mirror of
https://github.com/Infisical/infisical.git
synced 2026-01-07 22:53:55 -05:00
chore: removed operator helm
This commit is contained in:
Daniel Hougaard
@@ -1,23 +0,0 @@
|
|||||||
# Patterns to ignore when building packages.
|
|
||||||
# This supports shell glob matching, relative path matching, and
|
|
||||||
# negation (prefixed with !). Only one pattern per line.
|
|
||||||
.DS_Store
|
|
||||||
# Common VCS dirs
|
|
||||||
.git/
|
|
||||||
.gitignore
|
|
||||||
.bzr/
|
|
||||||
.bzrignore
|
|
||||||
.hg/
|
|
||||||
.hgignore
|
|
||||||
.svn/
|
|
||||||
# Common backup files
|
|
||||||
*.swp
|
|
||||||
*.bak
|
|
||||||
*.tmp
|
|
||||||
*.orig
|
|
||||||
*~
|
|
||||||
# Various IDEs
|
|
||||||
.project
|
|
||||||
.idea/
|
|
||||||
*.tmproj
|
|
||||||
.vscode/
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
apiVersion: v2
|
|
||||||
name: secrets-operator
|
|
||||||
description: A Helm chart for Infisical secrets
|
|
||||||
# A chart can be either an 'application' or a 'library' chart.
|
|
||||||
#
|
|
||||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
|
||||||
# to be deployed.
|
|
||||||
#
|
|
||||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
|
||||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
|
||||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
|
||||||
type: application
|
|
||||||
# This is the chart version. This version number should be incremented each time you make changes
|
|
||||||
# to the chart and its templates, including the app version.
|
|
||||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
|
||||||
version: v0.10.3
|
|
||||||
# This is the version number of the application being deployed. This version number should be
|
|
||||||
# incremented each time you make changes to the application. Versions are not expected to
|
|
||||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
|
||||||
# It is recommended to use it with quotes.
|
|
||||||
appVersion: "v0.10.3"
|
|
||||||
@@ -1,99 +0,0 @@
|
|||||||
# Infisical Helm Chart
|
|
||||||
|
|
||||||
This is the Infisical Secrets Operator Helm chart. Find the integration documentation [here](https://infisical.com/docs/integrations/platforms/kubernetes)
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
|
|
||||||
To install the chart, run the following :
|
|
||||||
|
|
||||||
```sh
|
|
||||||
# Add the Infisical repository
|
|
||||||
helm repo add infisical 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' && helm repo update
|
|
||||||
|
|
||||||
# Install Infisical Secrets Operator (with default values)
|
|
||||||
helm upgrade --install --atomic \
|
|
||||||
-n infisical-dev --create-namespace \
|
|
||||||
infisical-secrets-operator infisical/secrets-operator
|
|
||||||
|
|
||||||
# Install Infisical Secrets Operator (with custom inline values, replace with your own values)
|
|
||||||
helm upgrade --install --atomic \
|
|
||||||
-n infisical-dev --create-namespace \
|
|
||||||
--set controllerManager.replicas=3 \
|
|
||||||
infisical-secrets-operator infisical/secrets-operator
|
|
||||||
|
|
||||||
# Install Infisical Secrets Operator (with custom values file, replace with your own values file)
|
|
||||||
helm upgrade --install --atomic \
|
|
||||||
-n infisical-dev --create-namespace \
|
|
||||||
-f custom-values.yaml \
|
|
||||||
infisical-secrets-operator infisical/secrets-operator
|
|
||||||
```
|
|
||||||
|
|
||||||
## Synchronization
|
|
||||||
|
|
||||||
To sync your secrets from Infisical (or from your own instance), create the below resources :
|
|
||||||
|
|
||||||
```sh
|
|
||||||
# Create the tokenSecretReference (replace with your own token)
|
|
||||||
kubectl create secret generic infisical-example-service-token \
|
|
||||||
--from-literal=infisicalToken="<infisical-token-here>"
|
|
||||||
|
|
||||||
# Create the InfisicalSecret
|
|
||||||
cat <<EOF | kubectl apply -f -
|
|
||||||
apiVersion: secrets.infisical.com/v1alpha1
|
|
||||||
kind: InfisicalSecret
|
|
||||||
metadata:
|
|
||||||
# Name of of this InfisicalSecret resource
|
|
||||||
name: infisicalsecret-example
|
|
||||||
spec:
