diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 2ad97108d..4958e9c76 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -48,7 +48,7 @@ func (in *Authentication) DeepCopyInto(out *Authentication) { out.ServiceAccount = in.ServiceAccount out.ServiceToken = in.ServiceToken out.UniversalAuth = in.UniversalAuth - out.KubernetesAuth = in.KubernetesAuth + in.KubernetesAuth.DeepCopyInto(&out.KubernetesAuth) out.AwsIamAuth = in.AwsIamAuth out.AzureAuth = in.AzureAuth out.GcpIdTokenAuth = in.GcpIdTokenAuth @@ -207,7 +207,7 @@ func (in *GenericGcpIdTokenAuth) DeepCopy() *GenericGcpIdTokenAuth { func (in *GenericInfisicalAuthentication) DeepCopyInto(out *GenericInfisicalAuthentication) { *out = *in out.UniversalAuth = in.UniversalAuth - out.KubernetesAuth = in.KubernetesAuth + in.KubernetesAuth.DeepCopyInto(&out.KubernetesAuth) out.AwsIamAuth = in.AwsIamAuth out.AzureAuth = in.AzureAuth out.GcpIdTokenAuth = in.GcpIdTokenAuth @@ -228,6 +228,11 @@ func (in *GenericInfisicalAuthentication) DeepCopy() *GenericInfisicalAuthentica func (in *GenericKubernetesAuth) DeepCopyInto(out *GenericKubernetesAuth) { *out = *in out.ServiceAccountRef = in.ServiceAccountRef + if in.ServiceAccountTokenAudiences != nil { + in, out := &in.ServiceAccountTokenAudiences, &out.ServiceAccountTokenAudiences + *out = make([]string, len(*in)) + copy(*out, *in) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GenericKubernetesAuth. @@ -336,7 +341,7 @@ func (in *InfisicalDynamicSecretList) DeepCopyObject() runtime.Object { func (in *InfisicalDynamicSecretSpec) DeepCopyInto(out *InfisicalDynamicSecretSpec) { *out = *in in.ManagedSecretReference.DeepCopyInto(&out.ManagedSecretReference) - out.Authentication = in.Authentication + in.Authentication.DeepCopyInto(&out.Authentication) out.DynamicSecret = in.DynamicSecret out.TLS = in.TLS } @@ -476,7 +481,7 @@ func (in *InfisicalPushSecretSecretSource) DeepCopy() *InfisicalPushSecretSecret func (in *InfisicalPushSecretSpec) DeepCopyInto(out *InfisicalPushSecretSpec) { *out = *in out.Destination = in.Destination - out.Authentication = in.Authentication + in.Authentication.DeepCopyInto(&out.Authentication) in.Push.DeepCopyInto(&out.Push) out.TLS = in.TLS } @@ -583,7 +588,7 @@ func (in *InfisicalSecretList) DeepCopyObject() runtime.Object { func (in *InfisicalSecretSpec) DeepCopyInto(out *InfisicalSecretSpec) { *out = *in out.TokenSecretReference = in.TokenSecretReference - out.Authentication = in.Authentication + in.Authentication.DeepCopyInto(&out.Authentication) in.ManagedSecretReference.DeepCopyInto(&out.ManagedSecretReference) if in.ManagedKubeSecretReferences != nil { in, out := &in.ManagedKubeSecretReferences, &out.ManagedKubeSecretReferences @@ -654,6 +659,11 @@ func (in *KubernetesAuthDetails) DeepCopyInto(out *KubernetesAuthDetails) { *out = *in out.ServiceAccountRef = in.ServiceAccountRef out.SecretsScope = in.SecretsScope + if in.ServiceAccountTokenAudiences != nil { + in, out := &in.ServiceAccountTokenAudiences, &out.ServiceAccountTokenAudiences + *out = make([]string, len(*in)) + copy(*out, *in) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesAuthDetails. diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml index c1cb7255d..bcaf2b540 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml @@ -73,6 +73,12 @@ spec: type: object kubernetesAuth: properties: + autoCreateServiceAccountToken: + description: Optionally automatically create a service account + token for the configured service account. If this is set + to `true`, the operator will automatically create a service + account token for the configured service account. + type: boolean identityId: type: string serviceAccountRef: @@ -85,6 +91,13 @@ spec: - name - namespace type: object + serviceAccountTokenAudiences: + description: The audiences to use for the service account + token. This is only relevant if `autoCreateServiceAccountToken` + is true. + items: + type: string + type: array required: - identityId - serviceAccountRef diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml index 25fafd98a..31779c2f2 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml @@ -73,6 +73,12 @@ spec: type: object kubernetesAuth: properties: + autoCreateServiceAccountToken: + description: Optionally automatically create a service account + token for the configured service account. If this is set + to `true`, the operator will automatically create a service + account token for the configured service account. + type: boolean identityId: type: string serviceAccountRef: @@ -85,6 +91,13 @@ spec: - name - namespace type: object + serviceAccountTokenAudiences: + description: The audiences to use for the service account + token. This is only relevant if `autoCreateServiceAccountToken` + is true. + items: + type: string + type: array required: - identityId - serviceAccountRef diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index 49ed43a77..8012521d9 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -136,6 +136,12 @@ spec: type: object kubernetesAuth: properties: + autoCreateServiceAccountToken: + description: Optionally automatically create a service account + token for the configured service account. If this is set + to `true`, the operator will automatically create a service + account token for the configured service account. + type: boolean identityId: type: string secretsScope: @@ -163,6 +169,13 @@ spec: - name - namespace type: object + serviceAccountTokenAudiences: + description: The audiences to use for the service account + token. This is only relevant if `autoCreateServiceAccountToken` + is true. + items: + type: string + type: array required: - identityId - secretsScope diff --git a/k8-operator/config/rbac/role.yaml b/k8-operator/config/rbac/role.yaml index ab0b4463a..542face87 100644 --- a/k8-operator/config/rbac/role.yaml +++ b/k8-operator/config/rbac/role.yaml @@ -16,6 +16,13 @@ rules: - list - update - watch +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list - apiGroups: - "" resources: @@ -35,6 +42,12 @@ rules: - get - list - watch +- apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create - apiGroups: - apps resources: @@ -55,6 +68,12 @@ rules: - list - update - watch +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create - apiGroups: - secrets.infisical.com resources: