feat(k8-operator): push secrets

k8-operator/api/v1alpha1/infisicalpushsecret_types.go

@@ -0,0 +1,141 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type InfisicalPushSecretDestination struct {
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Immutable
+	SecretsPath string `json:"secretsPath"`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Immutable
+	EnvSlug string `json:"envSlug"`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Immutable
+	ProjectID string `json:"projectId"`
+}
+
+type PushSecretTlsConfig struct {
+	// Reference to secret containing CA cert
+	// +kubebuilder:validation:Optional
+	CaRef CaReference `json:"caRef,omitempty"`
+}
+
+// PushSecretUniversalAuth defines universal authentication
+type PushSecretUniversalAuth struct {
+	// +kubebuilder:validation:Required
+	CredentialsRef KubeSecretReference `json:"credentialsRef"`
+}
+
+type PushSecretAwsIamAuth struct {
+	// +kubebuilder:validation:Required
+	IdentityID string `json:"identityId"`
+}
+
+type PushSecretAzureAuth struct {
+	// +kubebuilder:validation:Required
+	IdentityID string `json:"identityId"`
+	// +kubebuilder:validation:Optional
+	Resource string `json:"resource,omitempty"`
+}
+
+type PushSecretGcpIdTokenAuth struct {
+	// +kubebuilder:validation:Required
+	IdentityID string `json:"identityId"`
+}
+
+type PushSecretGcpIamAuth struct {
+	// +kubebuilder:validation:Required
+	IdentityID string `json:"identityId"`
+	// +kubebuilder:validation:Required
+	ServiceAccountKeyFilePath string `json:"serviceAccountKeyFilePath"`
+}
+
+// Rest of your types should be defined similarly...
+type PushSecretKubernetesAuth struct {
+	// +kubebuilder:validation:Required
+	IdentityID string `json:"identityId"`
+	// +kubebuilder:validation:Required
+	ServiceAccountRef KubernetesServiceAccountRef `json:"serviceAccountRef"`
+}
+
+type PushSecretAuthentication struct {
+	// +kubebuilder:validation:Optional
+	UniversalAuth PushSecretUniversalAuth `json:"universalAuth,omitempty"`
+	// +kubebuilder:validation:Optional
+	KubernetesAuth PushSecretKubernetesAuth `json:"kubernetesAuth,omitempty"`
+	// +kubebuilder:validation:Optional
+	AwsIamAuth PushSecretAwsIamAuth `json:"awsIamAuth,omitempty"`
+	// +kubebuilder:validation:Optional
+	AzureAuth PushSecretAzureAuth `json:"azureAuth,omitempty"`
+	// +kubebuilder:validation:Optional
+	GcpIdTokenAuth PushSecretGcpIdTokenAuth `json:"gcpIdTokenAuth,omitempty"`
+	// +kubebuilder:validation:Optional
+	GcpIamAuth PushSecretGcpIamAuth `json:"gcpIamAuth,omitempty"`
+}
+
+type SecretPush struct {
+	// +kubebuilder:validation:Required
+	Secret KubeSecretReference `json:"secret"`
+}
+
+// InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret
+type InfisicalPushSecretSpec struct {
+	// +kubebuilder:validation:Optional
+	UpdatePolicy string `json:"updatePolicy"`
+
+	// +kubebuilder:validation:Optional
+	DeletionPolicy string `json:"deletionPolicy"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Immutable
+	Destination InfisicalPushSecretDestination `json:"destination"`
+
+	// +kubebuilder:validation:Optional
+	Authentication PushSecretAuthentication `json:"authentication"`
+
+	// +kubebuilder:validation:Required
+	Push SecretPush `json:"push"`
+
+	ResyncInterval string `json:"resyncInterval"`
+
+	// Infisical host to pull secrets from
+	// +kubebuilder:validation:Optional
+	HostAPI string `json:"hostAPI"`
+
+	// +kubebuilder:validation:Optional
+	TLS PushSecretTlsConfig `json:"tls"`
+}
+
+// InfisicalPushSecretStatus defines the observed state of InfisicalPushSecret
+type InfisicalPushSecretStatus struct {
+	Conditions []metav1.Condition `json:"conditions"`
+
+	// managed secrets is a map where the key is the ID, and the value is the secret key (string[id], string[key] )
+	ManagedSecrets map[string]string `json:"managedSecrets"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// InfisicalPushSecret is the Schema for the infisicalpushsecrets API
+type InfisicalPushSecret struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   InfisicalPushSecretSpec   `json:"spec,omitempty"`
+	Status InfisicalPushSecretStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// InfisicalPushSecretList contains a list of InfisicalPushSecret
+type InfisicalPushSecretList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []InfisicalPushSecret `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&InfisicalPushSecret{}, &InfisicalPushSecretList{})
+}