|
|
||||||
# The host that should be used to pull secrets from. The default value is https://app.infisical.com/api.
|
|
||||||
hostAPI: https://app.infisical.com/api
|
|
||||||
|
|
||||||
# The Kubernetes secret the stores the Infisical token
|
|
||||||
tokenSecretReference:
|
|
||||||
# Kubernetes secret name
|
|
||||||
secretName: infisical-example-service-token
|
|
||||||
# The secret namespace
|
|
||||||
secretNamespace: default
|
|
||||||
|
|
||||||
# The Kubernetes secret that Infisical Operator will create and populate with secrets from the above project
|
|
||||||
managedSecretReference:
|
|
||||||
# The name of managed Kubernetes secret that should be created
|
|
||||||
secretName: infisical-managed-secret
|
|
||||||
# The namespace the managed secret should be installed in
|
|
||||||
secretNamespace: default
|
|
||||||
EOF
|
|
||||||
```
|
|
||||||
|
|
||||||
### Managed secrets
|
|
||||||
|
|
||||||
#### Methods
|
|
||||||
|
|
||||||
To use the above created manage secrets, you can use the below methods :
|
|
||||||
- `env`
|
|
||||||
- `envFrom`
|
|
||||||
- `volumes`
|
|
||||||
|
|
||||||
Check the [docs](https://infisical.com/docs/integrations/platforms/kubernetes#using-managed-secret-in-your-deployment) to learn more about their implementation within your k8s resources
|
|
||||||
|
|
||||||
#### Auto-reload
|
|
||||||
|
|
||||||
And if you want to [auto-reload](https://infisical.com/docs/integrations/platforms/kubernetes#auto-redeployment) your deployments, add this annotation where the managed secret is consumed :
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
annotations:
|
|
||||||
secrets.infisical.com/auto-reload: "true"
|
|
||||||
```
|
|
||||||
|
|
||||||
## Parameters
|
|
||||||
|
|
||||||
*Coming soon*
|
|
||||||
|
|
||||||
## Local development
|
|
||||||
|
|
||||||
*Coming soon*
|
|
||||||
|
|
||||||
## Upgrading
|
|
||||||
|
|
||||||
### 0.1.2
|
|
||||||
|
|
||||||
Latest stable version, no breaking changes
|
|
||||||
@@ -1,62 +0,0 @@
|
|||||||
{{/*
|
|
||||||
Expand the name of the chart.
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.name" -}}
|
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified app name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
If release name contains chart name it will be used as a full name.
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.fullname" -}}
|
|
||||||
{{- if .Values.fullnameOverride }}
|
|
||||||
{{- .Values.fullnameOverride | trunc 15 | trimSuffix "-" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
|
||||||
{{- if contains $name .Release.Name }}
|
|
||||||
{{- .Release.Name | trunc 15 | trimSuffix "-" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- printf "%s-%s" .Release.Name $name | trunc 15 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create chart name and version as used by the chart label.
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.chart" -}}
|
|
||||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Common labels
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.labels" -}}
|
|
||||||
helm.sh/chart: {{ include "secrets-operator.chart" . }}
|
|
||||||
{{ include "secrets-operator.selectorLabels" . }}
|
|
||||||
{{- if .Chart.AppVersion }}
|
|
||||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
|
||||||
{{- end }}
|
|
||||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Selector labels
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.selectorLabels" -}}
|
|
||||||
app.kubernetes.io/name: {{ include "secrets-operator.name" . }}
|
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create the name of the service account to use
|
|
||||||
*/}}
|
|
||||||
{{- define "secrets-operator.serviceAccountName" -}}
|
|
||||||
{{- if .Values.serviceAccount.create }}
|
|
||||||
{{- default (include "secrets-operator.fullname" .) .Values.serviceAccount.name }}
|
|
||||||
{{- else }}
|
|
||||||
{{- default "default" .Values.serviceAccount.name }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
{{- if .Values.installCRDs }}
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: clustergenerators.secrets.infisical.com
|
|
||||||
annotations:
|
|
||||||
controller-gen.kubebuilder.io/version: v0.18.0
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
group: secrets.infisical.com
|
|
||||||
names:
|
|
||||||
kind: ClusterGenerator
|
|
||||||
listKind: ClusterGeneratorList
|
|
||||||
plural: clustergenerators
|
|
||||||
singular: clustergenerator
|
|
||||||
scope: Cluster
|
|
||||||
versions:
|
|
||||||
- name: v1alpha1
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
description: ClusterGenerator represents a cluster-wide generator
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: |-
|
|
||||||
APIVersion defines the versioned schema of this representation of an object.
|
|
||||||
Servers should convert recognized schemas to the latest internal value, and
|
|
||||||
may reject unrecognized values.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: |-
|
|
||||||
Kind is a string value representing the REST resource this object represents.
|
|
||||||
Servers may infer this from the endpoint the client submits requests to.
|
|
||||||
Cannot be updated.
|
|
||||||
In CamelCase.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
||||||
type: string
|
|
||||||
metadata:
|
|
||||||
type: object
|
|
||||||
spec:
|
|
||||||
properties:
|
|
||||||
generator:
|
|
||||||
description: Generator the spec for this generator, must match the kind.
|
|
||||||
properties:
|
|
||||||
passwordSpec:
|
|
||||||
description: PasswordSpec controls the behavior of the password
|
|
||||||
generator.
