Skip to content
This repository was archived by the owner on Aug 4, 2025. It is now read-only.

Commit a012f48

Browse files
sourav977SubrotoRoyvardhanreddy13
authored
Implementation of Chef External Secrets Provider (external-secrets#3127)
* Adding the details for chef provider secret store. Issue: external-secrets#2905 This commit intends to add the chef provider structure to the existing list of external-secrets providers. It defines the structure of the SecretStore and ClusterSecretStore for chef Provider. The yaml resource will contain 3 important parts to identify and connect to chef server to reconcile secrets. They are: 1. serverurl: This is the URL to the chef server. 2. username: The username to connect to the chef server. 3. auth: The password to connect to the chef server. It is a reference to an already existing kubernetes secret containing the password. This commit also contains the auto generated CRDs using the `make generate` command. Signed-off-by: Subroto Roy <[email protected]> * Implementation for Chef ESO provided Signed-off-by: vardhanreddy13 <[email protected]> * - implemented Chef eso, added required methods - added unit test cases - added sample documentation Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> * Added Documentation for Authentication Signed-off-by: Subroto Roy <[email protected]> * added documentation for Chef eso Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> * Updated chef ESO documentation Signed-off-by: vardhanreddy13 <[email protected]> * updated ValidateStore method signature Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> * made changes in chef provider to satisfy 'make docs' Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> * - updated code as per review comment, make reviewable suggestions Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> * modified chef provider code as per review comment Issue: external-secrets#2905 Signed-off-by: Sourav Patnaik <[email protected]> --------- Signed-off-by: Subroto Roy <[email protected]> Signed-off-by: vardhanreddy13 <[email protected]> Signed-off-by: Sourav Patnaik <[email protected]> Co-authored-by: Subroto Roy <[email protected]> Co-authored-by: vardhanreddy13 <[email protected]>
1 parent e726087 commit a012f48

File tree

16 files changed

+1461
-0
lines changed

16 files changed

+1461
-0
lines changed

‎apis/externalsecrets/v1beta1/secretstore_chef_types.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/*
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
http://www.apache.org/licenses/LICENSE-2.0
6+
Unless required by applicable law or agreed to in writing, software
7+
distributed under the License is distributed on an "AS IS" BASIS,
8+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
See the License for the specific language governing permissions and
10+
limitations under the License.
11+
*/
12+
13+
package v1beta1
14+
15+
import (
16+
esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
17+
)
18+
19+
// ChefAuth contains a secretRef for credentials.
20+
type ChefAuth struct {
21+
SecretRef ChefAuthSecretRef `json:"secretRef"`
22+
}
23+
24+
// ChefAuthSecretRef holds secret references for chef server login credentials.
25+
type ChefAuthSecretRef struct {
26+
// SecretKey is the Signing Key in PEM format, used for authentication.
27+
SecretKey esmeta.SecretKeySelector `json:"privateKeySecretRef"`
28+
}
29+
30+
// ChefProvider configures a store to sync secrets using basic chef server connection credentials.
31+
type ChefProvider struct {
32+
// Auth defines the information necessary to authenticate against chef Server
33+
Auth *ChefAuth `json:"auth"`
34+
// UserName should be the user ID on the chef server
35+
UserName string `json:"username"`
36+
// ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
37+
ServerURL string `json:"serverUrl"`
38+
}

‎apis/externalsecrets/v1beta1/secretstore_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ type SecretStoreProvider struct {
141141
// https://docs.delinea.com/online-help/products/devops-secrets-vault/current
142142
// +optional
143143
Delinea *DelineaProvider `json:"delinea,omitempty"`
144+
145+
// Chef configures this store to sync secrets with chef server
146+
// +optional
147+
Chef *ChefProvider `json:"chef,omitempty"`
144148
}
145149

146150
type CAProviderType string

‎apis/externalsecrets/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 57 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crds/bases/external-secrets.io_clustersecretstores.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2202,6 +2202,56 @@ spec:
22022202
required:
22032203
- vaultUrl
22042204
type: object
2205+
chef:
2206+
description: Chef configures this store to sync secrets with chef
2207+
server
2208+
properties:
2209+
auth:
2210+
description: Auth defines the information necessary to authenticate
2211+
against chef Server
2212+
properties:
2213+
secretRef:
2214+
description: ChefAuthSecretRef holds secret references
2215+
for chef server login credentials.
2216+
properties:
2217+
privateKeySecretRef:
2218+
description: SecretKey is the Signing Key in PEM format,
2219+
used for authentication.
2220+
properties:
2221+
key:
2222+
description: |-
2223+
The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
2224+
defaulted, in others it may be required.
2225+
type: string
2226+
name:
2227+
description: The name of the Secret resource being
2228+
referred to.
2229+
type: string
2230+
namespace:
2231+
description: |-
2232+
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
2233+
to the namespace of the referent.
2234+
type: string
2235+
type: object
2236+
required:
2237+
- privateKeySecretRef
2238+
type: object
2239+
required:
2240+
- secretRef
2241+
type: object
2242+
serverUrl:
2243+
description: ServerURL is the chef server URL used to connect
2244+
to. If using orgs you should include your org in the url
2245+
and terminate the url with a "/"
2246+
type: string
2247+
username:
2248+
description: UserName should be the user ID on the chef server
2249+
type: string
2250+
required:
2251+
- auth
2252+
- serverUrl
2253+
- username
2254+
type: object
22052255
conjur:
22062256
description: Conjur configures this store to sync secrets using
22072257
conjur provider

