Feature Request: Load keys from `Secret` or `ConfigMap` resources

[alanrichman]

What problem are you facing?

We manage our EnvironmentConfig resources using FluxCD which means they are committed to a git repository. Our use case for Crossplane involves creating compositions managing resources which require sensitive inputs. An easy example is that our compositions use the Kubernetes provider to create Secret resources in other clusters.

How could this Function help solve your problem?

There is not a general purpose way that I am aware of to provider secret values to Crossplane composition functions. The credentials field of the composition pipeline exists but the receiving function needs to be written to accept this. By allowing this function to read values from regular Kubernetes secrets it opens the door to use a different piece of k8s tooling to retrieve values for a Crossplane environment. The particular chain that I am interested in is:

Cloud secret store (AWS SM, GCP SM, Vault, etc.) -> External Secrets Operator -> K8s Secret -> function-environment-configs -> function-go-templating -> My composed resources

I have not fully thought through what the syntax might look like, but this pseudo-code represents the functionality I have in mind:

apiVersion: apiextensions.crossplane.io/v1beta1
kind: EnvironmentConfig
metadata:
  name: environment
data:
  environment: dev
  myPassword:
    secretRef:
      name: foo
      namespace: bar
      key: baz

[tenstad]

Could the function instead be extended to support loading values from Secret and ConfigMap resources, not only EnvironmentConfig?

---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
spec:
  pipeline:
    - input:
        apiVersion: environmentconfigs.fn.crossplane.io/v1beta1
        kind: Input
        spec:
          environmentConfigs:
            - type: Reference
              apiVersion: v1
              kind: Secret
              ref:
                name: foo
                namespace: bar

As mentioned in https://crossplane.slack.com/archives/C08BBMDCH7W/p1769759797425119?thread_ts=1769438184.689339&cid=C08BBMDCH7W, I've been using a fork of the function to read ConfigMaps, and the implementation is quite simple: sn-atmos@9ec17e4

It does however kinda turn it into crossplane-contrib/function-extra-resources, just that it would load into the environment context (which has built-in support in patch and transform) instead of the extra-resources context.