|
|
||||||
properties:
|
|
||||||
allowRepeat:
|
|
||||||
default: false
|
|
||||||
description: set allowRepeat to true to allow repeating characters.
|
|
||||||
type: boolean
|
|
||||||
digits:
|
|
||||||
description: |-
|
|
||||||
digits specifies the number of digits in the generated
|
|
||||||
password. If omitted it defaults to 25% of the length of the password
|
|
||||||
type: integer
|
|
||||||
length:
|
|
||||||
default: 24
|
|
||||||
description: |-
|
|
||||||
Length of the password to be generated.
|
|
||||||
Defaults to 24
|
|
||||||
type: integer
|
|
||||||
noUpper:
|
|
||||||
default: false
|
|
||||||
description: Set noUpper to disable uppercase characters
|
|
||||||
type: boolean
|
|
||||||
symbolCharacters:
|
|
||||||
description: |-
|
|
||||||
symbolCharacters specifies the special characters that should be used
|
|
||||||
in the generated password.
|
|
||||||
type: string
|
|
||||||
symbols:
|
|
||||||
description: |-
|
|
||||||
symbols specifies the number of symbol characters in the generated
|
|
||||||
password. If omitted it defaults to 25% of the length of the password
|
|
||||||
type: integer
|
|
||||||
type: object
|
|
||||||
uuidSpec:
|
|
||||||
description: UUIDSpec controls the behavior of the uuid generator.
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
kind:
|
|
||||||
description: Kind the kind of this generator.
|
|
||||||
enum:
|
|
||||||
- Password
|
|
||||||
- UUID
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- kind
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
status:
|
|
||||||
acceptedNames:
|
|
||||||
kind: ""
|
|
||||||
plural: ""
|
|
||||||
conditions: []
|
|
||||||
storedVersions: []
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,61 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-controller-manager
|
|
||||||
labels:
|
|
||||||
control-plane: controller-manager
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
replicas: {{ .Values.controllerManager.replicas }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
control-plane: controller-manager
|
|
||||||
{{- include "secrets-operator.selectorLabels" . | nindent 6 }}
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
control-plane: controller-manager
|
|
||||||
{{- include "secrets-operator.selectorLabels" . | nindent 8 }}
|
|
||||||
annotations:
|
|
||||||
kubectl.kubernetes.io/default-container: manager
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
{{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
- --namespace={{ .Values.scopedNamespace }}
|
|
||||||
{{- end }}
|
|
||||||
command:
|
|
||||||
- /manager
|
|
||||||
env:
|
|
||||||
- name: KUBERNETES_CLUSTER_DOMAIN
|
|
||||||
value: {{ quote .Values.kubernetesClusterDomain }}
|
|
||||||
image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag
|
|
||||||
| default .Chart.AppVersion }}
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 8081
|
|
||||||
initialDelaySeconds: 15
|
|
||||||
periodSeconds: 20
|
|
||||||
name: manager
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /readyz
|
|
||||||
port: 8081
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10
|
|
||||||
}}
|
|
||||||
securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext
|
|
||||||
| nindent 10 }}
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
serviceAccountName: {{ include "secrets-operator.fullname" . }}-controller-manager
|
|
||||||
{{- with .Values.imagePullSecrets }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
terminationGracePeriodSeconds: 10
|
|
||||||
nodeSelector: {{ toYaml .Values.controllerManager.nodeSelector | nindent 8 }}
|
|
||||||
tolerations: {{ toYaml .Values.controllerManager.tolerations | nindent 8 }}
|
|
||||||
@@ -1,338 +0,0 @@
|
|||||||
{{- if .Values.installCRDs }}
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: infisicaldynamicsecrets.secrets.infisical.com
|
|
||||||
annotations:
|
|
||||||
controller-gen.kubebuilder.io/version: v0.18.0
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
group: secrets.infisical.com
|
|
||||||
names:
|
|
||||||
kind: InfisicalDynamicSecret
|
|
||||||
listKind: InfisicalDynamicSecretList
|
|
||||||
plural: infisicaldynamicsecrets
|
|
||||||
singular: infisicaldynamicsecret
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1alpha1
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
description: InfisicalDynamicSecret is the Schema for the infisicaldynamicsecrets
|
|
||||||
API.
