$line" | sed 's/\(^[[:space:]]*\).*/\1/')
-      # Replace with our custom tag
-      echo "${indent}tag: <helm-pr-will-update-this-automatically>" >> "${HELM_DIR}/values.yaml.new"
-      continue
-    fi
-
-
     if [[ "$line" =~ resources: ]]; then
       in_resources_section=1
     fi