Merge branch 'heads/main' into daniel/k8s-dynamic-secrets

k8-operator/api/v1alpha1/zz_generated.deepcopy.go

@@ -720,6 +720,151 @@ func (in *SecretPush) DeepCopy() *SecretPush {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAuthentication) DeepCopyInto(out *PushSecretAuthentication) {
+	*out = *in
+	out.UniversalAuth = in.UniversalAuth
+	out.KubernetesAuth = in.KubernetesAuth
+	out.AwsIamAuth = in.AwsIamAuth
+	out.AzureAuth = in.AzureAuth
+	out.GcpIdTokenAuth = in.GcpIdTokenAuth
+	out.GcpIamAuth = in.GcpIamAuth
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAuthentication.
+func (in *PushSecretAuthentication) DeepCopy() *PushSecretAuthentication {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAuthentication)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAwsIamAuth) DeepCopyInto(out *PushSecretAwsIamAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAwsIamAuth.
+func (in *PushSecretAwsIamAuth) DeepCopy() *PushSecretAwsIamAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAwsIamAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretAzureAuth) DeepCopyInto(out *PushSecretAzureAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretAzureAuth.
+func (in *PushSecretAzureAuth) DeepCopy() *PushSecretAzureAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretAzureAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretGcpIamAuth) DeepCopyInto(out *PushSecretGcpIamAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretGcpIamAuth.
+func (in *PushSecretGcpIamAuth) DeepCopy() *PushSecretGcpIamAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretGcpIamAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretGcpIdTokenAuth) DeepCopyInto(out *PushSecretGcpIdTokenAuth) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretGcpIdTokenAuth.
+func (in *PushSecretGcpIdTokenAuth) DeepCopy() *PushSecretGcpIdTokenAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretGcpIdTokenAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretKubernetesAuth) DeepCopyInto(out *PushSecretKubernetesAuth) {
+	*out = *in
+	out.ServiceAccountRef = in.ServiceAccountRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretKubernetesAuth.
+func (in *PushSecretKubernetesAuth) DeepCopy() *PushSecretKubernetesAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretKubernetesAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretTlsConfig) DeepCopyInto(out *PushSecretTlsConfig) {
+	*out = *in
+	out.CaRef = in.CaRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretTlsConfig.
+func (in *PushSecretTlsConfig) DeepCopy() *PushSecretTlsConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretTlsConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PushSecretUniversalAuth) DeepCopyInto(out *PushSecretUniversalAuth) {
+	*out = *in
+	out.CredentialsRef = in.CredentialsRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PushSecretUniversalAuth.
+func (in *PushSecretUniversalAuth) DeepCopy() *PushSecretUniversalAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(PushSecretUniversalAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SecretPush) DeepCopyInto(out *SecretPush) {
+	*out = *in
+	out.Secret = in.Secret
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretPush.
+func (in *SecretPush) DeepCopy() *SecretPush {
+	if in == nil {
+		return nil
+	}
+	out := new(SecretPush)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretScopeInWorkspace) DeepCopyInto(out *SecretScopeInWorkspace) {
 	*out = *in

