feat: platform secrets as sealed secrets

.cspell.json

@@ -103,6 +103,7 @@
     "backoff",
     "basepath",
     "binzx",
+    "bitnami",
     "blackbox",
     "bootstrapper",
     "calico",

.github/workflows/integration.yml

@@ -91,7 +91,7 @@ on:
         options:
           - age
           - no_kms
-        default: age
+        default: no_kms
       certificate:
         type: choice
         description: Select certificate issuer

chart/apl/templates/deployment.yaml

@@ -77,13 +77,9 @@ spec:
               value: {{ .Values.operator.pollIntervalMs | default "30000" | quote }}
             - name: RECONCILE_INTERVAL_MS
               value: {{ .Values.operator.reconcileIntervalMs | default "300000" | quote }}
-          {{- if hasKey $kms "sops" }}
           envFrom:
-            - secretRef:
-                name: apl-sops-secrets
             - secretRef:
                 name: apl-git-credentials
-          {{- end }}
           volumeMounts:
             - name: otomi-values
               mountPath: /home/app/stack/env

chart/chart-index/Chart.yaml

@@ -31,6 +31,9 @@ dependencies:
   - name: external-dns
     version: 1.20.0
     repository: https://kubernetes-sigs.github.io/external-dns
+  - name: external-secrets
+    version: 0.14.3
+    repository: https://charts.external-secrets.io
   - name: gitea
     version: 12.5.0
     repository: https://dl.gitea.io/charts

charts/apl-operator/templates/deployment.yaml

@@ -44,6 +44,7 @@ spec:
           envFrom:
             - secretRef:
                 name: apl-sops-secrets
+                optional: true
             - secretRef:
                 name: apl-git-credentials
           livenessProbe:

charts/external-secrets/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+appVersion: 0.14.3
+description: External Secrets Operator for Kubernetes
+home: https://external-secrets.io
+keywords:
+- secrets
+- external-secrets
+kubeVersion: '>=1.19.0-0'
+maintainers:
+- name: External Secrets Community
+  url: https://github.com/external-secrets/external-secrets
+name: external-secrets
+sources:
+- https://github.com/external-secrets/external-secrets
+type: application
+version: 0.14.3

charts/external-secrets/crds/clusterexternalsecrets.yaml

@@ -0,0 +1,51 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterexternalsecrets.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: ClusterExternalSecret
+    listKind: ClusterExternalSecretList
+    plural: clusterexternalsecrets
+    shortNames:
+      - ces
+    singular: clusterexternalsecret
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .spec.externalSecretSpec.secretStoreRef.name
+          name: Store
+          type: string
+        - jsonPath: .spec.refreshTime
+          name: Refresh Interval
+          type: string
+        - jsonPath: .status.conditions[?(@.type=="Ready")].status
+          name: Ready
+          type: string
+      name: v1beta1
+      schema:
+        openAPIV3Schema:
+          description: ClusterExternalSecret creates ExternalSecrets across namespaces
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

charts/external-secrets/crds/clustersecretstores.yaml

@@ -0,0 +1,48 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clustersecretstores.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: ClusterSecretStore
+    listKind: ClusterSecretStoreList
+    plural: clustersecretstores
+    shortNames:
+      - css
+    singular: clustersecretstore
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: AGE
+          type: date
+        - jsonPath: .status.conditions[?(@.type=="Ready")].status
+          name: Ready
+          type: string
+      name: v1beta1
+      schema:
+        openAPIV3Schema:
+          description: ClusterSecretStore represents a cluster-wide secret store
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

charts/external-secrets/crds/externalsecrets.yaml

@@ -0,0 +1,51 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: externalsecrets.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: ExternalSecret
+    listKind: ExternalSecretList
+    plural: externalsecrets
+    shortNames:
+      - es
+    singular: externalsecret
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .spec.secretStoreRef.name
+          name: Store
+          type: string
+        - jsonPath: .spec.refreshInterval
+          name: Refresh Interval
+          type: string
+        - jsonPath: .status.conditions[?(@.type=="Ready")].status
+          name: Ready
+          type: string
+      name: v1beta1
+      schema:
+        openAPIV3Schema:
+          description: ExternalSecret reads secret data from external secret stores
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

charts/external-secrets/crds/generatorstates.yaml

@@ -0,0 +1,39 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: generatorstates.generators.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: generators.external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: GeneratorState
+    listKind: GeneratorStateList
+    plural: generatorstates
+    singular: generatorstate
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: GeneratorState tracks the state of generators
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

charts/external-secrets/crds/pushsecrets.yaml

@@ -0,0 +1,43 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: pushsecrets.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: PushSecret
+    listKind: PushSecretList
+    plural: pushsecrets
+    singular: pushsecret
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type=="Ready")].status
+          name: Ready
+          type: string
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: PushSecret pushes secrets to external secret stores
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

charts/external-secrets/crds/secretstores.yaml

@@ -0,0 +1,48 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: secretstores.external-secrets.io
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+spec:
+  group: external-secrets.io
+  names:
+    categories:
+      - externalsecrets
+    kind: SecretStore
+    listKind: SecretStoreList
+    plural: secretstores
+    shortNames:
+      - ss
+    singular: secretstore
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: AGE
+          type: date
+        - jsonPath: .status.conditions[?(@.type=="Ready")].status
+          name: Ready
+          type: string
+      name: v1beta1
+      schema:
+        openAPIV3Schema:
+          description: SecretStore represents a source of secrets
+          properties:
+            apiVersion:
+              type: string
+            kind:
+              type: string
+            metadata:
+              type: object
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}