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: |-
|
|
||||||
APIVersion defines the versioned schema of this representation of an object.
|
|
||||||
Servers should convert recognized schemas to the latest internal value, and
|
|
||||||
may reject unrecognized values.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: |-
|
|
||||||
Kind is a string value representing the REST resource this object represents.
|
|
||||||
Servers may infer this from the endpoint the client submits requests to.
|
|
||||||
Cannot be updated.
|
|
||||||
In CamelCase.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
||||||
type: string
|
|
||||||
metadata:
|
|
||||||
type: object
|
|
||||||
spec:
|
|
||||||
description: InfisicalDynamicSecretSpec defines the desired state of InfisicalDynamicSecret.
|
|
||||||
properties:
|
|
||||||
authentication:
|
|
||||||
properties:
|
|
||||||
awsIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
azureAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
resource:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
gcpIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
serviceAccountKeyFilePath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- serviceAccountKeyFilePath
|
|
||||||
type: object
|
|
||||||
gcpIdTokenAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
kubernetesAuth:
|
|
||||||
properties:
|
|
||||||
autoCreateServiceAccountToken:
|
|
||||||
description: |-
|
|
||||||
Optionally automatically create a service account token for the configured service account.
|
|
||||||
If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases.
|
|
||||||
type: boolean
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
serviceAccountRef:
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
namespace:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- namespace
|
|
||||||
type: object
|
|
||||||
serviceAccountTokenAudiences:
|
|
||||||
description: The audiences to use for the service account token.
|
|
||||||
This is only relevant if `autoCreateServiceAccountToken` is
|
|
||||||
true.
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- serviceAccountRef
|
|
||||||
type: object
|
|
||||||
ldapAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
universalAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
dynamicSecret:
|
|
||||||
properties:
|
|
||||||
environmentSlug:
|
|
||||||
type: string
|
|
||||||
projectId:
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
type: string
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- environmentSlug
|
|
||||||
- projectId
|
|
||||||
- secretName
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
hostAPI:
|
|
||||||
type: string
|
|
||||||
leaseRevocationPolicy:
|
|
||||||
type: string
|
|
||||||
leaseTTL:
|
|
||||||
type: string
|
|
||||||
managedSecretReference:
|
|
||||||
properties:
|
|
||||||
creationPolicy:
|
|
||||||
default: Orphan
|
|
||||||
description: |-
|
|
||||||
The Kubernetes Secret creation policy.
|
|
||||||
Enum with values: 'Owner', 'Orphan'.
|
|
||||||
Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
|
|
||||||
Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
secretType:
|
|
||||||
default: Opaque
|
|
||||||
description: 'The Kubernetes Secret type (experimental feature).
|
|
||||||
More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
|
|
||||||
type: string
|
|
||||||
template:
|
|
||||||
description: The template to transform the secret data
|
|
||||||
properties:
|
|
||||||
data:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: The template key values
|
|
||||||
type: object
|
|
||||||
includeAllSecrets:
|
|
||||||
description: |-
|
|
||||||
This injects all retrieved secrets into the top level of your template.
|
|
||||||
Secrets defined in the template will take precedence over the injected ones.
|
|
||||||
type: boolean
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
tls:
|
|
||||||
properties:
|
|
||||||
caRef:
|
|
||||||
description: Reference to secret containing CA cert
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
description: The name of the secret property with the CA certificate
|
|
||||||
value
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The namespace where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- authentication
|
|
||||||
- dynamicSecret
|
|
||||||
- leaseRevocationPolicy
|
|
||||||
- leaseTTL
|
|
||||||
- managedSecretReference
|
|
||||||
type: object
|
|
||||||
status:
|
|
||||||
description: InfisicalDynamicSecretStatus defines the observed state of
|
|
||||||
InfisicalDynamicSecret.
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
items:
|
|
||||||
description: Condition contains details for one aspect of the current
|
|
||||||
state of this API Resource.
|
|
||||||
properties:
|
|
||||||
lastTransitionTime:
|
|
||||||
description: |-
|
|
||||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
||||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
||||||
format: date-time
|
|
||||||
type: string
|
|
||||||
message:
|
|
||||||
description: |-
|
|
||||||
message is a human readable message indicating details about the transition.
|
|
||||||
This may be an empty string.
|
|
||||||
maxLength: 32768
|
|
||||||
type: string
|
|
||||||
observedGeneration:
|
|
||||||
description: |-
|
|
||||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
||||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
||||||
with respect to the current state of the instance.
|
|
||||||
format: int64
|
|
||||||
minimum: 0
|
|
||||||
type: integer
|
|
||||||
reason:
|
|
||||||
description: |-
|
|
||||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
||||||
Producers of specific condition types may define expected values and meanings for this field,
|
|
||||||
and whether the values are considered a guaranteed API.
|
|
||||||
The value should be a CamelCase string.
|
|
||||||
This field may not be empty.
|
|
||||||
maxLength: 1024
|
|
||||||
minLength: 1
|
|
||||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
||||||
type: string
|
|
||||||
status:
|
|
||||||
description: status of the condition, one of True, False, Unknown.