k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml

@@ -15,249 +15,263 @@ spec:
     singular: infisicalpushsecret
   scope: Namespaced
   versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: InfisicalPushSecret is the Schema for the infisicalpushsecrets
-          API
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret
-            properties:
-              authentication:
-                properties:
-                  awsIamAuth:
-                    properties:
-                      identityId:
-                        type: string
-                    required:
-                    - identityId
-                    type: object
-                  azureAuth:
-                    properties:
-                      identityId:
-                        type: string
-                      resource:
-                        type: string
-                    required:
-                    - identityId
-                    type: object
-                  gcpIamAuth:
-                    properties:
-                      identityId:
-                        type: string
-                      serviceAccountKeyFilePath:
-                        type: string
-                    required:
-                    - identityId
-                    - serviceAccountKeyFilePath
-                    type: object
-                  gcpIdTokenAuth:
-                    properties:
-                      identityId:
-                        type: string
-                    required:
-                    - identityId
-                    type: object
-                  kubernetesAuth:
-                    properties:
-                      identityId:
-                        type: string
-                      serviceAccountRef:
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - name
-                        - namespace
-                        type: object
-                    required:
-                    - identityId
-                    - serviceAccountRef
-                    type: object
-                  universalAuth:
-                    properties:
-                      credentialsRef:
-                        properties:
-                          secretName:
-                            description: The name of the Kubernetes Secret
-                            type: string
-                          secretNamespace:
-                            description: The name space where the Kubernetes Secret
-                              is located
-                            type: string
-                        required:
-                        - secretName
-                        - secretNamespace
-                        type: object
-                    required:
-                    - credentialsRef
-                    type: object
-                type: object
-              deletionPolicy:
-                type: string
-              destination:
-                properties:
-                  environmentSlug:
-                    type: string
-                  projectId:
-                    type: string
-                  secretsPath:
-                    type: string
-                required:
-                - environmentSlug
-                - projectId
-                - secretsPath
-                type: object
-              hostAPI:
-                description: Infisical host to pull secrets from
-                type: string
-              push:
-                properties:
-                  secret:
-                    properties:
-                      secretName:
-                        description: The name of the Kubernetes Secret
-                        type: string
-                      secretNamespace:
-                        description: The name space where the Kubernetes Secret is
-                          located
-                        type: string
-                    required:
-                    - secretName
-                    - secretNamespace
-                    type: object
-                required:
-                - secret
-                type: object
-              resyncInterval:
-                type: string
-              tls:
-                properties:
-                  caRef:
-                    description: Reference to secret containing CA cert
-                    properties:
-                      key:
-                        description: The name of the secret property with the CA certificate
-                          value
-                        type: string
-                      secretName:
-                        description: The name of the Kubernetes Secret
-                        type: string
-                      secretNamespace:
-                        description: The namespace where the Kubernetes Secret is
-                          located
-                        type: string
-                    required:
-                    - key
-                    - secretName
-                    - secretNamespace
-                    type: object
-                type: object
-              updatePolicy:
-                type: string
-            required:
-            - destination
-            - push
-            - resyncInterval
-            type: object
-          status:
-            description: InfisicalPushSecretStatus defines the observed state of InfisicalPushSecret
-            properties:
-              conditions:
-                items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource. --- This struct is intended for direct
-                    use as an array at the field path .status.conditions.  For example,
-                    \n type FooStatus struct{ // Represents the observations of a
-                    foo's current state. // Known .status.conditions.type are: \"Available\",
-                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
-                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
-                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
-                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description:
+            InfisicalPushSecret is the Schema for the infisicalpushsecrets
+            API
+          properties:
+            apiVersion:
+              description:
+                "APIVersion defines the versioned schema of this representation
+                of an object. Servers should convert recognized schemas to the latest
+                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description:
+                "Kind is a string value representing the REST resource this
+                object represents. Servers may infer this from the endpoint the client
+                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret
+              properties:
+                authentication:
                   properties:
-                    lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another. This should be when
-                        the underlying condition changed.  If that is not known, then
-                        using the time when the API field changed is acceptable.
-                      format: date-time
+                    awsIamAuth:
+                      properties:
+                        identityId:
+                          type: string
+                      required:
+                        - identityId
+                      type: object
+                    azureAuth:
+                      properties:
+                        identityId:
+                          type: string
+                        resource:
+                          type: string
+                      required:
+                        - identityId
+                      type: object
+                    gcpIamAuth:
+                      properties:
+                        identityId:
+                          type: string
+                        serviceAccountKeyFilePath:
+                          type: string
+                      required:
+                        - identityId
+                        - serviceAccountKeyFilePath
+                      type: object
+                    gcpIdTokenAuth:
+                      properties:
+                        identityId:
+                          type: string
+                      required:
+                        - identityId
+                      type: object
+                    kubernetesAuth:
+                      properties:
+                        identityId:
+                          type: string
+                        serviceAccountRef:
+                          properties:
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                          required:
+                            - name
+                            - namespace
+                          type: object
+                      required:
+                        - identityId
+                        - serviceAccountRef
+                      type: object
