Skip to content

Commit 6593d85

Browse files
ecordellecordell
authored
Merge pull request #403 from authzed/secrets
Add explicit secret reference support
2 parents 09fd666 + b9e8cc6 commit 6593d85

20 files changed

+2196
-191
lines changed

‎config/crds/authzed.com_spicedbclusters.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,72 @@ spec:
9191
description: Config values to be passed to the cluster
9292
type: object
9393
x-kubernetes-preserve-unknown-fields: true
94+
credentials:
95+
description: |-
96+
Credentials configures per-field secret references for sensitive config.
97+
Mutually exclusive with SecretRef.
98+
properties:
99+
datastoreURI:
100+
description: DatastoreURI configures the source for the datastore
101+
connection string.
102+
properties:
103+
key:
104+
description: |-
105+
Key is the key within the Secret. Defaults to the standard SpiceDB key
106+
name for this credential (datastore_uri or preshared_key) if omitted.
107+
type: string
108+
secretName:
109+
description: SecretName is the name of the Kubernetes Secret
110+
in the same namespace.
111+
type: string
112+
skip:
113+
description: |-
114+
Skip instructs the operator not to validate or inject this credential.
115+
Use when the credential is provided externally (CSI driver, workload
116+
identity, sidecar proxy). When true, SecretName and Key are ignored.
117+
type: boolean
118+
type: object
119+
migrationSecrets:
120+
description: MigrationSecrets configures the source for the migration
121+
secrets.
122+
properties:
123+
key:
124+
description: |-
125+
Key is the key within the Secret. Defaults to the standard SpiceDB key
126+
name for this credential (datastore_uri or preshared_key) if omitted.
127+
type: string
128+
secretName:
129+
description: SecretName is the name of the Kubernetes Secret
130+
in the same namespace.
131+
type: string
132+
skip:
133+
description: |-
134+
Skip instructs the operator not to validate or inject this credential.
135+
Use when the credential is provided externally (CSI driver, workload
136+
identity, sidecar proxy). When true, SecretName and Key are ignored.
137+
type: boolean
138+
type: object
139+
presharedKey:
140+
description: PresharedKey configures the source for the gRPC preshared
141+
key.
142+
properties:
143+
key:
144+
description: |-
145+
Key is the key within the Secret. Defaults to the standard SpiceDB key
146+
name for this credential (datastore_uri or preshared_key) if omitted.
147+
type: string
148+
secretName:
149+
description: SecretName is the name of the Kubernetes Secret
150+
in the same namespace.
151+
type: string
152+
skip:
153+
description: |-
154+
Skip instructs the operator not to validate or inject this credential.
155+
Use when the credential is provided externally (CSI driver, workload
156+
identity, sidecar proxy). When true, SecretName and Key are ignored.
157+
type: boolean
158+
type: object
159+
type: object
94160
patches:
95161
description: |-
96162
Patches is a list of patches to apply to generated resources.

‎e2e/cluster_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ var _ = Describe("SpiceDBClusters", func() {
167167
logr.FromContextOrDiscard(ctx).Info("watch event", "status", c.Status)
168168
return condition == nil
169169
})
170-
Expect(condition).To(EqualCondition(v1alpha1.NewInvalidConfigCondition("", fmt.Errorf("[datastoreEngine is a required field, couldn't find channel for datastore \"\": no channel found for datastore \"\", no update found in channel, secret must be provided]"))))
170+
Expect(condition).To(EqualCondition(v1alpha1.NewInvalidConfigCondition("", fmt.Errorf("[datastoreEngine is a required field, couldn't find channel for datastore \"\": no channel found for datastore \"\", no update found in channel, credentials or secretName must be provided]"))))
171171
})
172172
})
173173

‎pkg/apis/authzed/v1alpha1/types.go‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,11 @@ type ClusterSpec struct {
9393
// +optional
9494
SecretRef string `json:"secretName,omitempty"`
9595

96+
// Credentials configures per-field secret references for sensitive config.
97+
// Mutually exclusive with SecretRef.
98+
// +optional
99+
Credentials *ClusterCredentials `json:"credentials,omitempty"`
100+
96101
// Patches is a list of patches to apply to generated resources.
97102
// If multiple patches apply to the same object and field, later patches
98103
// in the list take precedence over earlier ones.
@@ -106,6 +111,40 @@ type ClusterSpec struct {
106111
BaseImage string `json:"baseImage,omitempty"`
107112
}
108113

114+
// ClusterCredentials configures where the operator reads sensitive credentials.
115+
type ClusterCredentials struct {
116+
// DatastoreURI configures the source for the datastore connection string.
117+
// +optional
118+
DatastoreURI *CredentialRef `json:"datastoreURI,omitempty"`
119+
120+
// PresharedKey configures the source for the gRPC preshared key.
121+
// +optional
122+
PresharedKey *CredentialRef `json:"presharedKey,omitempty"`
123+
124+
// MigrationSecrets configures the source for the migration secrets.
125+
// +optional
126+
MigrationSecrets *CredentialRef `json:"migrationSecrets,omitempty"`
127+
}
128+
129+
// CredentialRef describes where to read a single credential value.
130+
// Either SecretName must be set, or Skip must be true.
131+
type CredentialRef struct {
132+
// SecretName is the name of the Kubernetes Secret in the same namespace.
133+
// +optional
134+
SecretName string `json:"secretName,omitempty"`
135+
136+
// Key is the key within the Secret. Defaults to the standard SpiceDB key
137+
// name for this credential (datastore_uri or preshared_key) if omitted.
138+
// +optional
139+
Key string `json:"key,omitempty"`
140+
141+
// Skip instructs the operator not to validate or inject this credential.
142+
// Use when the credential is provided externally (CSI driver, workload
143+
// identity, sidecar proxy). When true, SecretName and Key are ignored.
144+
// +optional
145+
Skip bool `json:"skip,omitempty"`
146+
}
147+
109148
// Patch represents a single change to apply to generated manifests
110149
type Patch struct {
111150
// Kind targets an object by its kubernetes Kind name.

‎pkg/apis/authzed/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 50 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)