Merge pull request #20 from claudiol/golang-external-secrets-chart

Initial commit for golang external secrets chart

Author: claudiol

charts/golang-external-secrets/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+description: A Helm chart to configure the golang-based external-secrets
+keywords:
+- pattern
+name: golang-external-secrets
+version: 0.0.1
+dependencies:
+  - name: external-secrets
+    version: "0.8.2"
+    repository: "https://charts.external-secrets.io"
+    # "https://external-secrets.github.io/kubernetes-external-secrets"
+maintainers:
+  - name: michele
+    email: [email protected]
+  - name: claudiol
+    email: [email protected]

charts/golang-external-secrets/README.md

@@ -0,0 +1,14 @@
+# Subchart Update
+
+When updating this sub-chart, please remember to tweak the image tag in values.yaml.
+That is because we want to use -ubi images if possible and there is no suffix option, so
+we just override the tag with the version + "-ubi"
+
+## Steps
+
+1. Edit the version in Chart.yaml
+2. Run `helm dependency update .`
+3. Run `./update-helm-dependency.sh`
+4. Tweak `values.yaml` with the new image versions
+5. Run `make test`
+6. Commit to git

charts/golang-external-secrets/charts/external-secrets-0.8.2.tgz

@@ -0,0 +1,30 @@
+diff --color -urN external-secrets.orig/values.yaml external-secrets/values.yaml
+--- external-secrets.orig/values.yaml	2023-05-22 12:42:54.000000000 +0200
++++ external-secrets/values.yaml	2023-05-22 16:20:02.748621794 +0200
+@@ -117,7 +117,7 @@
+       - ALL
+   readOnlyRootFilesystem: true
+   runAsNonRoot: true
+-  runAsUser: 1000
++  # runAsUser: 1000
+   seccompProfile:
+     type: RuntimeDefault
+ 
+@@ -331,7 +331,7 @@
+         - ALL
+     readOnlyRootFilesystem: true
+     runAsNonRoot: true
+-    runAsUser: 1000
++    # runAsUser: 1000
+     seccompProfile:
+       type: RuntimeDefault
+ 
+@@ -453,7 +453,7 @@
+         - ALL
+     readOnlyRootFilesystem: true
+     runAsNonRoot: true
+-    runAsUser: 1000
++    # runAsUser: 1000
+     seccompProfile:
+       type: RuntimeDefault
+ 

charts/golang-external-secrets/local-patches/0001-runasuser-comment-out.patch

@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: golang-external-secrets
+  namespace: golang-external-secrets
+  annotations:
+    kubernetes.io/service-account.name: golang-external-secrets
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: role-tokenreview-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: golang-external-secrets
+  namespace: golang-external-secrets

charts/golang-external-secrets/templates/golang-external-secrets-hub-clusterrolebinding.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault-backend
+  namespace: golang-external-secrets
+spec:
+  provider:
+    vault:
+      server: https://vault-vault.{{ .Values.global.hubClusterDomain }}
+      path: secret
+      # Version of KV backend
+      version: v2
+{{ if .Values.clusterGroup.isHubCluster }}
+      caProvider:
+        type: ConfigMap
+        name: kube-root-ca.crt
+        key: ca.crt
+        namespace: golang-external-secrets
+{{ else }}
+      caProvider:
+        type: Secret
+        name: hub-ca
+        key: hub-kube-root-ca.crt
+        namespace: imperative
+{{ end }}
+      auth:
+        kubernetes:
+{{ if .Values.clusterGroup.isHubCluster }}
+          mountPath: {{ .Values.mountPath }}
+          role: {{ .Values.mountRole }}
+{{ else }}
+          mountPath: {{ $.Values.global.clusterDomain }}
+          role: {{ $.Values.global.clusterDomain }}-role
+{{ end }}
+          secretRef:
+            name: golang-external-secrets
+            namespace: golang-external-secrets
+            key: "token"

charts/golang-external-secrets/templates/golang-external-secrets-hub-secretstore.yaml

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -eu
+
+# Get the version of the dependency and then unquote it
+TMPVER=$(sed -e '1,/^version:/ d' "Chart.yaml" | grep "version:" | awk '{ print $2 }')
+VERSION=$(eval echo "${TMPVER}")
+
+# Chart format is external-secrets-0.8.0.tgz
+NAME="external-secrets"
+TAR="${NAME}-${VERSION}.tgz"
+CHARTDIR="charts"
+
+if [ ! -f "${CHARTDIR}/${TAR}" ]; then
+	echo "Charts $TAR not found"
+	exit 1
+fi
+
+pushd "${CHARTDIR}"
+rm -rf "${NAME}"
+tar xfz "${TAR}"
+pushd "${NAME}"
+for i in ../../local-patches/*.patch; do
+	filterdiff "${i}" -p1 -x 'test/*' | patch -p1
+done
+find . -type f -iname '*.orig' -exec rm -f "{}" \;
+popd
+tar cvfz "${TAR}" "${NAME}"
+rm -rf "${NAME}"
+popd

charts/golang-external-secrets/update-helm-dependency.sh

@@ -0,0 +1,20 @@
+---
+mountPath: "hub"
+mountRole: "hub-role"
+
+global:
+  hubClusterDomain: hub.example.com
+  clusterDomain: foo.example.com
+
+clusterGroup:
+  isHubCluster: true
+
+external-secrets:
+  image:
+    tag: v0.8.2-ubi
+  webhook:
+    image:
+      tag: v0.8.2-ubi
+  certController:
+    image:
+      tag: v0.8.2-ubi