+                    universalAuth:
+                      properties:
+                        credentialsRef:
+                          properties:
+                            secretName:
+                              description: The name of the Kubernetes Secret
+                              type: string
+                            secretNamespace:
+                              description:
+                                The name space where the Kubernetes Secret
+                                is located
+                              type: string
+                          required:
+                            - secretName
+                            - secretNamespace
+                          type: object
+                      required:
+                        - credentialsRef
+                      type: object
+                  type: object
+                deletionPolicy:
+                  type: string
+                destination:
+                  properties:
+                    environmentSlug:
                       type: string
-                    message:
-                      description: message is a human readable message indicating
-                        details about the transition. This may be an empty string.
-                      maxLength: 32768
+                    projectId:
                       type: string
-                    observedGeneration:
-                      description: observedGeneration represents the .metadata.generation
-                        that the condition was set based upon. For instance, if .metadata.generation
-                        is currently 12, but the .status.conditions[x].observedGeneration
-                        is 9, the condition is out of date with respect to the current
-                        state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: reason contains a programmatic identifier indicating
-                        the reason for the condition's last transition. Producers
-                        of specific condition types may define expected values and
-                        meanings for this field, and whether the values are considered
-                        a guaranteed API. The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        --- Many .condition.type values are consistent across resources
-                        like Available, but because arbitrary conditions can be useful
-                        (see .node.status.conditions), the ability to deconflict is
-                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                    secretsPath:
                       type: string
                   required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
+                    - environmentSlug
+                    - projectId
+                    - secretsPath
                   type: object
-                type: array
-              managedSecrets:
-                additionalProperties:
+                hostAPI:
+                  description: Infisical host to pull secrets from
                   type: string
-                description: managed secrets is a map where the key is the ID, and
-                  the value is the secret key (string[id], string[key] )
-                type: object
-            required:
-            - conditions
-            - managedSecrets
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
+                push:
+                  properties:
+                    secret:
+                      properties:
+                        secretName:
+                          description: The name of the Kubernetes Secret
+                          type: string
+                        secretNamespace:
+                          description:
+                            The name space where the Kubernetes Secret is
+                            located
+                          type: string
+                      required:
+                        - secretName
+                        - secretNamespace
+                      type: object
+                  required:
+                    - secret
+                  type: object
+                resyncInterval:
+                  type: string
+                tls:
+                  properties:
+                    caRef:
+                      description: Reference to secret containing CA cert
+                      properties:
+                        key:
+                          description:
+                            The name of the secret property with the CA certificate
+                            value
+                          type: string
+                        secretName:
+                          description: The name of the Kubernetes Secret
+                          type: string
+                        secretNamespace:
+                          description:
+                            The namespace where the Kubernetes Secret is
+                            located
+                          type: string
+                      required:
+                        - key
+                        - secretName
+                        - secretNamespace
+                      type: object
+                  type: object
+                updatePolicy:
+                  type: string
+              required:
+                - destination
+                - push
+                - resyncInterval
+              type: object
+            status:
+              description: InfisicalPushSecretStatus defines the observed state of InfisicalPushSecret
+              properties:
+                conditions:
+                  items:
+                    description:
+                      "Condition contains details for one aspect of the current
+                      state of this API Resource. --- This struct is intended for direct
+                      use as an array at the field path .status.conditions.  For example,
+                      \n type FooStatus struct{ // Represents the observations of a
+                      foo's current state. // Known .status.conditions.type are: \"Available\",
+                      \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                      // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                      `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                      protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                    properties:
+                      lastTransitionTime:
+                        description:
+                          lastTransitionTime is the last time the condition
+                          transitioned from one status to another. This should be when
+                          the underlying condition changed.  If that is not known, then
+                          using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description:
+                          message is a human readable message indicating
+                          details about the transition. This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description:
+                          observedGeneration represents the .metadata.generation
+                          that the condition was set based upon. For instance, if .metadata.generation
+                          is currently 12, but the .status.conditions[x].observedGeneration
+                          is 9, the condition is out of date with respect to the current
+                          state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description:
+                          reason contains a programmatic identifier indicating
+                          the reason for the condition's last transition. Producers
+                          of specific condition types may define expected values and
+                          meanings for this field, and whether the values are considered
+                          a guaranteed API. The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description:
+                          type of condition in CamelCase or in foo.example.com/CamelCase.
+                          --- Many .condition.type values are consistent across resources
+                          like Available, but because arbitrary conditions can be useful
+                          (see .node.status.conditions), the ability to deconflict is
+                          important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  type: array
+                managedSecrets:
+                  additionalProperties:
+                    type: string
+                  description:
+                    managed secrets is a map where the key is the ID, and
+                    the value is the secret key (string[id], string[key] )
+                  type: object
+              required:
+                - conditions
+                - managedSecrets
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

