From 9977329741f83b4708d788f5970606f13a80c65a Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Wed, 12 Jun 2024 18:25:18 -0400
Subject: [PATCH] add sample resources for k8s auth

---
 .../k8s-auth/cluster-role-binding.yaml        | 13 ++++++++
 .../k8s-auth/infisical-service-account.yaml   |  5 ++++
 .../config/samples/k8s-auth/sample.yaml       | 30 +++++++++++++++++++
 .../k8s-auth/service-account-token.yaml       |  7 +++++
 4 files changed, 55 insertions(+)
 create mode 100644 k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml
 create mode 100644 k8-operator/config/samples/k8s-auth/infisical-service-account.yaml
 create mode 100644 k8-operator/config/samples/k8s-auth/sample.yaml
 create mode 100644 k8-operator/config/samples/k8s-auth/service-account-token.yaml

diff --git a/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml b/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml
new file mode 100644
index 000000000..c1adb56e4
--- /dev/null
+++ b/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml
@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: role-tokenreview-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-auth
+    namespace: default
diff --git a/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml b/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml
new file mode 100644
index 000000000..60c7f14fd
--- /dev/null
+++ b/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-auth
+  namespace: default
\ No newline at end of file
diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml
new file mode 100644
index 000000000..e4082a9ae
--- /dev/null
+++ b/k8-operator/config/samples/k8s-auth/sample.yaml
@@ -0,0 +1,30 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+    name: infisicalsecret-sample
+    labels:
+        label-to-be-passed-to-managed-secret: sample-value
+    annotations:
+        example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
+spec:
+    hostAPI: https://app.infisical.com/api
+    resyncInterval: 10
+    authentication:
+        # Native Kubernetes Auth
+        kubernetesAuth:
+            identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50
+            # serviceAccountTokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token
+
+            # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
+            secretsScope:
+                projectSlug: dsf-gpb-t
+                envSlug: dev
+                secretsPath: "/"
+                recursive: true
+
+
+    managedSecretReference:
+        secretName: managed-secret
+        secretNamespace: default
+        creationPolicy: "Orphan" ## Owner | Orphan
+        # secretType: kubernetes.io/dockerconfigjson
diff --git a/k8-operator/config/samples/k8s-auth/service-account-token.yaml b/k8-operator/config/samples/k8s-auth/service-account-token.yaml
new file mode 100644
index 000000000..894c98b06
--- /dev/null
+++ b/k8-operator/config/samples/k8s-auth/service-account-token.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: infisical-auth-token
+  annotations:
+    kubernetes.io/service-account.name: "infisical-auth"
\ No newline at end of file