/run pipeline

@sai-madhav-k you must be in the team github-collaborators in order to trigger the pipeline.

generally speaking the functionality created by this PR is not clear, is there an issue bound to this PR? Could be possible to have an example for the secret that needs to be created?

For all Dreadnought cabins we need enable the capability to pull images from ibm-dreadnought-prod-images using Trusted profile onboarding into AppGalley account.

This is how the secret need to look for accessing the images from ibm-dreadnought-prod-images

{"auths": {"icr.io": {"password": "<ServiceID APIKEY>","username": "<TrustedProfileID>"}}}

Could be possible to have a documentation showing what we are creating? The PR hasn't any description, and it is also marked as new major version Last, why are we adding support for trusted profile only for the dockerjson chain of secret? if it could be bound to an apikey value, wouldn't make sense to add the support for standard secrets too?

We have the following the trusted profile in the appgalley account: dn-dev-d-appgalley-icr-dn-base-images-tp. This trusted profile will be having the access to pull dreadnought provided images. A trust relationship will be established between service id and the trusted profile. Once the trust relationship is established between service id and trusted profile, this service id apikey needs to be shipped into cluster and has to be deployed as dockerconfigjson, so that cabin teams can refer to the trusted profile and service id apikey for pulling images from appgalley account.

Issue: https://github.ibm.com/dreadnought/kanban/issues/3026

generally speaking the functionality created by this PR is not clear, is there an issue bound to this PR? Could be possible to have an example for the secret that needs to be created?

For all Dreadnought cabins we need enable the capability to pull images from ibm-dreadnought-prod-images using Trusted profile onboarding into AppGalley account.

This is how the secret need to look for accessing the images from ibm-dreadnought-prod-images

{"auths": {"icr.io": {"password": "<ServiceID APIKEY>","username": "<TrustedProfileID>"}}}

Could be possible to have a documentation showing what we are creating? The PR hasn't any description, and it is also marked as new major version Last, why are we adding support for trusted profile only for the dockerjson chain of secret? if it could be bound to an apikey value, wouldn't make sense to add the support for standard secrets too?

We have the following the trusted profile in the appgalley account: dn-dev-d-appgalley-icr-dn-base-images-tp. This trusted profile will be having the access to pull dreadnought provided images. A trust relationship will be established between service id and the trusted profile. Once the trust relationship is established between service id and trusted profile, this service id apikey needs to be shipped into cluster and has to be deployed as dockerconfigjson, so that cabin teams can refer to the trusted profile and service id apikey for pulling images from appgalley account.

Issue: https://github.ibm.com/dreadnought/kanban/issues/3026

Ok thank you now it is more clear to me.
I think it could be handled directly by setting the trusted profile ID instead of iamapikey username here

this would avoid to have this condition here

Last, you are implementing only for registry secrets chain, if we support it in the chain, we need to add its support in the standard registry secret configuration, if it is a valid use-case

I think it could be handled directly by setting the trusted profile ID instead of iamapikey username here

docker_user     = var.sm_secret_type == "username_password" || var.sm_secret_type=="trusted_profile" ? "{{ .username }}" : "iamapikey" # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value

I think we are using this variable in another variable called data_payload, but I dont think we are using that variable anywhere related to rotating type secret or secret id chain. So I think this block can remain unchanged as the main version.

@sai-madhav-k could be possible to add the same option for the single secret version?

