feat(k8-operator): push secrets

k8-operator/config/samples/crd/pushsecret/pushSecret.yaml

@@ -0,0 +1,45 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalPushSecret
+metadata:
+  name: infisical-push-secret-demo
+spec:
+  resyncInterval: 1m
+  hostAPI: https://app.infisical.com/api
+
+  # Optional, defaults to replacement.
+  updatePolicy: Replace # If set to replace, existing secrets inside Infisical will be replaced by the value of the PushSecret on sync.
+
+  # Optional, defaults to no deletion.
+  deletionPolicy: Delete # If set to delete, the secret(s) inside Infisical managed by the operator, will be deleted if the InfisicalPushSecret CRD is deleted.
+
+  destination:
+    projectId: <project-id>
+    envSlug: <env-slug>
+    secretsPath: <secret-path>
+
+  push:
+    secret:
+      secretName: push-secret-demo # Secret CRD
+      secretNamespace: default
+
+  # Only have one authentication method defined or you are likely to run into authentication issues.
+  # Remove all except one authentication method.
+  authentication:
+    awsIamAuth:
+      identityId: <machine-identity-id>
+    azureAuth:
+      identityId: <machine-identity-id>
+    gcpIamAuth:
+      identityId: <machine-identity-id>
+      serviceAccountKeyFilePath: </path-to-service-account-key-file.json>
+    gcpIdTokenAuth:
+      identityId: <machine-identity-id>
+    kubernetesAuth:
+      identityId: <machine-identity-id>
+      serviceAccountRef:
+        name: <secret-name>
+        namespace: <secret-namespace>
+    universalAuth:
+      credentialsRef:
+        secretName: <secret-name> # universal-auth-credentials
+        secretNamespace: <secret-namespace> # default

k8-operator/config/samples/crd/pushsecret/sourceSecret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: push-secret-demo
+  namespace: default
+stringData: # can also be "data", but needs to be base64 encoded
+  API_KEY: some-api-key
+  DATABASE_URL: postgres://127.0.0.1:5432
+  ENCRYPTION_KEY: fabcc12-a22-facbaa4-11aa568aab