|
|
||||||
enum:
|
|
||||||
- "True"
|
|
||||||
- "False"
|
|
||||||
- Unknown
|
|
||||||
type: string
|
|
||||||
type:
|
|
||||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
||||||
maxLength: 316
|
|
||||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- lastTransitionTime
|
|
||||||
- message
|
|
||||||
- reason
|
|
||||||
- status
|
|
||||||
- type
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
dynamicSecretId:
|
|
||||||
type: string
|
|
||||||
lease:
|
|
||||||
properties:
|
|
||||||
creationTimestamp:
|
|
||||||
format: date-time
|
|
||||||
type: string
|
|
||||||
expiresAt:
|
|
||||||
format: date-time
|
|
||||||
type: string
|
|
||||||
id:
|
|
||||||
type: string
|
|
||||||
version:
|
|
||||||
format: int64
|
|
||||||
type: integer
|
|
||||||
required:
|
|
||||||
- creationTimestamp
|
|
||||||
- expiresAt
|
|
||||||
- id
|
|
||||||
- version
|
|
||||||
type: object
|
|
||||||
maxTTL:
|
|
||||||
description: The MaxTTL can be null, if it's null, there's no max TTL
|
|
||||||
and we should never have to renew.
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- conditions
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
status:
|
|
||||||
acceptedNames:
|
|
||||||
kind: ""
|
|
||||||
plural: ""
|
|
||||||
conditions: []
|
|
||||||
storedVersions: []
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,333 +0,0 @@
|
|||||||
{{- if .Values.installCRDs }}
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: infisicalpushsecrets.secrets.infisical.com
|
|
||||||
annotations:
|
|
||||||
controller-gen.kubebuilder.io/version: v0.18.0
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
group: secrets.infisical.com
|
|
||||||
names:
|
|
||||||
kind: InfisicalPushSecret
|
|
||||||
listKind: InfisicalPushSecretList
|
|
||||||
plural: infisicalpushsecrets
|
|
||||||
singular: infisicalpushsecret
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1alpha1
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
description: InfisicalPushSecret is the Schema for the infisicalpushsecrets
|
|
||||||
API
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: |-
|
|
||||||
APIVersion defines the versioned schema of this representation of an object.
|
|
||||||
Servers should convert recognized schemas to the latest internal value, and
|
|
||||||
may reject unrecognized values.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: |-
|
|
||||||
Kind is a string value representing the REST resource this object represents.
|
|
||||||
Servers may infer this from the endpoint the client submits requests to.
|
|
||||||
Cannot be updated.
|
|
||||||
In CamelCase.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
||||||
type: string
|
|
||||||
metadata:
|
|
||||||
type: object
|
|
||||||
spec:
|
|
||||||
description: InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret
|
|
||||||
properties:
|
|
||||||
authentication:
|
|
||||||
properties:
|
|
||||||
awsIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
azureAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
resource:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
gcpIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
serviceAccountKeyFilePath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- serviceAccountKeyFilePath
|
|
||||||
type: object
|
|
||||||
gcpIdTokenAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
kubernetesAuth:
|
|
||||||
properties:
|
|
||||||
autoCreateServiceAccountToken:
|
|
||||||
description: |-
|
|
||||||
Optionally automatically create a service account token for the configured service account.
|
|
||||||
If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases.
|
|
||||||
type: boolean
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
serviceAccountRef:
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
namespace:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- namespace
|
|
||||||
type: object
|
|
||||||
serviceAccountTokenAudiences:
|
|
||||||
description: The audiences to use for the service account token.
|
|
||||||
This is only relevant if `autoCreateServiceAccountToken` is
|
|
||||||
true.
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- serviceAccountRef
|
|
||||||
type: object
|
|
||||||
ldapAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
- identityId
|
|
||||||
type: object
|
|
||||||
universalAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
deletionPolicy:
|
|
||||||
type: string
|
|
||||||
destination:
|
|
||||||
properties:
|
|
||||||
environmentSlug:
|
|
||||||
type: string
|
|
||||||
projectId:
|
|
||||||
type: string
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- environmentSlug
|
|
||||||
- projectId
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
hostAPI:
|
|
||||||
description: Infisical host to pull secrets from
|
|
||||||
type: string
|
|
||||||
push:
|
|
||||||
properties:
|
|
||||||
generators:
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
destinationSecretName:
|
|
||||||
type: string
|
|
||||||
generatorRef:
|
|
||||||
properties:
|
|
||||||
kind:
|
|
||||||
allOf:
|
|
||||||
- enum:
|
|
||||||
- Password
|
|
||||||
- UUID
|
|
||||||
- enum:
|
|
||||||
- Password
|
|
||||||
- UUID
|
|
||||||
description: Specify the Kind of the generator resource
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- kind
|
|
||||||
- name
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- destinationSecretName
|
|
||||||
- generatorRef
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
secret:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
template:
|
|
||||||
properties:
|
|
||||||
data:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: The template key values
|
|
||||||
type: object
|
|
||||||
includeAllSecrets:
|
|
||||||
description: |-
|
|
||||||
This injects all retrieved secrets into the top level of your template.