k8-operator/api/v1alpha1/zz_generated.deepcopy.go

@@ -128,6 +128,128 @@ func (in *GcpIamAuthDetails) DeepCopy() *GcpIamAuthDetails {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfisicalPushSecret) DeepCopyInto(out *InfisicalPushSecret) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalPushSecret.
+func (in *InfisicalPushSecret) DeepCopy() *InfisicalPushSecret {
+	if in == nil {
+		return nil
+	}
+	out := new(InfisicalPushSecret)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InfisicalPushSecret) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfisicalPushSecretDestination) DeepCopyInto(out *InfisicalPushSecretDestination) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalPushSecretDestination.
+func (in *InfisicalPushSecretDestination) DeepCopy() *InfisicalPushSecretDestination {
+	if in == nil {
+		return nil
+	}
+	out := new(InfisicalPushSecretDestination)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfisicalPushSecretList) DeepCopyInto(out *InfisicalPushSecretList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]InfisicalPushSecret, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalPushSecretList.
+func (in *InfisicalPushSecretList) DeepCopy() *InfisicalPushSecretList {
+	if in == nil {
+		return nil
+	}
+	out := new(InfisicalPushSecretList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InfisicalPushSecretList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfisicalPushSecretSpec) DeepCopyInto(out *InfisicalPushSecretSpec) {
+	*out = *in
+	out.Destination = in.Destination
+	out.Authentication = in.Authentication
+	out.Push = in.Push
+	out.TLS = in.TLS
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalPushSecretSpec.
+func (in *InfisicalPushSecretSpec) DeepCopy() *InfisicalPushSecretSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(InfisicalPushSecretSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfisicalPushSecretStatus) DeepCopyInto(out *InfisicalPushSecretStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ManagedSecrets != nil {
+		in, out := &in.ManagedSecrets, &out.ManagedSecrets
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalPushSecretStatus.
+func (in *InfisicalPushSecretStatus) DeepCopy() *InfisicalPushSecretStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(InfisicalPushSecretStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *InfisicalSecret) DeepCopyInto(out *InfisicalSecret) {
 	*out = *in
@@ -332,6 +454,151 @@ func (in *MangedKubeSecretConfig) DeepCopy() *MangedKubeSecretConfig {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAuthentication) DeepCopyInto(out *PushSecretAuthentication) {
+	*out = *in
+	out.UniversalAuth = in.UniversalAuth
+	out.KubernetesAuth = in.KubernetesAuth
+	out.AwsIamAuth = in.AwsIamAuth
+	out.AzureAuth = in.AzureAuth
+	out.GcpIdTokenAuth = in.GcpIdTokenAuth
+	out.GcpIamAuth = in.GcpIamAuth
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAuthentication.
+func (in *PushSecretAuthentication) DeepCopy() *PushSecretAuthentication {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAuthentication)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAwsIamAuth) DeepCopyInto(out *PushSecretAwsIamAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAwsIamAuth.
+func (in *PushSecretAwsIamAuth) DeepCopy() *PushSecretAwsIamAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAwsIamAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAzureAuth) DeepCopyInto(out *PushSecretAzureAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAzureAuth.
+func (in *PushSecretAzureAuth) DeepCopy() *PushSecretAzureAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAzureAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretGcpIamAuth) DeepCopyInto(out *PushSecretGcpIamAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretGcpIamAuth.
+func (in *PushSecretGcpIamAuth) DeepCopy() *PushSecretGcpIamAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretGcpIamAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretGcpIdTokenAuth) DeepCopyInto(out *PushSecretGcpIdTokenAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretGcpIdTokenAuth.
+func (in *PushSecretGcpIdTokenAuth) DeepCopy() *PushSecretGcpIdTokenAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretGcpIdTokenAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretKubernetesAuth) DeepCopyInto(out *PushSecretKubernetesAuth) {
+	*out = *in
+	out.ServiceAccountRef = in.ServiceAccountRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretKubernetesAuth.
+func (in *PushSecretKubernetesAuth) DeepCopy() *PushSecretKubernetesAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretKubernetesAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretTlsConfig) DeepCopyInto(out *PushSecretTlsConfig) {
+	*out = *in
+	out.CaRef = in.CaRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretTlsConfig.
+func (in *PushSecretTlsConfig) DeepCopy() *PushSecretTlsConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretTlsConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretUniversalAuth) DeepCopyInto(out *PushSecretUniversalAuth) {
+	*out = *in
+	out.CredentialsRef = in.CredentialsRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretUniversalAuth.
+func (in *PushSecretUniversalAuth) DeepCopy() *PushSecretUniversalAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretUniversalAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SecretPush) DeepCopyInto(out *SecretPush) {
+	*out = *in
+	out.Secret = in.Secret
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretPush.
+func (in *SecretPush) DeepCopy() *SecretPush {
+	if in == nil {
+		return nil
+	}
+	out := new(SecretPush)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) {
 	*out = *in