k8-operator/controllers/infisicalpushsecret/conditions.go

@@ -2,13 +2,14 @@ package controllers
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func (r *InfisicalPushSecretReconciler) SetSuccessfullyReconciledConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, err error) error {
+func (r *InfisicalPushSecretReconciler) SetReconcileStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, err error) error {
 
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
@@ -16,14 +17,14 @@ func (r *InfisicalPushSecretReconciler) SetSuccessfullyReconciledConditions(ctx
 
 	if err != nil {
 		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
-			Type:    "secrets.infisical.com/SuccessfullyReconciled",
+			Type:    "secrets.infisical.com/Reconcile",
 			Status:  metav1.ConditionTrue,
 			Reason:  "Error",
-			Message: "Reconcile failed, secrets were not pushed to Infisical. Check operator logs for more info",
+			Message: fmt.Sprintf("Reconcile failed, secrets were not pushed to Infisical. Error: %s", err.Error()),
 		})
 	} else {
 		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
-			Type:    "secrets.infisical.com/SuccessfullyReconciled",
+			Type:    "secrets.infisical.com/Reconcile",
 			Status:  metav1.ConditionFalse,
 			Reason:  "OK",
 			Message: "Reconcile succeeded, secrets were pushed to Infisical",
@@ -34,7 +35,7 @@ func (r *InfisicalPushSecretReconciler) SetSuccessfullyReconciledConditions(ctx
 
 }
 
-func (r *InfisicalPushSecretReconciler) SetFailedToReplaceSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+func (r *InfisicalPushSecretReconciler) SetFailedToReplaceSecretsStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -58,7 +59,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToReplaceSecretsConditions(ctx
 	return r.Client.Status().Update(ctx, infisicalPushSecret)
 }
 
-func (r *InfisicalPushSecretReconciler) SetFailedToCreateSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+func (r *InfisicalPushSecretReconciler) SetFailedToCreateSecretsStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -82,7 +83,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToCreateSecretsConditions(ctx c
 	return r.Client.Status().Update(ctx, infisicalPushSecret)
 }
 
-func (r *InfisicalPushSecretReconciler) SetFailedToUpdateSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+func (r *InfisicalPushSecretReconciler) SetFailedToUpdateSecretsStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -106,7 +107,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToUpdateSecretsConditions(ctx c
 	return r.Client.Status().Update(ctx, infisicalPushSecret)
 }
 
-func (r *InfisicalPushSecretReconciler) SetFailedToDeleteSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+func (r *InfisicalPushSecretReconciler) SetFailedToDeleteSecretsStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -130,7 +131,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToDeleteSecretsConditions(ctx c
 	return r.Client.Status().Update(ctx, infisicalPushSecret)
 }
 