‎config/crds/bases/external-secrets.io_secretstores.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2202,6 +2202,56 @@ spec:
22022202
required:
22032203
- vaultUrl
22042204
type: object
2205+
chef:
2206+
description: Chef configures this store to sync secrets with chef
2207+
server
2208+
properties:
2209+
auth:
2210+
description: Auth defines the information necessary to authenticate
2211+
against chef Server
2212+
properties:
2213+
secretRef:
2214+
description: ChefAuthSecretRef holds secret references
2215+
for chef server login credentials.
2216+
properties:
2217+
privateKeySecretRef:
2218+
description: SecretKey is the Signing Key in PEM format,
2219+
used for authentication.
2220+
properties:
2221+
key:
2222+
description: |-
2223+
The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
2224+
defaulted, in others it may be required.
2225+
type: string
2226+
name:
2227+
description: The name of the Secret resource being
2228+
referred to.
2229+
type: string
2230+
namespace:
2231+
description: |-
2232+
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
2233+
to the namespace of the referent.
2234+
type: string
2235+
type: object
2236+
required:
2237+
- privateKeySecretRef
2238+
type: object
2239+
required:
2240+
- secretRef
2241+
type: object
2242+
serverUrl:
2243+
description: ServerURL is the chef server URL used to connect
2244+
to. If using orgs you should include your org in the url
2245+
and terminate the url with a "/"
2246+
type: string
2247+
username:
2248+
description: UserName should be the user ID on the chef server
2249+
type: string
2250+
required:
2251+
- auth
2252+
- serverUrl
2253+
- username
2254+
type: object
22052255
conjur:
22062256
description: Conjur configures this store to sync secrets using
22072257
conjur provider

‎deploy/crds/bundle.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2665,6 +2665,49 @@ spec:
26652665
required:
26662666
- vaultUrl
26672667
type: object
2668+
chef:
2669+
description: Chef configures this store to sync secrets with chef server
2670+
properties:
2671+
auth:
2672+
description: Auth defines the information necessary to authenticate against chef Server
2673+
properties:
2674+
secretRef:
2675+
description: ChefAuthSecretRef holds secret references for chef server login credentials.
2676+
properties:
2677+
privateKeySecretRef:
2678+
description: SecretKey is the Signing Key in PEM format, used for authentication.
2679+
properties:
2680+
key:
2681+
description: |-
2682+
The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
2683+
defaulted, in others it may be required.
2684+
type: string
2685+
name:
2686+
description: The name of the Secret resource being referred to.
2687+
type: string
2688+
namespace:
2689+
description: |-
2690+
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
2691+
to the namespace of the referent.
2692+
type: string
2693+
type: object
2694+
required:
2695+
- privateKeySecretRef
2696+
type: object
2697+
required:
2698+
- secretRef
2699+
type: object
2700+
serverUrl:
2701+
description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
2702+
type: string
2703+
username:
2704+
description: UserName should be the user ID on the chef server
2705+
type: string
2706+
required:
2707+
- auth
2708+
- serverUrl
2709+
- username
2710+
type: object
26682711
conjur:
26692712
description: Conjur configures this store to sync secrets using conjur provider
26702713
properties:
@@ -7639,6 +7682,49 @@ spec:
76397682
required:
76407683
- vaultUrl
76417684
type: object
7685+
chef:
7686+
description: Chef configures this store to sync secrets with chef server
7687+
properties:
7688+
auth:
7689+
description: Auth defines the information necessary to authenticate against chef Server
7690+
properties:
7691+
secretRef:
7692+
description: ChefAuthSecretRef holds secret references for chef server login credentials.
7693+
properties:
7694+
privateKeySecretRef:
7695+
description: SecretKey is the Signing Key in PEM format, used for authentication.
7696+
properties:
7697+
key:
7698+
description: |-
7699+
The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
7700+
defaulted, in others it may be required.
7701+
type: string
7702+
name:
7703+
description: The name of the Secret resource being referred to.
7704+
type: string
7705+
namespace:
7706+
description: |-
7707+
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
7708+
to the namespace of the referent.
7709+
type: string
7710+
type: object
7711+
required:
7712+
- privateKeySecretRef
7713+
type: object
7714+
required:
7715+
- secretRef
7716+
type: object
7717+
serverUrl:
7718+
description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
7719+
type: string
7720+
username:
7721+
description: UserName should be the user ID on the chef server
7722+
type: string
7723+
required:
7724+
- auth
7725+
- serverUrl
7726+
- username
7727+
type: object
76427728
conjur:
76437729
description: Conjur configures this store to sync secrets using conjur provider
76447730
properties:

0 commit comments

Comments
 (0)