From 72bf160f2ee16929199852a49c054ac90b9e3b05 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 15 Dec 2022 20:02:22 -0500 Subject: [PATCH 1/7] add secrets ready to sync condition --- .../api/v1alpha1/infisicalsecret_types.go | 4 +- ...ecrets.infisical.com_infisicalsecrets.yaml | 12 ++--- .../secrets_v1alpha1_infisicalsecret.yaml | 8 +++- .../controllers/infisicalsecret_controller.go | 6 ++- .../controllers/infisicalsecret_helper.go | 44 +++++++++++++++---- 5 files changed, 56 insertions(+), 18 deletions(-) diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index d7a7c2eab..c35b4ab62 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -7,11 +7,11 @@ import ( type KubeSecretReference struct { // The name of the Kubernetes Secret // +kubebuilder:validation:Required - Name string `json:"name"` + SecretName string `json:"secretName"` // The name space where the Kubernetes Secret is located // +kubebuilder:validation:Required - Namespace string `json:"namespace,omitempty"` + SecretNamespace string `json:"secretNamespace,omitempty"` } // InfisicalSecretSpec defines the desired state of InfisicalSecret diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index 948c9d4b4..dd658e12b 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -40,25 +40,25 @@ spec: type: string infisicalToken: properties: - name: + secretName: description: The name of the Kubernetes Secret type: string - namespace: + secretNamespace: description: The name space where the Kubernetes Secret is located type: string required: - - name + - secretName type: object managedSecret: properties: - name: + secretName: description: The name of the Kubernetes Secret type: string - namespace: + secretNamespace: description: The name space where the Kubernetes Secret is located type: string required: - - name + - secretName type: object projectId: description: The Infisical project id diff --git a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml b/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml index 170beae0b..20f7c87c6 100644 --- a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml +++ b/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml @@ -9,4 +9,10 @@ metadata: app.kubernetes.io/created-by: k8-operator name: infisicalsecret-sample spec: - # TODO(user): Add fields here + projectId: 62faf98ae0b05e8529b5da46 + infisicalToken: + secretName: service-token + secretNamespace: default + managedSecret: + secretName: managed-secret + secretNamespace: default diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index dccb7cd8d..7a4726a84 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -54,6 +54,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ } err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR) + r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) if err != nil { log.Error(err, "Unable to reconcile Infisical Secret and will try again") return ctrl.Result{ @@ -61,7 +62,10 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ }, nil } - return ctrl.Result{}, nil + // Sync again after the specified time + return ctrl.Result{ + RequeueAfter: time.Minute, + }, nil } // SetupWithManager sets up the controller with the Manager. diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index c2af793c3..f9c84fdff 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -9,6 +9,7 @@ import ( models "github.com/Infisical/infisical/k8-operator/packages/models" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" ) @@ -27,17 +28,17 @@ func (r *InfisicalSecretReconciler) GetKubeSecretByNamespacedName(ctx context.Co func (r *InfisicalSecretReconciler) GetInfisicalToken(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) { tokenSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{ - Namespace: infisicalSecret.Spec.ManagedSecret.Namespace, - Name: infisicalSecret.Spec.ManagedSecret.Name, + Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, + Name: infisicalSecret.Spec.ManagedSecret.SecretName, }) if err != nil { - return "", fmt.Errorf("failed to read infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecret.Name, infisicalSecret.Spec.ManagedSecret.Namespace, err) + return "", fmt.Errorf("failed to read infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecret.SecretName, infisicalSecret.Spec.ManagedSecret.SecretNamespace, err) } infisicalServiceToken := tokenSecret.Data[INFISICAL_TOKEN_SECRET_KEY_NAME] if infisicalServiceToken == nil { - return "", fmt.Errorf("the Infisical token is not set in the Kubernetes secret. Please add the key [%s] with the corresponding token value.", INFISICAL_TOKEN_SECRET_KEY_NAME) + return "", fmt.Errorf("the Infisical token is not set in the Kubernetes secret. Please add the key [%s] with the corresponding token value", INFISICAL_TOKEN_SECRET_KEY_NAME) } return string(infisicalServiceToken), nil @@ -52,8 +53,8 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context // create a new secret as specified by the managed secret spec of CRD newKubeSecretInstance := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ - Name: infisicalSecret.Spec.ManagedSecret.Name, - Namespace: infisicalSecret.Spec.ManagedSecret.Namespace, + Name: infisicalSecret.Spec.ManagedSecret.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, }, Type: "Opaque", Data: plainProcessedSecrets, @@ -91,8 +92,8 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } managedKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{ - Name: infisicalSecret.Spec.ManagedSecret.Name, - Namespace: infisicalSecret.Spec.ManagedSecret.Namespace, + Name: infisicalSecret.Spec.ManagedSecret.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, }) if err != nil && !errors.IsNotFound(err) { @@ -111,3 +112,30 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } } + +func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, maybeSecretsSyncError error) { + if infisicalSecret.Status.Conditions == nil { + infisicalSecret.Status.Conditions = []metav1.Condition{} + } + + if maybeSecretsSyncError == nil { + meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ + Type: "secrets.infisical.com/ReadyToSyncSecrets", + Status: metav1.ConditionTrue, + Reason: "OK", + Message: "Infisical controller has started syncing your secrets", + }) + } else { + meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ + Type: "secrets.infisical.com/ReadyToSyncSecrets", + Status: metav1.ConditionFalse, + Reason: "Error", + Message: fmt.Sprintf("Failed to update secret because: %v", maybeSecretsSyncError), + }) + } + + err := r.Client.Status().Update(ctx, infisicalSecret) + if err != nil { + fmt.Println("Could not set condition") + } +} From 7fe2e15a9867349b78317904cd7167d06a474a76 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 15 Dec 2022 22:25:44 -0500 Subject: [PATCH 2/7] add substitution into k8 and fix loading token --- .../api/v1alpha1/infisicalsecret_types.go | 6 +- ...ecrets.infisical.com_infisicalsecrets.yaml | 5 ++ .../secrets_v1alpha1_infisicalsecret.yaml | 1 + .../controllers/infisicalsecret_controller.go | 2 +- .../controllers/infisicalsecret_helper.go | 48 ++++++++++-- k8-operator/packages/api/api.go | 73 ++++++++++++++++++- 6 files changed, 122 insertions(+), 13 deletions(-) diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index c35b4ab62..74e3f9788 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -11,7 +11,7 @@ type KubeSecretReference struct { // The name space where the Kubernetes Secret is located // +kubebuilder:validation:Required - SecretNamespace string `json:"secretNamespace,omitempty"` + SecretNamespace string `json:"secretNamespace"` } // InfisicalSecretSpec defines the desired state of InfisicalSecret @@ -21,11 +21,11 @@ type InfisicalSecretSpec struct { // The Infisical project id // +kubebuilder:validation:Required - ProjectId string `json:"projectId,omitempty"` + ProjectId string `json:"projectId"` // The Infisical environment such as dev, prod, testing // +kubebuilder:validation:Required - Environment string `json:"environment,omitempty"` + Environment string `json:"environment"` } // InfisicalSecretStatus defines the observed state of InfisicalSecret diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index dd658e12b..ca00676b4 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -48,6 +48,7 @@ spec: type: string required: - secretName + - secretNamespace type: object managedSecret: properties: @@ -59,10 +60,14 @@ spec: type: string required: - secretName + - secretNamespace type: object projectId: description: The Infisical project id type: string + required: + - environment + - projectId type: object status: description: InfisicalSecretStatus defines the observed state of InfisicalSecret diff --git a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml b/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml index 20f7c87c6..7ab08e9cd 100644 --- a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml +++ b/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml @@ -10,6 +10,7 @@ metadata: name: infisicalsecret-sample spec: projectId: 62faf98ae0b05e8529b5da46 + environment: dev infisicalToken: secretName: service-token secretNamespace: default diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 7a4726a84..297e29bfb 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -71,6 +71,6 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ // SetupWithManager