-func (r *InfisicalPushSecretReconciler) SetAuthenticatedConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, errorToConditionOn error) error {
+func (r *InfisicalPushSecretReconciler) SetAuthenticatedStatusCondition(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, errorToConditionOn error) error {
 	if infisicalPushSecret.Status.Conditions == nil {
 		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
 	}

k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go

@@ -159,7 +159,7 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
 	}
 
 	err = r.ReconcileInfisicalPushSecret(ctx, logger, infisicalPushSecretCRD)
-	r.SetSuccessfullyReconciledConditions(ctx, &infisicalPushSecretCRD, err)
+	r.SetReconcileStatusCondition(ctx, &infisicalPushSecretCRD, err)
 
 	if err != nil {
 		logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Push Secret. Will requeue after [requeueTime=%v]", requeueTime))

k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_helper.go

@@ -112,7 +112,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
 	if authDetails.AuthStrategy == "" {
 		logger.Info("No authentication strategy found. Attempting to authenticate")
 		authDetails, err = r.handleAuthentication(ctx, infisicalPushSecret, infisicalClient)
-		r.SetAuthenticatedConditions(ctx, &infisicalPushSecret, err)
+		r.SetAuthenticatedStatusCondition(ctx, &infisicalPushSecret, err)
 
 		if err != nil {
 			return fmt.Errorf("unable to authenticate [err=%s]", err)
@@ -401,28 +401,28 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
 	} else {
 		errorMessage = ""
 	}
-	r.SetFailedToCreateSecretsConditions(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to create secrets: [%s]", errorMessage))
+	r.SetFailedToCreateSecretsStatusCondition(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to create secrets: [%s]", errorMessage))
 
 	if len(secretsFailedToUpdate) > 0 {
 		errorMessage = fmt.Sprintf("Failed to update secrets: [%s]", strings.Join(secretsFailedToUpdate, ", "))
 	} else {
 		errorMessage = ""
 	}
-	r.SetFailedToUpdateSecretsConditions(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to update secrets: [%s]", errorMessage))
+	r.SetFailedToUpdateSecretsStatusCondition(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to update secrets: [%s]", errorMessage))
 
 	if len(secretsFailedToDelete) > 0 {
 		errorMessage = fmt.Sprintf("Failed to delete secrets: [%s]", strings.Join(secretsFailedToDelete, ", "))
 	} else {
 		errorMessage = ""
 	}
-	r.SetFailedToDeleteSecretsConditions(ctx, &infisicalPushSecret, errorMessage)
+	r.SetFailedToDeleteSecretsStatusCondition(ctx, &infisicalPushSecret, errorMessage)
 
 	if len(secretsFailedToReplaceById) > 0 {
 		errorMessage = fmt.Sprintf("Failed to replace secrets: [%s]", strings.Join(secretsFailedToReplaceById, ", "))
 	} else {
 		errorMessage = ""
 	}
-	r.SetFailedToReplaceSecretsConditions(ctx, &infisicalPushSecret, errorMessage)
+	r.SetFailedToReplaceSecretsStatusCondition(ctx, &infisicalPushSecret, errorMessage)
 
 	// Update the status of the InfisicalPushSecret
 	if err := r.Client.Status().Update(ctx, &infisicalPushSecret); err != nil {