|
|
||||||
Secrets defined in the template will take precedence over the injected ones.
|
|
||||||
type: boolean
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
resyncInterval:
|
|
||||||
type: string
|
|
||||||
tls:
|
|
||||||
properties:
|
|
||||||
caRef:
|
|
||||||
description: Reference to secret containing CA cert
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
description: The name of the secret property with the CA certificate
|
|
||||||
value
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The namespace where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
updatePolicy:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- destination
|
|
||||||
- push
|
|
||||||
type: object
|
|
||||||
status:
|
|
||||||
description: InfisicalPushSecretStatus defines the observed state of InfisicalPushSecret
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
items:
|
|
||||||
description: Condition contains details for one aspect of the current
|
|
||||||
state of this API Resource.
|
|
||||||
properties:
|
|
||||||
lastTransitionTime:
|
|
||||||
description: |-
|
|
||||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
||||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
||||||
format: date-time
|
|
||||||
type: string
|
|
||||||
message:
|
|
||||||
description: |-
|
|
||||||
message is a human readable message indicating details about the transition.
|
|
||||||
This may be an empty string.
|
|
||||||
maxLength: 32768
|
|
||||||
type: string
|
|
||||||
observedGeneration:
|
|
||||||
description: |-
|
|
||||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
||||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
||||||
with respect to the current state of the instance.
|
|
||||||
format: int64
|
|
||||||
minimum: 0
|
|
||||||
type: integer
|
|
||||||
reason:
|
|
||||||
description: |-
|
|
||||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
||||||
Producers of specific condition types may define expected values and meanings for this field,
|
|
||||||
and whether the values are considered a guaranteed API.
|
|
||||||
The value should be a CamelCase string.
|
|
||||||
This field may not be empty.
|
|
||||||
maxLength: 1024
|
|
||||||
minLength: 1
|
|
||||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
||||||
type: string
|
|
||||||
status:
|
|
||||||
description: status of the condition, one of True, False, Unknown.
|
|
||||||
enum:
|
|
||||||
- "True"
|
|
||||||
- "False"
|
|
||||||
- Unknown
|
|
||||||
type: string
|
|
||||||
type:
|
|
||||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
||||||
maxLength: 316
|
|
||||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- lastTransitionTime
|
|
||||||
- message
|
|
||||||
- reason
|
|
||||||
- status
|
|
||||||
- type
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
managedSecrets:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: managed secrets is a map where the key is the ID, and the
|
|
||||||
value is the secret key (string[id], string[key] )
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- conditions
|
|
||||||
- managedSecrets
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
status:
|
|
||||||
acceptedNames:
|
|
||||||
kind: ""
|
|
||||||
plural: ""
|
|
||||||
conditions: []
|
|
||||||
storedVersions: []
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,549 +0,0 @@
|
|||||||
{{- if .Values.installCRDs }}
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: infisicalsecrets.secrets.infisical.com
|
|
||||||
annotations:
|
|
||||||
controller-gen.kubebuilder.io/version: v0.18.0
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
group: secrets.infisical.com
|
|
||||||
names:
|
|
||||||
kind: InfisicalSecret
|
|
||||||
listKind: InfisicalSecretList
|
|
||||||
plural: infisicalsecrets
|
|
||||||
singular: infisicalsecret
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1alpha1
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
description: InfisicalSecret is the Schema for the infisicalsecrets API
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: |-
|
|
||||||
APIVersion defines the versioned schema of this representation of an object.
|
|
||||||
Servers should convert recognized schemas to the latest internal value, and
|
|
||||||
may reject unrecognized values.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: |-
|
|
||||||
Kind is a string value representing the REST resource this object represents.
|
|
||||||
Servers may infer this from the endpoint the client submits requests to.
|
|
||||||
Cannot be updated.
|
|
||||||
In CamelCase.
|
|
||||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
||||||
type: string
|
|
||||||
metadata:
|
|
||||||
type: object
|
|
||||||
spec:
|
|
||||||
description: InfisicalSecretSpec defines the desired state of InfisicalSecret
|
|
||||||
properties:
|
|
||||||
authentication:
|
|
||||||
properties:
|
|
||||||
awsIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
type: object
|
|
||||||
azureAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
resource:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
type: object
|
|
||||||
gcpIamAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
serviceAccountKeyFilePath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
- serviceAccountKeyFilePath
|
|
||||||
type: object
|
|
||||||
gcpIdTokenAuth:
|
|
||||||
properties:
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
type: object
|
|
||||||
kubernetesAuth:
|
|
||||||
properties:
|
|
||||||
autoCreateServiceAccountToken:
|
|
||||||
description: |-
|
|
||||||
Optionally automatically create a service account token for the configured service account.
|
|
||||||
If this is set to `true`, the operator will automatically create a service account token for the configured service account.
|
|
||||||
type: boolean
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
serviceAccountRef:
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
namespace:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- namespace
|
|
||||||
type: object
|
|
||||||
serviceAccountTokenAudiences:
|
|
||||||
description: The audiences to use for the service account token.
|
|
||||||
This is only relevant if `autoCreateServiceAccountToken` is
|
|
||||||
true.
