Skip to content

Commit c6042a3

Browse files
bsgrigorovbsgrigorov
committed
feat: add external secrets to platform-extensions
1 parent 4104107 commit c6042a3

3 files changed

Lines changed: 158 additions & 17 deletions

File tree

‎charts/platform-extensions/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: platform-extensions
33
description: Cluster-scoped Kubernetes resources for platform teams (requires cluster-admin)
44
type: application
5-
version: 1.2.1
5+
version: 1.3.0
66
appVersion: "1.0.0"
77
kubeVersion: ">=1.22.0-0"
88
home: https://github.com/synkube/

‎charts/platform-extensions/templates/secrets/external-secrets.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{{- range $name, $externalSecret := .Values.externalSecrets }}
2+
{{- if include "common.hasApi" (list "external-secrets.io/v1/ExternalSecret" $) }}
3+
---
4+
apiVersion: external-secrets.io/v1
5+
kind: ExternalSecret
6+
metadata:
7+
name: {{ $name }}
8+
{{- with $externalSecret.namespace }}
9+
namespace: {{ . }}
10+
{{- end }}
11+
labels:
12+
{{- include "platform-extensions.labels" $ | nindent 4 }}
13+
{{- with $externalSecret.annotations }}
14+
annotations:
15+
{{- toYaml . | nindent 4 }}
16+
{{- end }}
17+
spec:
18+
refreshInterval: {{ $externalSecret.refreshInterval | default "1h" }}
19+
secretStoreRef:
20+
name: {{ $externalSecret.secretStoreRef.name }}
21+
kind: {{ $externalSecret.secretStoreRef.kind | default "ClusterSecretStore" }}
22+
target:
23+
name: {{ $externalSecret.target.name | default $name }}
24+
creationPolicy: {{ $externalSecret.target.creationPolicy | default "Owner" }}
25+
{{- with $externalSecret.target.deletionPolicy }}
26+
deletionPolicy: {{ . }}
27+
{{- end }}
28+
{{- if $externalSecret.target.template }}
29+
template:
30+
{{- toYaml $externalSecret.target.template | nindent 6 }}
31+
{{- end }}
32+
{{- if $externalSecret.data }}
33+
data:
34+
{{- range $externalSecret.data }}
35+
- secretKey: {{ .secretKey }}
36+
remoteRef:
37+
key: {{ .remoteRef.key }}
38+
{{- if .remoteRef.property }}
39+
property: {{ .remoteRef.property }}
40+
{{- end }}
41+
{{- if .remoteRef.version }}
42+
version: {{ .remoteRef.version }}
43+
{{- end }}
44+
{{- if .remoteRef.conversionStrategy }}
45+
conversionStrategy: {{ .remoteRef.conversionStrategy }}
46+
{{- end }}
47+
{{- if .remoteRef.decodingStrategy }}
48+
decodingStrategy: {{ .remoteRef.decodingStrategy }}
49+
{{- end }}
50+
{{- end }}
51+
{{- end }}
52+
{{- if $externalSecret.dataFrom }}
53+
dataFrom:
54+
{{- range $externalSecret.dataFrom }}
55+
- extract:
56+
key: {{ .extract.key }}
57+
{{- if .extract.property }}
58+
property: {{ .extract.property }}
59+
{{- end }}
60+
{{- if .extract.version }}
61+
version: {{ .extract.version }}
62+
{{- end }}
63+
{{- if .extract.conversionStrategy }}
64+
conversionStrategy: {{ .extract.conversionStrategy }}
65+
{{- end }}
66+
{{- if .extract.decodingStrategy }}
67+
decodingStrategy: {{ .extract.decodingStrategy }}
68+
{{- end }}
69+
{{- if .rewrite }}
70+
rewrite:
71+
{{- range .rewrite }}
72+
- regexp:
73+
source: {{ .regexp.source }}
74+
target: {{ .regexp.target }}
75+
{{- end }}
76+
{{- end }}
77+
{{- end }}
78+
{{- end }}
79+
{{- end }}
80+
{{- end }}

