Skip to content

Commit 2eb37b5

Browse files
dirtycajunricedirtycajunrice
authored
Merge pull request #36 from itscontained/backend/gcp
Add GCP Secret Manager Backend
2 parents 5139d92 + d765be1 commit 2eb37b5

29 files changed

+858
-69
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,21 @@ repos:
99
types: ['file']
1010
files: '^deploy/charts/.*(\.ya?ml|\.tpl|\.helmignore|NOTES.txt)'
1111
entry: -u 0 quay.io/helmpack/chart-testing:v3.0.0 ct lint --config .ct.yaml
12+
- id: make-fmt
13+
name: "make fmt"
14+
language: system
15+
pass_filenames: false
16+
entry: make fmt
17+
- id: make-lint
18+
name: "make lint"
19+
language: system
20+
pass_filenames: false
21+
entry: make lint
22+
- id: make-test
23+
name: "make test"
24+
language: system
25+
pass_filenames: false
26+
entry: make test
1227
- repo: https://github.com/pre-commit/pre-commit-hooks
1328
rev: v3.2.0
1429
hooks:

‎Dockerfile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,14 @@ COPY go.sum go.sum
1010
RUN go mod download
1111

1212
# Copy the go source
13-
COPY cmd/ cmd/
14-
COPY pkg/ pkg/
13+
COPY cmd cmd/
14+
COPY pkg pkg/
1515
COPY Makefile Makefile
1616

17+
# Copy the dirs for make
18+
COPY build build/
19+
COPY .git .git/
20+
1721
# Build
1822
RUN make build
1923

‎Makefile‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,8 @@ manifests: controller-gen ## Generate CRD manifests
6666
generate: controller-gen ## Generate CRD code
6767
$(CONTROLLER_GEN) object:headerFile="build/boilerplate.go.txt" paths="./pkg/apis/..."
6868

69-
docker-build: manifests generate test build ## Build the docker image
70-
docker build . -t $(IMG)
69+
docker-build: manifests generate test ## Build the docker image
70+
docker build . -t $(IMG) --load
7171

7272
crds-to-chart: ## copy crds to helm chart directory
7373
cp deploy/crds/*.yaml $(HELM_DIR)/templates/crds/; \
@@ -79,7 +79,9 @@ docker-build-kind-deploy: docker-build crds-to-chart ## copy
7979
kind load docker-image ${IMG} --name test
8080
kind export kubeconfig --name test --kubeconfig $(HOME)/.kube/configs/kind-test.yaml
8181
kubie ctx kind-test --namespace kube-system
82-
helm upgrade secret-manager $(HELM_DIR)/. -f values.yaml --set image.tag=$(IMG_TAG),image.pullPolicy=IfNotPresent,installCRDs=true --namespace kube-system --install
82+
helm upgrade secret-manager $(HELM_DIR)/. -f $(HELM_DIR)/values.yaml \
83+
--set image.tag=$(IMG_TAG),image.pullPolicy=IfNotPresent,installCRDs=true,leaderElect=false \
84+
--namespace kube-system --install
8385

8486
docker-push: ## Push the docker image
8587
docker push ${IMG}

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,12 @@ SecretStores.
66
### Supported
77
* Hashicorp Vault
88
* AWS SecretManager
9-
### Planned
109
* GCP Secret Manager
1110

11+
### Planned
12+
* Azure Key Vault
13+
* Bitwarden
14+
1215
## Inspiration
1316
Inspired by the great work done by the contributors over at [godaddy/kubernetes-external-secrets][1] and
1417
[jetstack/cert-manager][2], This project aims to take some of the best ideas from both projects for managing secrets.

‎deploy/charts/secret-manager/Chart.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ keywords:
1515
- crd
1616
home: https://github.com/itscontained/secret-manager
1717
sources:
18-
- https://github.com/itscontained/secret-manager
1918
- https://hub.docker.com/r/itscontained/secret-manager
2019
- https://quay.io/repository/itscontained/secret-manager
2120
- https://github.com/orgs/itscontained/packages/container/secret-manager
@@ -24,3 +23,19 @@ maintainers:
2423
email: nick@cajun.pro
2524
- name: mcavoyk
2625
email: kellinmcavoy@gmail.com
26+
annotations:
27+
artifacthub.io/operator: true
28+
artifacthub.io/links: |
29+
- name: Source Code
30+
url: https://github.com/itscontained/secret-manager
31+
- name: DockerHub Image
32+
url: https://hub.docker.com/r/itscontained/secret-manager
33+
- name: Quay.io Image
34+
url: https://quay.io/repository/itscontained/secret-manager
35+
- name: GHCR Image
36+
url: https://github.com/orgs/itscontained/packages/container/secret-manager
37+
artifacthub.io/maintainers: |
38+
- name: Nicholas St. Germain
39+
email: nick@cajun.pro
40+
- name: Kellin McAvoy
41+
email: kellinmcavoy@gmail.com