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
- serviceAccountRef
|
|
||||||
type: object
|
|
||||||
ldapAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
identityId:
|
|
||||||
type: string
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
- identityId
|
|
||||||
- secretsScope
|
|
||||||
type: object
|
|
||||||
serviceAccount:
|
|
||||||
properties:
|
|
||||||
environmentName:
|
|
||||||
type: string
|
|
||||||
projectId:
|
|
||||||
type: string
|
|
||||||
serviceAccountSecretReference:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- environmentName
|
|
||||||
- projectId
|
|
||||||
- serviceAccountSecretReference
|
|
||||||
type: object
|
|
||||||
serviceToken:
|
|
||||||
properties:
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
serviceTokenSecretReference:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- secretsScope
|
|
||||||
- serviceTokenSecretReference
|
|
||||||
type: object
|
|
||||||
universalAuth:
|
|
||||||
properties:
|
|
||||||
credentialsRef:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret
|
|
||||||
is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
secretsScope:
|
|
||||||
properties:
|
|
||||||
envSlug:
|
|
||||||
type: string
|
|
||||||
projectSlug:
|
|
||||||
type: string
|
|
||||||
recursive:
|
|
||||||
type: boolean
|
|
||||||
secretsPath:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- envSlug
|
|
||||||
- projectSlug
|
|
||||||
- secretsPath
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- credentialsRef
|
|
||||||
- secretsScope
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
hostAPI:
|
|
||||||
description: Infisical host to pull secrets from
|
|
||||||
type: string
|
|
||||||
instantUpdates:
|
|
||||||
type: boolean
|
|
||||||
managedKubeConfigMapReferences:
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
configMapName:
|
|
||||||
description: The name of the Kubernetes ConfigMap
|
|
||||||
type: string
|
|
||||||
configMapNamespace:
|
|
||||||
description: The namespace where the Kubernetes ConfigMap is located
|
|
||||||
type: string
|
|
||||||
creationPolicy:
|
|
||||||
default: Orphan
|
|
||||||
description: |-
|
|
||||||
The Kubernetes ConfigMap creation policy.
|
|
||||||
Enum with values: 'Owner', 'Orphan'.
|
|
||||||
Owner creates the config map and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
|
|
||||||
Orphan will not set the config map owner. This will result in the config map being orphaned and not deleted when the resource is deleted.
|
|
||||||
type: string
|
|
||||||
template:
|
|
||||||
description: The template to transform the secret data
|
|
||||||
properties:
|
|
||||||
data:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: The template key values
|
|
||||||
type: object
|
|
||||||
includeAllSecrets:
|
|
||||||
description: |-
|
|
||||||
This injects all retrieved secrets into the top level of your template.
|
|
||||||
Secrets defined in the template will take precedence over the injected ones.
|
|
||||||
type: boolean
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- configMapName
|
|
||||||
- configMapNamespace
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
managedKubeSecretReferences:
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
creationPolicy:
|
|
||||||
default: Orphan
|
|
||||||
description: |-
|
|
||||||
The Kubernetes Secret creation policy.
|
|
||||||
Enum with values: 'Owner', 'Orphan'.
|
|
||||||
Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
|
|
||||||
Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
secretType:
|
|
||||||
default: Opaque
|
|
||||||
description: 'The Kubernetes Secret type (experimental feature).
|
|
||||||
More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
|
|
||||||
type: string
|
|
||||||
template:
|
|
||||||
description: The template to transform the secret data
|
|
||||||
properties:
|
|
||||||
data:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: The template key values
|
|
||||||
type: object
|
|
||||||
includeAllSecrets:
|
|
||||||
description: |-
|
|
||||||
This injects all retrieved secrets into the top level of your template.
|
|
||||||
Secrets defined in the template will take precedence over the injected ones.
|
|
||||||
type: boolean
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
managedSecretReference:
|
|
||||||
properties:
|
|
||||||
creationPolicy:
|
|
||||||
default: Orphan
|
|
||||||
description: |-
|
|
||||||
The Kubernetes Secret creation policy.
|
|
||||||
Enum with values: 'Owner', 'Orphan'.
|
|
||||||
Owner creates the secret and sets .metadata.ownerReferences of the InfisicalSecret CRD that created it.
|
|
||||||
Orphan will not set the secret owner. This will result in the secret being orphaned and not deleted when the resource is deleted.