sets up the controller with the Manager. func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error { return ctrl.NewControllerManagedBy(mgr). - For(&secretsv1alpha1.InfisicalSecret{}). + For(&secretsv1alpha1.InfisicalSecret{}). // TODO we should also be watching secrets with the name specifed Complete(r) } diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index f9c84fdff..fbcacadea 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -3,6 +3,7 @@ package controllers import ( "context" "fmt" + "strings" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" api "github.com/Infisical/infisical/k8-operator/packages/api" @@ -28,12 +29,12 @@ func (r *InfisicalSecretReconciler) GetKubeSecretByNamespacedName(ctx context.Co func (r *InfisicalSecretReconciler) GetInfisicalToken(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) { tokenSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{ - Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, - Name: infisicalSecret.Spec.ManagedSecret.SecretName, + Namespace: infisicalSecret.Spec.InfisicalToken.SecretNamespace, + Name: infisicalSecret.Spec.InfisicalToken.SecretName, }) if err != nil { - return "", fmt.Errorf("failed to read infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecret.SecretName, infisicalSecret.Spec.ManagedSecret.SecretNamespace, err) + return "", fmt.Errorf("failed to read Infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecret.SecretName, infisicalSecret.Spec.ManagedSecret.SecretNamespace, err) } infisicalServiceToken := tokenSecret.Data[INFISICAL_TOKEN_SECRET_KEY_NAME] @@ -41,7 +42,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalToken(ctx context.Context, infis return "", fmt.Errorf("the Infisical token is not set in the Kubernetes secret. Please add the key [%s] with the corresponding token value", INFISICAL_TOKEN_SECRET_KEY_NAME) } - return string(infisicalServiceToken), nil + return strings.Replace(string(infisicalServiceToken), " ", "", -1), nil } func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []models.SingleEnvironmentVariable) error { @@ -87,6 +88,7 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { infisicalToken, err := r.GetInfisicalToken(ctx, infisicalSecret) + r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, err) if err != nil { return fmt.Errorf("unable to load Infisical Token from the specified Kubernetes secret with error [%w]", err) } @@ -101,6 +103,7 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } secretsFromApi, err := api.GetAllEnvironmentVariables(infisicalSecret.Spec.ProjectId, infisicalSecret.Spec.Environment, infisicalToken) + if err != nil { return err } @@ -113,12 +116,14 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } -func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, maybeSecretsSyncError error) { +// Conditions + +func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, errorToConditionOn error) { if infisicalSecret.Status.Conditions == nil { infisicalSecret.Status.Conditions = []metav1.Condition{} } - if maybeSecretsSyncError == nil { + if errorToConditionOn == nil { meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ Type: "secrets.infisical.com/ReadyToSyncSecrets", Status: metav1.ConditionTrue, @@ -130,12 +135,39 @@ func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context. Type: "secrets.infisical.com/ReadyToSyncSecrets", Status: metav1.ConditionFalse, Reason: "Error", - Message: fmt.Sprintf("Failed to update secret because: %v", maybeSecretsSyncError), + Message: fmt.Sprintf("Failed to update secret because: %v", errorToConditionOn), }) } err := r.Client.Status().Update(ctx, infisicalSecret) if err != nil { - fmt.Println("Could not set condition") + fmt.Println("Could not set condition", err) + } +} + +func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, errorToConditionOn error) { + if infisicalSecret.Status.Conditions == nil { + infisicalSecret.Status.Conditions = []metav1.Condition{} + } + + if errorToConditionOn == nil { + meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ + Type: "secrets.infisical.com/LoadedInfisicalToken", + Status: metav1.ConditionTrue, + Reason: "OK", + Message: "Infisical controller has located the Infisical token in provided Kubernetes secret", + }) + } else { + meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ + Type: "secrets.infisical.com/LoadedInfisicalToken", + Status: metav1.ConditionFalse, + Reason: "Error", + Message: fmt.Sprintf("Failed to load Infisical Token because: %v", errorToConditionOn), + }) + } + + err := r.Client.Status().Update(ctx, infisicalSecret) + if err != nil { + fmt.Println("Could not set condition for LoadedInfisicalToken") } } diff --git a/k8-operator/packages/api/api.go b/k8-operator/packages/api/api.go index 28939147f..ac2cc5b25 100644 --- a/k8-operator/packages/api/api.go +++ b/k8-operator/packages/api/api.go @@ -4,6 +4,7 @@ import ( "encoding/base64" "errors" "fmt" + "regexp" "strings" "github.com/Infisical/infisical/k8-operator/packages/crypto" @@ -20,7 +21,7 @@ func GetAllEnvironmentVariables(projectId string, envName string, infisicalToken return nil, err } - return envsFromApi, nil + return SubstituteSecrets(envsFromApi), nil } func GetSecretsFromAPIUsingInfisicalToken(infisicalToken string, envName string, projectId string) ([]models.SingleEnvironmentVariable, error) { @@ -106,3 +107,73 @@ func GetSecretsFromAPIUsingInfisicalToken(infisicalToken string, envName string, return listOfEnv, nil } + +func getExpandedEnvVariable(secrets []models.SingleEnvironmentVariable, variableWeAreLookingFor string, hashMapOfCompleteVariables map[string]string, hashMapOfSelfRefs map[string]string) string { + if value, found := hashMapOfCompleteVariables[variableWeAreLookingFor]; found { + return value + } + + for _, secret := range secrets { + if secret.Key == variableWeAreLookingFor { + regex := regexp.MustCompile(`\${([^\}]*)}`) + variablesToPopulate := regex.FindAllString(secret.Value, -1) + + // case: variable is a constant so return its value + if len(variablesToPopulate) == 0 { + return secret.Value + } + + valueToEdit := secret.Value + for _, variableWithSign := range variablesToPopulate { + variableWithoutSign := strings.Trim(variableWithSign, "}") + variableWithoutSign = strings.Trim(variableWithoutSign, "${") + + // case: reference to self + if variableWithoutSign == secret.Key { + hashMapOfSelfRefs[variableWithoutSign] = variableWithoutSign + continue + } else { + var expandedVariableValue string + + if preComputedVariable, found := hashMapOfCompleteVariables[variableWithoutSign]; found { + expandedVariableValue = preComputedVariable + } else { + expandedVariableValue = getExpandedEnvVariable(secrets, variableWithoutSign, hashMapOfCompleteVariables, hashMapOfSelfRefs) + hashMapOfCompleteVariables[variableWithoutSign] = expandedVariableValue + } + + // If after expanding all the vars above, is the current var a self ref? if so no replacement needed for it + if _, found := hashMapOfSelfRefs[variableWithoutSign]; found { + continue + } else { + valueToEdit = strings.ReplaceAll(valueToEdit, variableWithSign, expandedVariableValue) + } + } + } + + return valueToEdit + + } else { + continue + } + } + + return "${" + variableWeAreLookingFor + "}" +} + +func SubstituteSecrets(secrets []models.SingleEnvironmentVariable) []models.SingleEnvironmentVariable { + hashMapOfCompleteVariables := make(map[string]string) + hashMapOfSelfRefs := make(map[string]string) + expandedSecrets := []models.SingleEnvironmentVariable{} + + for _, secret := range secrets { + expandedVariable := getExpandedEnvVariable(secrets, secret.Key, hashMapOfCompleteVariables, hashMapOfSelfRefs) + expandedSecrets = append(expandedSecrets, models.SingleEnvironmentVariable{ + Key: secret.Key, + Value: expandedVariable, + }) + + } + + return expandedSecrets +} From c8633bf546c78809e115b8accbf2c9001d21c70c Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 13:57:04 -0500 Subject: [PATCH 3/7] Add new workflow to push k8 operator to prod --- .../workflows/release_docker_k8_operator.yaml | 38 +++++++++++++++++++ k8-operator/Dockerfile | 1 + k8-operator/go.mod | 2 +- 3 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/release_docker_k8_operator.yaml diff --git a/.github/workflows/release_docker_k8_operator.yaml b/.github/workflows/release_docker_k8_operator.yaml new file mode 100644 index 000000000..01aa3b625 --- /dev/null +++ b/.github/workflows/release_docker_k8_operator.yaml @@ -0,0 +1,38 @@ +name: Release Docker image for K8 operator +on: [workflow_dispatch] + +jobs: + release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - name: 🔧 Set up QEMU + uses: docker/setup-qemu-action@v1 + + - name: 🔧 Set up Docker Buildx + uses: docker/setup-buildx-action@v1 + + - name: 🐋 Login to Docker Hub + uses: docker/login-action@v1 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Build and push + id: docker_build + uses: docker/build-push-action@v2 + with: + context: k8-operator + push: true + platforms: linux/amd64,linux/arm64 + tags: infisical/kubernetes-operator:latest + + - uses: actions/setup-go@v2 + + - name: Upload CRD manifest + uses: svenstaro/upload-release-action@v2 + with: + repo_token: ${{ secrets.GITHUB_TOKEN }} + file: dist/install-secrets-operator.yaml + tag: ${{ github.ref }} \ No newline at end of file diff --git a/k8-operator/Dockerfile