Modified the block for both trusted profile and iam_credentials. As we are linking trusted profile with service id, so the service id apikey will be in the secrets manager under iam credentials, I have added it as iam_credentials/${element.sm_secret_id} which was missed earlier.

resource "helm_release" "kubernetes_secret_chain_list" {
  count     = local.is_dockerjsonconfig_chain == true ? 1 : 0
  name      = local.helm_secret_name
  namespace = local.es_helm_rls_namespace
  chart     = "${path.module}/../../chart/${local.helm_raw_chart_name}"
  version   = local.helm_raw_chart_version
  timeout   = 600
  values = [
    <<-EOF
    resources:
      - apiVersion: external-secrets.io/v1beta1
        kind: ExternalSecret
        metadata:
          name: "${var.es_kubernetes_secret_name}"
          namespace: "${var.es_kubernetes_namespace}"
        spec:
          refreshInterval: ${var.es_refresh_interval}
          secretStoreRef:
            name: "${var.eso_store_name}"
            kind: "${local.secret_store_ref_kind}"
          target:
            name: "${var.es_kubernetes_secret_name}"
            template:
              engineVersion: v2
              type: "${local.es_kubernetes_secret_type}"
              metadata:
                annotations:
                  ${local.reloader_annotation}
              data:
                ${local.data_chain}
          data:
%{for index, element in var.es_container_registry_secrets_chain~}
          - secretKey: secretid_${index}
            remoteRef:
              key: "${var.sm_secret_type == "trusted_profile" ? "iam_credentials/${element.sm_secret_id}" : "${var.sm_secret_type}/${element.sm_secret_id}"}"
%{endfor~}
    EOF
  ]
}

@sai-madhav-k could be possible to add the same option for the single secret version?

terraform-ibm-external-secrets-operator/modules/eso-external-secret/main.tf

Line 131 in 4e2cb6d

resource "helm_release" "kubernetes_secret" {

@vbontempi We can do it in subsequent release. For now can we release it for trusted profile as container_registry_chain. In the subsequent weeks I will create a different PR for this.

@vbontempi can you review this PR today , if there are any shortcomings it can be rectified within a day. Thank you !

The following are the helm values after deployment of secrets

1. Trusted-profile

saimadhav@Sais-MacBook-Pro terraform-ibm-external-secrets-operator % helm get values test-es-docker-iam-tp -n test
USER-SUPPLIED VALUES:
resources:
- apiVersion: external-secrets.io/v1beta1
  kind: ExternalSecret
  metadata:
    name: dn-common-image-all-io
    namespace: test
  spec:
    data:
    - remoteRef:
        key: iam_credentials/<SECRET-ID>
      secretKey: secretid_0
    - remoteRef:
        key: iam_credentials/<SECRET-ID>
      secretKey: secretid_1
    refreshInterval: 30s
    secretStoreRef:
      kind: SecretStore
      name: test-store
    target:
      name: dn-common-image-all-io
      template:
        data:
          .dockerconfigjson: '{"auths":{"icr.io":{"password":"{{ .secretid_0 }}","username":"<TP-ID>"},"private.icr.io":{"password":"{{
            .secretid_1 }}","username":"<TP-ID>"}}}'
        engineVersion: v2
        metadata:
          annotations: {}
        type: kubernetes.io/dockerconfigjson

2. Iam credentials

saimadhav@Sais-MacBook-Pro terraform-ibm-external-secrets-operator % helm get values test-es-docker-iam-arb -n test
USER-SUPPLIED VALUES:
resources:
- apiVersion: external-secrets.io/v1beta1
  kind: ExternalSecret
  metadata:
    name: dn-creds-io
    namespace: test
  spec:
    data:
    - remoteRef:
        key: iam_credentials/<SECRET-ID>
      secretKey: secretid_0
    - remoteRef:
        key: iam_credentials/<SECRET-ID>
      secretKey: secretid_1
    refreshInterval: 30s
    secretStoreRef:
      kind: SecretStore
      name: test-store
    target:
      name: dn-creds-io
      template:
        data:
          .dockerconfigjson: '{"auths":{"icr.io":{"password":"{{ .secretid_0 }}","username":"iamapikey"},"private.icr.io":{"password":"{{
            .secretid_1 }}","username":"iamapikey"}}}'
        engineVersion: v2
        metadata:
          annotations: {}
        type: kubernetes.io/dockerconfigjson

/run pipeline

/run pipeline

/run pipeline

/run pipeline

🎉 This PR is included in version 1.3.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