k8-operator/controllers/infisicalsecret/auto_redeployment.go

@@ -0,0 +1,108 @@
+package controllers
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
+	"github.com/go-logr/logr"
+	v1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+const DEPLOYMENT_SECRET_NAME_ANNOTATION_PREFIX = "secrets.infisical.com/managed-secret"
+const AUTO_RELOAD_DEPLOYMENT_ANNOTATION = "secrets.infisical.com/auto-reload" // needs to be set to true for a deployment to start auto redeploying
+
+func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx context.Context, logger logr.Logger, infisicalSecret v1alpha1.InfisicalSecret) (int, error) {
+	listOfDeployments := &v1.DeploymentList{}
+	err := r.Client.List(ctx, listOfDeployments, &client.ListOptions{Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace})
+	if err != nil {
+		return 0, fmt.Errorf("unable to get deployments in the [namespace=%v] [err=%v]", infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, err)
+	}
+
+	managedKubeSecretNameAndNamespace := types.NamespacedName{
+		Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
+		Name:      infisicalSecret.Spec.ManagedSecretReference.SecretName,
+	}
+
+	managedKubeSecret := &corev1.Secret{}
+	err = r.Client.Get(ctx, managedKubeSecretNameAndNamespace, managedKubeSecret)
+	if err != nil {
+		return 0, fmt.Errorf("unable to fetch Kubernetes secret to update deployment: %v", err)
+	}
+
+	var wg sync.WaitGroup
+	// Iterate over the deployments and check if they use the managed secret
+	for _, deployment := range listOfDeployments.Items {
+		deployment := deployment
+		if deployment.Annotations[AUTO_RELOAD_DEPLOYMENT_ANNOTATION] == "true" && r.IsDeploymentUsingManagedSecret(deployment, infisicalSecret) {
+			// Start a goroutine to reconcile the deployment
+			wg.Add(1)
+			go func(d v1.Deployment, s corev1.Secret) {
+				defer wg.Done()
+				if err := r.ReconcileDeployment(ctx, logger, d, s); err != nil {
+					logger.Error(err, fmt.Sprintf("unable to reconcile deployment with [name=%v]. Will try next requeue", deployment.ObjectMeta.Name))
+				}
+			}(deployment, *managedKubeSecret)
+		}
+	}
+
+	wg.Wait()
+
+	return 0, nil
+}
+
+// Check if the deployment uses managed secrets
+func (r *InfisicalSecretReconciler) IsDeploymentUsingManagedSecret(deployment v1.Deployment, infisicalSecret v1alpha1.InfisicalSecret) bool {
+	managedSecretName := infisicalSecret.Spec.ManagedSecretReference.SecretName
+	for _, container := range deployment.Spec.Template.Spec.Containers {
+		for _, envFrom := range container.EnvFrom {
+			if envFrom.SecretRef != nil && envFrom.SecretRef.LocalObjectReference.Name == managedSecretName {
+				return true
+			}
+		}
+		for _, env := range container.Env {
+			if env.ValueFrom != nil && env.ValueFrom.SecretKeyRef != nil && env.ValueFrom.SecretKeyRef.LocalObjectReference.Name == managedSecretName {
+				return true
+			}
+		}
+	}
+	for _, volume := range deployment.Spec.Template.Spec.Volumes {
+		if volume.Secret != nil && volume.Secret.SecretName == managedSecretName {
+			return true
+		}
+	}
+
+	return false
+}
+
+// This function ensures that a deployment is in sync with a Kubernetes secret by comparing their versions.
+// If the version of the secret is different from the version annotation on the deployment, the annotation is updated to trigger a restart of the deployment.
+func (r *InfisicalSecretReconciler) ReconcileDeployment(ctx context.Context, logger logr.Logger, deployment v1.Deployment, secret corev1.Secret) error {
+	annotationKey := fmt.Sprintf("%s.%s", DEPLOYMENT_SECRET_NAME_ANNOTATION_PREFIX, secret.Name)
+	annotationValue := secret.Annotations[constants.SECRET_VERSION_ANNOTATION]
+
+	if deployment.Annotations[annotationKey] == annotationValue &&
+		deployment.Spec.Template.Annotations[annotationKey] == annotationValue {
+		logger.Info(fmt.Sprintf("The [deploymentName=%v] is already using the most up to date managed secrets. No action required.", deployment.ObjectMeta.Name))
+		return nil
+	}
+
+	logger.Info(fmt.Sprintf("Deployment is using outdated managed secret. Starting re-deployment [deploymentName=%v]", deployment.ObjectMeta.Name))
+
+	if deployment.Spec.Template.Annotations == nil {
+		deployment.Spec.Template.Annotations = make(map[string]string)
+	}
+
+	deployment.Annotations[annotationKey] = annotationValue
+	deployment.Spec.Template.Annotations[annotationKey] = annotationValue
+
+	if err := r.Client.Update(ctx, &deployment); err != nil {
+		return fmt.Errorf("failed to update deployment annotation: %v", err)
+	}
+	return nil
+}

k8-operator/main.go

@@ -41,8 +41,10 @@ func main() {
 	var metricsAddr string
 	var enableLeaderElection bool
 	var probeAddr string
+	var namespace string
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
+	flag.StringVar(&namespace, "namespace", "", "Watch InfisicalSecrets scoped in the provided namespace only")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
@@ -54,7 +56,7 @@ func main() {
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+	ctrlOpts := ctrl.Options{
 		Scheme:                 scheme,
 		MetricsBindAddress:     metricsAddr,
 		Port:                   9443,
@@ -72,7 +74,13 @@ func main() {
 		// if you are doing or is intended to do any operation such as perform cleanups
 		// after the manager stops then its usage might be unsafe.
 		// LeaderElectionReleaseOnCancel: true,
-	})
+	}
+
+	if namespace != "" {
+		ctrlOpts.Namespace = namespace
+	}
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrlOpts)
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)

k8-operator/packages/controllerutil/util.go

@@ -0,0 +1,45 @@
+package controllerhelpers
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
+	corev1 "k8s.io/api/core/v1"
+	k8Errors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func GetInfisicalConfigMap(ctx context.Context, client client.Client) (configMap map[string]string, errToReturn error) {
+	// default key values
+	defaultConfigMapData := make(map[string]string)
+	defaultConfigMapData["hostAPI"] = constants.INFISICAL_DOMAIN
+
+	kubeConfigMap := &corev1.ConfigMap{}
+	err := client.Get(ctx, types.NamespacedName{
+		Namespace: constants.OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE,
+		Name:      constants.OPERATOR_SETTINGS_CONFIGMAP_NAME,
+	}, kubeConfigMap)
+
+	if err != nil {
+		if k8Errors.IsNotFound(err) {
+			kubeConfigMap = nil
+		} else {
+			return nil, fmt.Errorf("GetConfigMapByNamespacedName: unable to fetch config map in [namespacedName=%s] [err=%s]", constants.OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE, err)
+		}
+	}
+
+	if kubeConfigMap == nil {
+		return defaultConfigMapData, nil
+	} else {
+		for key, value := range defaultConfigMapData {
+			_, exists := kubeConfigMap.Data[key]
+			if !exists {
+				kubeConfigMap.Data[key] = value
+			}
+		}
+
+		return kubeConfigMap.Data, nil
+	}
+}

k8-operator/packages/util/time.go

@@ -0,0 +1,40 @@
+package util
+
+import (
+	"fmt"
+	"strconv"
+	"time"
+)
+
+func ConvertResyncIntervalToDuration(resyncInterval string) (time.Duration, error) {
+	length := len(resyncInterval)
+	if length < 2 {
+		return 0, fmt.Errorf("invalid format")
+	}
+
+	unit := resyncInterval[length-1:]
+	numberPart := resyncInterval[:length-1]
+
+	number, err := strconv.Atoi(numberPart)
+	if err != nil {
+		return 0, err
+	}
+
+	switch unit {
+	case "s":
+		if number < 5 {
+			return 0, fmt.Errorf("resync interval must be at least 5 seconds")
+		}
+		return time.Duration(number) * time.Second, nil
+	case "m":
+		return time.Duration(number) * time.Minute, nil
+	case "h":
+		return time.Duration(number) * time.Hour, nil
+	case "d":
+		return time.Duration(number) * 24 * time.Hour, nil
+	case "w":
+		return time.Duration(number) * 7 * 24 * time.Hour, nil
+	default:
+		return 0, fmt.Errorf("invalid time unit")
+	}
+}