b/k8-operator/Dockerfile index 8f9cca18e..6a5d70189 100644 --- a/k8-operator/Dockerfile +++ b/k8-operator/Dockerfile @@ -15,6 +15,7 @@ RUN go mod download COPY main.go main.go COPY api/ api/ COPY controllers/ controllers/ +COPY packages/ packages/ # Build # the GOARCH has not a default value to allow the binary be built according to the host where the command diff --git a/k8-operator/go.mod b/k8-operator/go.mod index 44847bf72..023cc9da7 100644 --- a/k8-operator/go.mod +++ b/k8-operator/go.mod @@ -70,7 +70,7 @@ require ( gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/api v0.25.0 // indirect + k8s.io/api v0.25.0 k8s.io/apiextensions-apiserver v0.25.0 // indirect k8s.io/component-base v0.25.0 // indirect k8s.io/klog/v2 v2.70.1 // indirect From a799e1bffcb95cac02a8ea47e34aa58cf72ef1cb Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 13:57:04 -0500 Subject: [PATCH 4/7] Add new workflow to push k8 operator to prod --- helm-charts/secrets-operator/.helmignore | 23 +++ helm-charts/secrets-operator/Chart.yaml | 21 +++ .../secrets-operator/templates/_helpers.tpl | 62 +++++++ .../templates/deployment.yaml | 108 ++++++++++++ .../templates/infisicalsecret-crd.yaml | 156 ++++++++++++++++++ .../templates/leader-election-rbac.yaml | 59 +++++++ .../templates/manager-rbac.yaml | 71 ++++++++ .../templates/metrics-reader-rbac.yaml | 14 ++ .../templates/metrics-service.yaml | 17 ++ .../templates/proxy-rbac.yaml | 40 +++++ helm-charts/secrets-operator/values.yaml | 32 ++++ k8-operator/Makefile | 5 + 12 files changed, 608 insertions(+) create mode 100644 helm-charts/secrets-operator/.helmignore create mode 100644 helm-charts/secrets-operator/Chart.yaml create mode 100644 helm-charts/secrets-operator/templates/_helpers.tpl create mode 100644 helm-charts/secrets-operator/templates/deployment.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml create mode 100644 helm-charts/secrets-operator/templates/leader-election-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/manager-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/metrics-service.yaml create mode 100644 helm-charts/secrets-operator/templates/proxy-rbac.yaml create mode 100644 helm-charts/secrets-operator/values.yaml diff --git a/helm-charts/secrets-operator/.helmignore b/helm-charts/secrets-operator/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/helm-charts/secrets-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml new file mode 100644 index 000000000..26a402da3 --- /dev/null +++ b/helm-charts/secrets-operator/Chart.yaml @@ -0,0 +1,21 @@ +apiVersion: v2 +name: secrets-operator +description: A Helm chart for Infisical secrets +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "0.1.0" diff --git a/helm-charts/secrets-operator/templates/_helpers.tpl b/helm-charts/secrets-operator/templates/_helpers.tpl new file mode 100644 index 000000000..44e464d93 --- /dev/null +++ b/helm-charts/secrets-operator/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "secrets-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "secrets-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "secrets-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "secrets-operator.labels" -}} +helm.sh/chart: {{ include "secrets-operator.chart" . }} +{{ include "secrets-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "secrets-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "secrets-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "secrets-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "secrets-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml new file mode 100644 index 000000000..026728bfa --- /dev/null +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -0,0 +1,108 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager + labels: + app.kubernetes.io/component: manager + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.controllerManager.replicas }} + selector: + matchLabels: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 8 }} + annotations: + kubectl.kubernetes.io/default-container: manager + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + env: + - name: KUBERNETES_CLUSTER_DOMAIN + value: {{ .Values.kubernetesClusterDomain }} + image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag + | default .Chart.AppVersion }} + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent + 10 }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + env: + - name: KUBERNETES_CLUSTER_DOMAIN + value: {{ .Values.kubernetesClusterDomain }} + image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag + | default .Chart.AppVersion }} + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 + }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + securityContext: + runAsNonRoot: true + serviceAccountName: {{ include "secrets-operator.fullname" . }}-controller-manager + terminationGracePeriodSeconds: 10 \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml new file mode 100644 index 000000000..8628a57d9 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -0,0 +1,156 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: infisicalsecrets.secrets.infisical.com + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + group: secrets.infisical.com + names: + kind: InfisicalSecret + listKind: InfisicalSecretList + plural: infisicalsecrets + singular: infisicalsecret + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: InfisicalSecret is the Schema for the infisicalsecrets API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: InfisicalSecretSpec defines the desired state of InfisicalSecret + properties: + environment: + description: The Infisical environment such as dev, prod, testing + type: string + infisicalToken: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + managedSecret: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + projectId: + description: The Infisical project id + type: string + required: + - environment + - projectId + type: object + status: + description: InfisicalSecretStatus defines the observed state of InfisicalSecret + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + \n type FooStatus struct{ // Represents the observations of a foo's + current state. // Known .status.conditions.type are: \"Available\", + \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge + // +listType=map // +listMapKey=type Conditions []metav1.Condition + `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" + protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating details + about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers of + specific condition types may define expected values and meanings + for this field, and whether the values are considered a guaranteed + API. The value should be a CamelCase string. This field may + not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/leader-election-rbac.yaml b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml new file mode 100644 index 000000000..dc41acf14 --- /dev/null +++ b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml @@ -0,0 +1,59 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "secrets-operator.fullname" . }}-leader-election-role + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-leader-election-rolebinding + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: '{{ include "secrets-operator.fullname" . }}-leader-election-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml new file mode 100644 index 000000000..a560790f6 --- /dev/null +++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml @@ -0,0 +1,71 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-manager-role + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/finalizers + verbs: + - update +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-manager-rolebinding + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: '{{ include "secrets-operator.fullname" . }}-manager-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml new file mode 100644 index 000000000..7d7ceba46 --- /dev/null +++ b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-metrics-reader + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- nonResourceURLs: + - /metrics + verbs: + - get \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml new file mode 100644 index 000000000..ebf7ce549 --- /dev/null +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.metricsService.type }} + selector: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 4 }} + ports: + {{- .Values.metricsService.ports | toYaml | nindent 2 -}} \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/proxy-rbac.yaml b/helm-charts/secrets-operator/templates/proxy-rbac.yaml new file mode 100644 index 000000000..5f07e2908 --- /dev/null +++ b/helm-charts/secrets-operator/templates/proxy-rbac.yaml @@ -0,0 +1,40 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-proxy-role + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-proxy-rolebinding + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: '{{ include "secrets-operator.fullname" . }}-proxy-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml new file mode 100644 index 000000000..32ae2f789 --- /dev/null +++ b/helm-charts/secrets-operator/values.yaml @@ -0,0 +1,32 @@ +controllerManager: + kubeRbacProxy: + image: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.13.1 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + manager: + image: + repository: infisical/kubernetes-operator + tag: latest + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + replicas: 1 +kubernetesClusterDomain: cluster.local +metricsService: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + type: ClusterIP diff --git a/k8-operator/Makefile b/k8-operator/Makefile index 9116f8522..541e26b60 100644 --- a/k8-operator/Makefile +++ b/k8-operator/Makefile @@ -36,6 +36,11 @@ all: build help: ## Display this help. @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) + +## Chart +helm-chart: + $(KUSTOMIZE) build config/default | helmify ../helm-charts/secrets-operator + ##@ Development .PHONY: manifests From 033275ed69ca010753fd0c68cc04c3a4ebd00376 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 16:14:05 -0500 Subject: [PATCH 5/7] update read me helm chart --- helm-charts/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/helm-charts/README.md b/helm-charts/README.md index 097464028..468275e3f 100644 --- a/helm-charts/README.md +++ b/helm-charts/README.md @@ -14,3 +14,4 @@ helm install infisical-helm-charts/ #### Available chart names - infisical +- secrets-operator From c12eeac9b337e11a17e0583861e670cd00231e82 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 16 Dec 2022 16:35:08 -0500 Subject: [PATCH 6/7] Add placeholder upcoming integrations to docs --- docs/integrations/cicd/circleci.mdx | 5 +++++ docs/integrations/cloud/flyio.mdx | 5 +++++ docs/integrations/cloud/render.mdx | 5 +++++ docs/integrations/overview.mdx | 4 +++- docs/mint.json | 10 +++++++++- 5 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 docs/integrations/cicd/circleci.mdx create mode 100644 docs/integrations/cloud/flyio.mdx create mode 100644 docs/integrations/cloud/render.mdx diff --git a/docs/integrations/cicd/circleci.mdx b/docs/integrations/cicd/circleci.mdx new file mode 100644 index 000000000..7ded52d8a --- /dev/null +++ b/docs/integrations/cicd/circleci.mdx @@ -0,0 +1,5 @@ +--- +title: "Circle CI" +--- + +Coming soon. diff --git a/docs/integrations/cloud/flyio.mdx b/docs/integrations/cloud/flyio.mdx new file mode 100644 index 000000000..b53a52404 --- /dev/null +++ b/docs/integrations/cloud/flyio.mdx @@ -0,0 +1,5 @@ +--- +title: "Fly.io" +--- + +Coming soon. diff --git a/docs/integrations/cloud/render.mdx b/docs/integrations/cloud/render.mdx new file mode 100644 index 000000000..895bf01d1 --- /dev/null +++ b/docs/integrations/cloud/render.mdx @@ -0,0 +1,5 @@ +--- +title: "Render" +--- + +Coming soon. diff --git a/docs/integrations/overview.mdx b/docs/integrations/overview.mdx index 9323f8917..922221a99 100644 --- a/docs/integrations/overview.mdx +++ b/docs/integrations/overview.mdx @@ -13,12 +13,14 @@ Missing an integration? Throw in a [request](https://github.com/Infisical/infisi | Kubernetes | Platform | Coming soon | | [Heroku](/integrations/cloud/heroku) | Cloud | Available | | [Vercel](/integrations/cloud/vercel) | Cloud | Coming soon | +| [Render](/integrations/cloud/render) | Cloud | Coming soon | +| [Fly.io](/integrations/cloud/flyio) | Cloud | Coming soon | | AWS | Cloud | Coming soon | | GCP | Cloud | Coming soon | | Azure | Cloud | Coming soon | | DigitalOcean | Cloud | Coming soon | | GitLab | CI/CD | Coming soon | -| CircleCI | CI/CD | Coming soon | +| [CircleCI](/integrations/cicd/circleci) | CI/CD | Coming soon | | TravisCI | CI/CD | Coming soon | | GitHub Actions | CI/CD | Coming soon | | Jenkins | CI/CD | Coming soon | diff --git a/docs/mint.json b/docs/mint.json index 547291fa5..7343622db 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -131,7 +131,15 @@ "group": "Cloud", "pages": [ "integrations/cloud/heroku", - "integrations/cloud/vercel" + "integrations/cloud/vercel", + "integrations/cloud/render", + "integrations/cloud/flyio" + ] + }, + { + "group": "CI/CD", + "pages": [ + "integrations/cicd/circleci" ] }, { From 2e84b7e3549b4a56255b7fd9945cf72c6a26f10a Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sat, 17 Dec 2022 15:10:30 -0500 Subject: [PATCH 7/7] Initial schema ideas for logging --- backend/src/controllers/index.ts | 4 ++- backend/src/controllers/logController.ts | 30 ++++++++++++++++ backend/src/index.ts | 4 ++- backend/src/models/index.ts | 5 ++- backend/src/models/log.ts | 46 ++++++++++++++++++++++++ backend/src/routes/index.ts | 4 ++- backend/src/routes/log.ts | 17 +++++++++ 7 files changed, 106 insertions(+), 4 deletions(-) create mode 100644 backend/src/controllers/logController.ts create mode 100644 backend/src/models/log.ts create mode 100644 backend/src/routes/log.ts diff --git a/backend/src/controllers/index.ts b/backend/src/controllers/index.ts index 2d3debfb5..e52d021b1 