‎deploy/charts/secret-manager/templates/NOTES.txt‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,4 @@ In order to begin using ExternalSecrets, you will need to set up a SecretStore
44
or ClusterSecretStore resource (for example, by creating a 'vault' SecretStore).
55

66
More information on the different types of SecretStores and how to configure them
7-
can be found in our Github:
8-
9-
https://github.com/itscontained/secret-manager
7+
can be found in our Github: https://github.com/itscontained/secret-manager

‎deploy/charts/secret-manager/templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ spec:
5454
{{- if .Values.leaderElect }}
5555
- --leader-elect=true
5656
- --leader-election-namespace={{ .Release.Namespace }}
57+
{{- else }}
58+
- --leader-elect=false
5759
{{- end }}
5860
{{- range $arg := .Values.extraArgs }}
5961
- {{ $arg }}

‎deploy/crds/legacy/secret-manager.itscontained.io_clustersecretstores.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,50 @@ spec:
124124
description: Region configures the region to send requests to.
125125
type: string
126126
type: object
127+
gcp:
128+
description: GCP configures this store to sync secrets using GCP Secret
129+
Manager
130+
properties:
131+
authSecretRef:
132+
description: Auth configures how secret-manager authenticates with
133+
GCP Secret Manager.
134+
properties:
135+
filePath:
136+
description: 'The FilePath string is used for authentication
137+
using a gcp credentials json file. If not set we fall-back
138+
to using `GOOGLE_APPLICATION_CREDENTIALS` or the default service
139+
account of the compute engine see: https://cloud.google.com/docs/authentication/production'
140+
type: string
141+
json:
142+
description: 'The JSON secret key selector is used for authentication.
143+
If not set we fall-back to using `GOOGLE_APPLICATION_CREDENTIALS`
144+
or the default service account of the compute engine see:
145+
https://cloud.google.com/docs/authentication/production'
146+
properties:
147+
key:
148+
description: The key of the entry in the Secret resource's
149+
`data` field to be used. Some instances of this field
150+
may be defaulted, in others it may be required.
151+
type: string
152+
name:
153+
description: 'Name of the resource being referred to. More
154+
info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
155+
type: string
156+
namespace:
157+
description: Namespace of the resource being referred to.
158+
Ignored if referent is not cluster-scoped. cluster-scoped
159+
defaults to the namespace of the referent.
160+
type: string
161+
required:
162+
- name
163+
type: object
164+
type: object
165+
projectID:
166+
description: ProjectID is a convenience string to allow the shortening
167+
of secret paths. When set, the prefix projects/<ProjectID> can
168+
be removed from the name
169+
type: string
170+
type: object
127171
vault:
128172
description: Vault configures this store to sync secrets using a HashiCorp
129173
Vault KV backend.

‎deploy/crds/legacy/secret-manager.itscontained.io_externalsecrets.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,9 @@ spec:
5959
description: Data is a list of references to secret values.
6060
items:
6161
properties:
62+
namespace:
63+
description: Namespace of the secret. Ignored if SecretStore
64+
type: string
6265
remoteRef:
6366
description: RemoteRef describes the path and other parameters
6467
to access the secret for the specific SecretStore

‎deploy/crds/legacy/secret-manager.itscontained.io_secretstores.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,50 @@ spec:
124124
description: Region configures the region to send requests to.
125125
type: string
126126
type: object
127+
gcp:
128+
description: GCP configures this store to sync secrets using GCP Secret
129+
Manager
130+
properties:
131+
authSecretRef:
132+
description: Auth configures how secret-manager authenticates with
133+
GCP Secret Manager.
134+
properties:
135+
filePath:
136+
description: 'The FilePath string is used for authentication
137+
using a gcp credentials json file. If not set we fall-back
138+
to using `GOOGLE_APPLICATION_CREDENTIALS` or the default service
139+
account of the compute engine see: https://cloud.google.com/docs/authentication/production'
140+
type: string
141+
json:
142+
description: 'The JSON secret key selector is used for authentication.
143+
If not set we fall-back to using `GOOGLE_APPLICATION_CREDENTIALS`
144+
or the default service account of the compute engine see:
145+
https://cloud.google.com/docs/authentication/production'
146+
properties:
147+
key:
148+
description: The key of the entry in the Secret resource's
149+
`data` field to be used. Some instances of this field
150+
may be defaulted, in others it may be required.
151+
type: string
152+
name:
153+
description: 'Name of the resource being referred to. More
154+
info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
155+
type: string
156+
namespace:
157+
description: Namespace of the resource being referred to.
158+
Ignored if referent is not cluster-scoped. cluster-scoped
159+
defaults to the namespace of the referent.
160+
type: string
161+
required:
162+
- name
163+
type: object
164+
type: object
165+
projectID:
166+
description: ProjectID is a convenience string to allow the shortening
167+
of secret paths. When set, the prefix projects/<ProjectID> can
168+
be removed from the name
169+
type: string
170+
type: object
127171
vault:
128172
description: Vault configures this store to sync secrets using a HashiCorp
129173
Vault KV backend.

0 commit comments

Comments
 (0)