‎charts/platform-extensions/values.yaml‎

Lines changed: 77 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,85 @@ clusterSecretStores: {}
1313
# infisical:
1414
# auth:
1515
# universalAuthCredentials:
16-
# secretsPath: "/k8s/platform"
1716
# clientId:
18-
# secretRef:
19-
# secretName: infisical-auth
20-
# key: clientId
17+
# key: clientId
18+
# namespace: argocd
19+
# name: infisical-auth
2120
# clientSecret:
22-
# secretRef:
23-
# secretName: infisical-auth
24-
# key: clientSecret
25-
# hostAPI: "https://app.infisical.com/api"
26-
# conditions:
27-
# - namespaceSelector:
28-
# matchLabels:
29-
# platform-secrets: "enabled"
21+
# key: clientSecret
22+
# namespace: argocd
23+
# name: infisical-auth
24+
# hostAPI: "https://app.infisical.com"
25+
# secretsScope:
26+
# projectSlug: "my-project"
27+
# environmentSlug: "prod"
28+
# secretsPath: "/k8s/platform"
29+
# recursive: true
30+
31+
# External Secrets - Platform-wide secrets synced from external providers
32+
# These create secrets in specific namespaces for platform services
33+
externalSecrets: {}
34+
# oauth2-proxy-credentials:
35+
# namespace: network
36+
# refreshInterval: "5m"
37+
# secretStoreRef:
38+
# name: infisical-platform
39+
# kind: ClusterSecretStore
40+
# target:
41+
# name: oauth2-proxy-credentials
42+
# creationPolicy: Owner
43+
# data:
44+
# - secretKey: client-id
45+
# remoteRef:
46+
# key: /k8s/platform/oauth2_proxy_github_client_id
47+
# - secretKey: client-secret
48+
# remoteRef:
49+
# key: /k8s/platform/oauth2_proxy_github_client_secret
50+
# - secretKey: cookie-secret
51+
# remoteRef:
52+
# key: /k8s/platform/oauth2_proxy_cookie_secret
53+
#
54+
# cloudflare-cert-manager:
55+
# namespace: cert-manager
56+
# refreshInterval: "5m"
57+
# secretStoreRef:
58+
# name: infisical-platform
59+
# kind: ClusterSecretStore
60+
# target:
61+
# name: cloudflare
62+
# creationPolicy: Owner
63+
# data:
64+
# - secretKey: api-token
65+
# remoteRef:
66+
# key: /k8s/platform/cloudflare_api_token
67+
#
68+
# cloudflare-network:
69+
# namespace: network
70+
# refreshInterval: "5m"
71+
# secretStoreRef:
72+
# name: infisical-platform
73+
# kind: ClusterSecretStore
74+
# target:
75+
# name: cloudflare
76+
# creationPolicy: Owner
77+
# data:
78+
# - secretKey: api-token
79+
# remoteRef:
80+
# key: /k8s/platform/cloudflare_api_token
81+
#
82+
# api-basic-auth:
83+
# namespace: network
84+
# refreshInterval: "5m"
85+
# secretStoreRef:
86+
# name: infisical-platform
87+
# kind: ClusterSecretStore
88+
# target:
89+
# name: api-basic-auth
90+
# creationPolicy: Owner
91+
# data:
92+
# - secretKey: users
93+
# remoteRef:
94+
# key: /k8s/platform/api_basic_auth_users
3095

3196
# Cluster Roles - Cluster-wide permissions
3297
clusterRoles: {}
@@ -38,10 +103,6 @@ clusterRoles: {}
38103
# - apiGroups: ["external-secrets.io"]
39104
# resources: ["externalsecrets", "secretstores"]
40105
# verbs: ["*"]
41-
# aggregationRule:
42-
# clusterRoleSelectors:
43-
# - matchLabels:
44-
# rbac.platform/aggregate-to-operator: "true"
45106

46107
# Cluster Role Bindings - Cluster-wide permission assignments
47108
clusterRoleBindings: {}

0 commit comments

Comments
 (0)