100644 --- a/backend/src/controllers/index.ts +++ b/backend/src/controllers/index.ts @@ -13,6 +13,7 @@ import * as stripeController from './stripeController'; import * as userActionController from './userActionController'; import * as userController from './userController'; import * as workspaceController from './workspaceController'; +import * as logController from './logController'; export { authController, @@ -29,5 +30,6 @@ export { stripeController, userActionController, userController, - workspaceController + workspaceController, + logController }; diff --git a/backend/src/controllers/logController.ts b/backend/src/controllers/logController.ts new file mode 100644 index 000000000..3e1d7d535 --- /dev/null +++ b/backend/src/controllers/logController.ts @@ -0,0 +1,30 @@ +import { Request, Response } from 'express'; +import * as Sentry from '@sentry/node'; +import { + Log +} from '../models'; + + +export const getLogs = async (req: Request, res: Response) => { + // get logs + + console.log('getLogs'); + let logs; + try { + const { workspaceId } = req.params; + + logs = await Log.find({ + workspace: workspaceId + }); + } catch (err) { + Sentry.setUser({ email: req.user.email }); + Sentry.captureException(err); + return res.status(400).send({ + message: 'Failed to get audit logs' + }); + } + + return res.status(200).send({ + logs + }); +} \ No newline at end of file diff --git a/backend/src/index.ts b/backend/src/index.ts index 28e27cc9a..fd4f867af 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -38,7 +38,8 @@ import { password as passwordRouter, stripe as stripeRouter, integration as integrationRouter, - integrationAuth as integrationAuthRouter + integrationAuth as integrationAuthRouter, + log as logRouter } from './routes'; const connectWithRetry = () => { @@ -92,6 +93,7 @@ app.use('/api/v1/password', passwordRouter); app.use('/api/v1/stripe', stripeRouter); app.use('/api/v1/integration', integrationRouter); app.use('/api/v1/integration-auth', integrationAuthRouter); +app.use('/api/v1/log', logRouter); const server = http.createServer(app); diff --git a/backend/src/models/index.ts b/backend/src/models/index.ts index 9b07f6766..53f5a395a 100644 --- a/backend/src/models/index.ts +++ b/backend/src/models/index.ts @@ -12,6 +12,7 @@ import Token, { IToken } from './token'; import User, { IUser } from './user'; import UserAction, { IUserAction } from './userAction'; import Workspace, { IWorkspace } from './workspace'; +import Log, { ILog } from './log'; export { BackupPrivateKey, @@ -41,5 +42,7 @@ export { UserAction, IUserAction, Workspace, - IWorkspace + IWorkspace, + Log, + ILog }; diff --git a/backend/src/models/log.ts b/backend/src/models/log.ts new file mode 100644 index 000000000..7078ae52f --- /dev/null +++ b/backend/src/models/log.ts @@ -0,0 +1,46 @@ +import { Schema, model, Types } from 'mongoose'; + +export interface ILog { + _id: Types.ObjectId; + user: Types.ObjectId; + workspace: Types.ObjectId; + event: string; + source: string; + ipAddress: string; +} + +// TODO: need a way to store payload info for each +// log + +// which secret is being ref etc. + +const logSchema = new Schema( + { + user: { + type: Schema.Types.ObjectId, + ref: 'User' + }, + workspace: { + type: Schema.Types.ObjectId, + ref: 'Workspace' + }, + event: { + type: String, + required: true + }, + source: { // should this just be a payload attr? + type: String, + required: true + }, + ipAddress: { // store in bytes? + type: String, + required: true + } + }, { + timestamps: true + } +); + +const Log = model('Log', logSchema); + +export default Log; \ No newline at end of file diff --git a/backend/src/routes/index.ts b/backend/src/routes/index.ts index cf015abfb..97dc72c83 100644 --- a/backend/src/routes/index.ts +++ b/backend/src/routes/index.ts @@ -14,6 +14,7 @@ import password from './password'; import stripe from './stripe'; import integration from './integration'; import integrationAuth from './integrationAuth'; +import log from './log'; export { signup, @@ -31,5 +32,6 @@ export { password, stripe, integration, - integrationAuth + integrationAuth, + log }; diff --git a/backend/src/routes/log.ts b/backend/src/routes/log.ts new file mode 100644 index 000000000..43d91d7ac --- /dev/null +++ b/backend/src/routes/log.ts @@ -0,0 +1,17 @@ +import express from 'express'; +const router = express.Router(); +import { + requireAuth, + validateRequest +} from '../middleware'; +import { logController } from '../controllers'; + +// TODO: workspaceId validation +router.get( + '/:workspaceId', + requireAuth, + validateRequest, + logController.getLogs +); + +export default router; \ No newline at end of file