feat(k8s): automatic service account token creation for k8s auth

k8-operator/api/v1alpha1/zz_generated.deepcopy.go

@@ -48,7 +48,7 @@ func (in *Authentication) DeepCopyInto(out *Authentication) {
 	out.ServiceAccount = in.ServiceAccount
 	out.ServiceToken = in.ServiceToken
 	out.UniversalAuth = in.UniversalAuth
-	out.KubernetesAuth = in.KubernetesAuth
+	in.KubernetesAuth.DeepCopyInto(&out.KubernetesAuth)
 	out.AwsIamAuth = in.AwsIamAuth
 	out.AzureAuth = in.AzureAuth
 	out.GcpIdTokenAuth = in.GcpIdTokenAuth
@@ -207,7 +207,7 @@ func (in *GenericGcpIdTokenAuth) DeepCopy() *GenericGcpIdTokenAuth {
 func (in *GenericInfisicalAuthentication) DeepCopyInto(out *GenericInfisicalAuthentication) {
 	*out = *in
 	out.UniversalAuth = in.UniversalAuth
-	out.KubernetesAuth = in.KubernetesAuth
+	in.KubernetesAuth.DeepCopyInto(&out.KubernetesAuth)
 	out.AwsIamAuth = in.AwsIamAuth
 	out.AzureAuth = in.AzureAuth
 	out.GcpIdTokenAuth = in.GcpIdTokenAuth
@@ -228,6 +228,11 @@ func (in *GenericInfisicalAuthentication) DeepCopy() *GenericInfisicalAuthentica
 func (in *GenericKubernetesAuth) DeepCopyInto(out *GenericKubernetesAuth) {
 	*out = *in
 	out.ServiceAccountRef = in.ServiceAccountRef
+	if in.ServiceAccountTokenAudiences != nil {
+		in, out := &in.ServiceAccountTokenAudiences, &out.ServiceAccountTokenAudiences
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GenericKubernetesAuth.
@@ -336,7 +341,7 @@ func (in *InfisicalDynamicSecretList) DeepCopyObject() runtime.Object {
 func (in *InfisicalDynamicSecretSpec) DeepCopyInto(out *InfisicalDynamicSecretSpec) {
 	*out = *in
 	in.ManagedSecretReference.DeepCopyInto(&out.ManagedSecretReference)
-	out.Authentication = in.Authentication
+	in.Authentication.DeepCopyInto(&out.Authentication)
 	out.DynamicSecret = in.DynamicSecret
 	out.TLS = in.TLS
 }
@@ -476,7 +481,7 @@ func (in *InfisicalPushSecretSecretSource) DeepCopy() *InfisicalPushSecretSecret
 func (in *InfisicalPushSecretSpec) DeepCopyInto(out *InfisicalPushSecretSpec) {
 	*out = *in
 	out.Destination = in.Destination
-	out.Authentication = in.Authentication
+	in.Authentication.DeepCopyInto(&out.Authentication)
 	in.Push.DeepCopyInto(&out.Push)
 	out.TLS = in.TLS
 }
@@ -583,7 +588,7 @@ func (in *InfisicalSecretList) DeepCopyObject() runtime.Object {
 func (in *InfisicalSecretSpec) DeepCopyInto(out *InfisicalSecretSpec) {
 	*out = *in
 	out.TokenSecretReference = in.TokenSecretReference
-	out.Authentication = in.Authentication
+	in.Authentication.DeepCopyInto(&out.Authentication)
 	in.ManagedSecretReference.DeepCopyInto(&out.ManagedSecretReference)
 	if in.ManagedKubeSecretReferences != nil {
 		in, out := &in.ManagedKubeSecretReferences, &out.ManagedKubeSecretReferences
@@ -654,6 +659,11 @@ func (in *KubernetesAuthDetails) DeepCopyInto(out *KubernetesAuthDetails) {
 	*out = *in
 	out.ServiceAccountRef = in.ServiceAccountRef
 	out.SecretsScope = in.SecretsScope
+	if in.ServiceAccountTokenAudiences != nil {
+		in, out := &in.ServiceAccountTokenAudiences, &out.ServiceAccountTokenAudiences
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesAuthDetails.

k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml

@@ -73,6 +73,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -85,6 +91,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef

k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml

@@ -73,6 +73,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -85,6 +91,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef

k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml

@@ -136,6 +136,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       secretsScope:
@@ -163,6 +169,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - secretsScope

k8-operator/config/rbac/role.yaml

@@ -16,6 +16,13 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
@@ -35,6 +42,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 - apiGroups:
   - apps
   resources:
@@ -55,6 +68,12 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
 - apiGroups:
   - secrets.infisical.com
   resources: