Skip to content

Commit 65edba4

Browse files
syedhaseebahmedsyedhaseebahmed
committed
review comments implementation
1 parent c033814 commit 65edba4

File tree

8 files changed

+266
-24
lines changed

8 files changed

+266
-24
lines changed

‎components/secretstore-gen-secrets/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
2-
name: site-secrets
3-
description: Orchestrating secrets across kubernetes clusters (global-site) using External SecretStore
2+
name: secretstore-gen-secrets
3+
description: Secret store backed External Secrets generator
44
type: application
55
version: 0.1.0
66
appVersion: "1.0"

‎components/secretstore-gen-secrets/templates/secrets.yaml.tmpl‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
1-
{{- $site := .Values.site }}
2-
{{- $secretStore := $site.secretStore }}
3-
{{- range $site.secrets }}
1+
{{- $secretStore := .Values.secretStore }}
2+
{{- range .Values.secrets }}
43
---
54
apiVersion: external-secrets.io/v1
65
kind: ExternalSecret

‎components/secretstore-gen-secrets/values.yaml‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1 @@
1-
site:
2-
name: uc-iad3-dev
3-
partition: uc-dev
4-
env: dev
5-
role: aio
6-
secretStore:
7-
kind: SecretStore
8-
name: vault
1+
---

‎docs/schema/component-secretstore-gen-secrets.schema.json‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"title": "Secret store backed External Secrets generator Helm Chart Values",
4+
"description": "Schema for Secret store backed secrets generator Helm chart values.yaml configuration",
5+
"type": "object",
6+
"properties": {
7+
"secretStore": {
8+
"type": "object",
9+
"description": "Secret store backed secrets generator Secret Store configuration",
10+
"properties": {
11+
"kind": {
12+
"type": "string",
13+
"enum": ["ClusterSecretStore", "SecretStore"],
14+
"description": "Type of secret store - ClusterSecretStore or SecretStore for namespaced"
15+
},
16+
"name": {
17+
"type": "string",
18+
"description": "Name of the ClusterSecretStore or SecretStore to use"
19+
}
20+
},
21+
"required": ["kind", "name"],
22+
"additionalProperties": false
23+
},
24+
"secrets": {
25+
"type": "array",
26+
"description": "Array of External Secret configurations",
27+
"items": {
28+
"type": "object",
29+
"properties": {
30+
"name": {
31+
"type": "string",
32+
"description": "Name of the ExternalSecret and target Secret resource"
33+
},
34+
"externalLinkAnnotationTemplate": {
35+
"type": "string",
36+
"description": "Optional template for external link annotations on ExternalSecret resources"
37+
},
38+
"labels": {
39+
"type": "object",
40+
"description": "Labels to apply to both ExternalSecret and target Secret",
41+
"additionalProperties": {
42+
"type": "string"
43+
}
44+
},
45+
"refreshInterval": {
46+
"type": "string",
47+
"pattern": "^[0-9]+(s|m|h|d)$",
48+
"default": "1h",
49+
"description": "How often Secret store backed secrets generator refreshes this secret"
50+
},
51+
"templateType": {
52+
"type": "string",
53+
"default": "Opaque",
54+
"description": "Kubernetes secret type for the target secret",
55+
"enum": ["Opaque", "kubernetes.io/tls", "kubernetes.io/ssh-auth", "kubernetes.io/basic-auth", "kubernetes.io/dockerconfigjson", "kubernetes.io/service-account-token"]
56+
},
57+
"templateData": {
58+
"type": "object",
59+
"description": "Template data for constructing the target secret using Go templating",
60+
"additionalProperties": {
61+
"type": "string"
62+
}
63+
},
64+
"data": {
65+
"type": "array",
66+
"description": "Individual data mappings from remote secrets to target secret keys",
67+
"items": {
68+
"type": "object",
69+
"properties": {
70+
"secretKey": {
71+
"type": "string",
72+
"description": "Key name in the target Kubernetes secret"
73+
},
74+
"remoteRef": {
75+
"type": "object",
76+
"description": "Reference to the remote secret",
77+
"properties": {
78+
"key": {
79+
"type": "string",
80+
"description": "Key/ID of the remote secret"
81+
},
82+
"property": {
83+
"type": "string",
84+
"description": "Property/field within the remote secret"
85+
},
86+
"conversionStrategy": {
87+
"type": "string",
88+
"default": "Default",
89+
"enum": ["Default", "Unicode"],
90+
"description": "Strategy for converting the secret value"
91+
},
92+
"decodingStrategy": {
93+
"type": "string",
94+
"default": "None",
95+
"enum": ["None", "Base64", "Base64URL", "Auto"],
96+
"description": "Strategy for decoding the secret value"
97+
},
98+
"metadataPolicy": {
99+
"type": "string",
100+
"default": "None",
101+
"enum": ["None", "Fetch"],
102+
"description": "Policy for handling secret metadata"
103+
}
104+
},
105+
"required": ["key"],
106+
"additionalProperties": false
107+
}
108+
},
109+
"required": ["secretKey", "remoteRef"],
110+
"additionalProperties": false
111+
}
112+
},
113+
"dataFrom": {
114+
"type": "array",
115+
"description": "Bulk data extraction from remote secrets",
116+
"items": {
117+
"type": "object",
118+
"properties": {
119+
"extract": {
120+
"type": "object",
121+
"description": "Extract configuration for bulk secret retrieval",
122+
"properties": {
123+
"key": {
124+
"type": "string",
125+
"description": "Key/ID of the remote secret to extract from"
126+
},
127+
"property": {
128+
"type": "string",
129+
"description": "Specific property to extract (optional)"
130+
},
131+
"conversionStrategy": {
132+
"type": "string",
133+
"default": "Default",
134+
"enum": ["Default", "Unicode"],
135+
"description": "Strategy for converting the secret values"
136+
},
137+
"decodingStrategy": {
138+
"type": "string",
139+
"default": "None",
140+
"enum": ["None", "Base64", "Base64URL", "Auto"],
141+
"description": "Strategy for decoding the secret values"
142+
},
143+
"metadataPolicy": {
144+
"type": "string",
145+
"default": "None",
146+
"enum": ["None", "Fetch"],
147+
"description": "Policy for handling secret metadata"
148+
}
149+
},
150+
"required": ["key"],
151+
"additionalProperties": false
152+
},
153+
"find": {
154+
"type": "object",
155+
"description": "Find configuration for pattern-based secret discovery",
156+
"properties": {
157+
"path": {
158+
"type": "string",
159+
"description": "Path pattern to search for secrets"
160+
},
161+
"name": {
162+
"type": "object",
163+
"description": "Name pattern configuration",
164+
"properties": {
165+
"regexp": {
166+
"type": "string",
167+
"description": "Regular expression for matching secret names"
168+
}
169+
},
170+
"additionalProperties": false
171+
},
172+
"tags": {
173+
"type": "object",
174+
"description": "Tag filters for finding secrets",
175+
"additionalProperties": {
176+
"type": "string"
177+
}
178+
}
179+
},
180+
"additionalProperties": false
181+
},
182+
"sourceRef": {
183+
"type": "object",
184+
"description": "Reference to a different secret store for this data source",
185+
"properties": {
186+
"storeRef": {
187+
"type": "object",
188+
"properties": {
189+
"name": {
190+
"type": "string",
191+
"description": "Name of the secret store"
192+
},
193+
"kind": {
194+
"type": "string",
195+
"enum": ["ClusterSecretStore", "SecretStore"],
196+
"description": "Kind of secret store"
197+
}
198+
},
199+
"required": ["name", "kind"],
200+
"additionalProperties": false
201+
}
202+
},
203+
"additionalProperties": false
204+
}
205+
},
206+
"anyOf": [
207+
{"required": ["extract"]},
208+
{"required": ["find"]}
209+
],
210+
"additionalProperties": false
211+
}
212+
}
213+
},
214+
"required": ["name"],
215+
"anyOf": [
216+
{"required": ["data"]},
217+
{"required": ["dataFrom"]},
218+
{"required": ["templateData"]}
219+
],
220+
"additionalProperties": false
221+
}
222+
}
223+
},
224+
"required": ["secretStore", "secrets"],
225+
"additionalProperties": false
226+
}

‎workflows/nautobot/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@ resources:
99

1010
# noutobot secret
1111
- serviceaccounts/k8s-secret-events-nautobot.yaml
12+
- serviceaccounts/k8s-job-create.yaml
1213
- eventsources/k8s-secret-nautobot-token.yaml
1314
- sensors/k8s-nautobot-secret.yaml

‎workflows/nautobot/sensors/k8s-nautobot-secret.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
this process ensures the user is created in Nautobot and a corresponding token is provisioned.
1010
spec:
1111
template:
12-
serviceAccountName: k8s-events-secret-nautobot
12+
serviceAccountName: k8s-job-create
1313
dependencies:
1414
- name: nautobot-token-secret
1515
eventSourceName: k8s-secret-nautobot-token
@@ -38,7 +38,7 @@ spec:
3838
spec:
3939
containers:
4040
- name: nautobot-create-token
41-
image: ghcr.io/rackerlabs/understack/ansible:pr-1256
41+
image: ghcr.io/rackerlabs/understack/ansible:latest
4242
imagePullPolicy: Always
4343
command:
4444
- "ansible-runner"

‎workflows/nautobot/serviceaccounts/k8s-job-create.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: k8s-job-create
6+
7+
---
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: Role
10+
metadata:
11+
name: k8s-job
12+
rules:
13+
- apiGroups: ["batch"]
14+
resources: ["jobs"]
15+
verbs: ["create", "get", "list", "watch"]
16+
17+
---
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: RoleBinding
20+
metadata:
21+
name: k8s-job-binding
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: Role
25+
name: k8s-job
26+
subjects:
27+
- kind: ServiceAccount
28+
name: k8s-job-create
29+
namespace: nautobot

‎workflows/nautobot/serviceaccounts/k8s-secret-events-nautobot.yaml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,15 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: k8s-events-secret-nautobot
6-
76
---
87
apiVersion: rbac.authorization.k8s.io/v1
98
kind: Role
109
metadata:
1110
name: secret-reader
1211
rules:
13-
- apiGroups:
14-
- ""
15-
- batch
16-
resources:
17-
- secrets
18-
- jobs
19-
verbs:
20-
- '*'
12+
- apiGroups: [""]
13+
resources: ["secrets"]
14+
verbs: ["list", "watch"]
2115

2216
---
2317
apiVersion: rbac.authorization.k8s.io/v1

0 commit comments

Comments
 (0)