Merge pull request #1908 from Infisical/daniel/k8-mi-include-imports

Feat: Include Imports for Machine Identity auth

helm-charts/secrets-operator/values.yaml

@@ -32,7 +32,7 @@ controllerManager:
         - ALL
     image:
       repository: infisical/kubernetes-operator
-      tag: v0.5.1 # fixed to prevent accidental upgrade
+      tag: v0.5.2 # fixed to prevent accidental upgrade
     resources:
       limits:
         cpu: 500m

k8-operator/packages/api/api.go

@@ -156,6 +156,7 @@ func CallGetDecryptedSecretsV3(httpClient *resty.Client, request GetDecryptedSec
 		R().
 		SetResult(&decryptedSecretsResponse).
 		SetHeader("User-Agent", USER_AGENT_NAME).
+		SetQueryParam("include_imports", "true").
 		SetQueryParam("secretPath", request.SecretPath).
 		SetQueryParam("workspaceSlug", request.ProjectSlug).
 		SetQueryParam("environment", request.Environment)

k8-operator/packages/api/models.go

@@ -84,6 +84,13 @@ type ImportedSecretV3 struct {
 	Secrets     []EncryptedSecretV3 `json:"secrets"`
 }
 
+type ImportedRawSecretV3 struct {
+	Environment string              `json:"environment"`
+	FolderId    string              `json:"folderId"`
+	SecretPath  string              `json:"secretPath"`
+	Secrets     []DecryptedSecretV3 `json:"secrets"`
+}
+
 type GetEncryptedSecretsV3Response struct {
 	Secrets         []EncryptedSecretV3 `json:"secrets"`
 	ImportedSecrets []ImportedSecretV3  `json:"imports,omitempty"`
@@ -92,9 +99,10 @@ type GetEncryptedSecretsV3Response struct {
 }
 
 type GetDecryptedSecretsV3Response struct {
-	Secrets  []DecryptedSecretV3 `json:"secrets"`
+	Secrets  []DecryptedSecretV3   `json:"secrets"`
-	ETag     string              `json:"ETag,omitempty"`
+	ETag     string                `json:"ETag,omitempty"`
-	Modified bool                `json:"modified,omitempty"`
+	Modified bool                  `json:"modified,omitempty"`
+	Imports  []ImportedRawSecretV3 `json:"imports,omitempty"`
 }
 
 type GetDecryptedSecretsV3Request struct {

k8-operator/packages/util/secrets.go

@@ -81,7 +81,13 @@ func GetPlainTextSecretsViaUniversalAuth(accessToken string, etag string, secret
 		})
 	}
 
-	return secrets, model.RequestUpdateUpdateDetails{
+	// No need to do expansion for Machine Identity auth as this is handled on server-side.
+	mergedSecrets := MergeRawImportedSecrets(secrets, secretsResponse.Imports)
+	if err != nil {
+		return nil, model.RequestUpdateUpdateDetails{}, err
+	}
+
+	return mergedSecrets, model.RequestUpdateUpdateDetails{
 		Modified: secretsResponse.Modified,
 		ETag:     secretsResponse.ETag,
 	}, nil
@@ -436,3 +442,32 @@ func InjectImportedSecret(plainTextWorkspaceKey []byte, secrets []model.SingleEn
 
 	return secrets, nil
 }
+
+func MergeRawImportedSecrets(secrets []model.SingleEnvironmentVariable, importedSecrets []api.ImportedRawSecretV3) []model.SingleEnvironmentVariable {
+	if importedSecrets == nil {
+		return secrets
+	}
+
+	hasOverriden := make(map[string]bool)
+	for _, sec := range secrets {
+		hasOverriden[sec.Key] = true
+	}
+
+	for i := len(importedSecrets) - 1; i >= 0; i-- {
+		importSec := importedSecrets[i]
+
+		for _, sec := range importSec.Secrets {
+			if _, ok := hasOverriden[sec.SecretKey]; !ok {
+				secrets = append(secrets, model.SingleEnvironmentVariable{
+					Key:   sec.SecretKey,
+					Value: sec.SecretValue,
+					Type:  sec.Type,
+					ID:    sec.ID,
+				})
+				hasOverriden[sec.SecretKey] = true
+			}
+		}
+	}
+
+	return secrets
+}