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
secretType:
|
|
||||||
default: Opaque
|
|
||||||
description: 'The Kubernetes Secret type (experimental feature).
|
|
||||||
More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types'
|
|
||||||
type: string
|
|
||||||
template:
|
|
||||||
description: The template to transform the secret data
|
|
||||||
properties:
|
|
||||||
data:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: The template key values
|
|
||||||
type: object
|
|
||||||
includeAllSecrets:
|
|
||||||
description: |-
|
|
||||||
This injects all retrieved secrets into the top level of your template.
|
|
||||||
Secrets defined in the template will take precedence over the injected ones.
|
|
||||||
type: boolean
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
resyncInterval:
|
|
||||||
default: 60
|
|
||||||
type: integer
|
|
||||||
tls:
|
|
||||||
properties:
|
|
||||||
caRef:
|
|
||||||
description: Reference to secret containing CA cert
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
description: The name of the secret property with the CA certificate
|
|
||||||
value
|
|
||||||
type: string
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The namespace where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
tokenSecretReference:
|
|
||||||
properties:
|
|
||||||
secretName:
|
|
||||||
description: The name of the Kubernetes Secret
|
|
||||||
type: string
|
|
||||||
secretNamespace:
|
|
||||||
description: The name space where the Kubernetes Secret is located
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- secretName
|
|
||||||
- secretNamespace
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- resyncInterval
|
|
||||||
type: object
|
|
||||||
status:
|
|
||||||
description: InfisicalSecretStatus defines the observed state of InfisicalSecret
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
items:
|
|
||||||
description: Condition contains details for one aspect of the current
|
|
||||||
state of this API Resource.
|
|
||||||
properties:
|
|
||||||
lastTransitionTime:
|
|
||||||
description: |-
|
|
||||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
||||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
||||||
format: date-time
|
|
||||||
type: string
|
|
||||||
message:
|
|
||||||
description: |-
|
|
||||||
message is a human readable message indicating details about the transition.
|
|
||||||
This may be an empty string.
|
|
||||||
maxLength: 32768
|
|
||||||
type: string
|
|
||||||
observedGeneration:
|
|
||||||
description: |-
|
|
||||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
||||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
||||||
with respect to the current state of the instance.
|
|
||||||
format: int64
|
|
||||||
minimum: 0
|
|
||||||
type: integer
|
|
||||||
reason:
|
|
||||||
description: |-
|
|
||||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
||||||
Producers of specific condition types may define expected values and meanings for this field,
|
|
||||||
and whether the values are considered a guaranteed API.
|
|
||||||
The value should be a CamelCase string.
|
|
||||||
This field may not be empty.
|
|
||||||
maxLength: 1024
|
|
||||||
minLength: 1
|
|
||||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
||||||
type: string
|
|
||||||
status:
|
|
||||||
description: status of the condition, one of True, False, Unknown.
|
|
||||||
enum:
|
|
||||||
- "True"
|
|
||||||
- "False"
|
|
||||||
- Unknown
|
|
||||||
type: string
|
|
||||||
type:
|
|
||||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
||||||
maxLength: 316
|
|
||||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- lastTransitionTime
|
|
||||||
- message
|
|
||||||
- reason
|
|
||||||
- status
|
|
||||||
- type
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- conditions
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
status:
|
|
||||||
acceptedNames:
|
|
||||||
kind: ""
|
|
||||||
plural: ""
|
|
||||||
conditions: []
|
|
||||||
storedVersions: []
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-leader-election-role
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- configmaps
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- events
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- patch
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-leader-election-rolebinding
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-leader-election-role'
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-controller-manager'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
@@ -1,124 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: Role
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRole
|
|
||||||
{{- end }}
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-manager-role
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
namespace: {{ .Values.scopedNamespace | quote }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- configmaps
|
|
||||||
- secrets
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- delete
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- update
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- serviceaccounts
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- serviceaccounts/token
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- apps
|
|
||||||
resources:
|
|
||||||
- daemonsets
|
|
||||||
- deployments
|
|
||||||
- statefulsets
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- update
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- authentication.k8s.io
|
|
||||||
resources:
|
|
||||||
- tokenreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- secrets.infisical.com
|
|
||||||
resources:
|
|
||||||
- clustergenerators
|
|
||||||
- infisicaldynamicsecrets
|
|
||||||
- infisicalpushsecrets
|
|
||||||
- infisicalsecrets
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- delete
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- patch
|
|
||||||
- update
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- secrets.infisical.com
|
|
||||||
resources:
|
|
||||||
- infisicaldynamicsecrets/finalizers
|
|
||||||
- infisicalpushsecrets/finalizers
|
|
||||||
- infisicalsecrets/finalizers
|
|
||||||
verbs:
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- secrets.infisical.com
|
|
||||||
resources:
|
|
||||||
- infisicaldynamicsecrets/status
|
|
||||||
- infisicalpushsecrets/status
|
|
||||||
- infisicalsecrets/status
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- patch
|
|
||||||
- update
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: RoleBinding
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
{{- end }}
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-manager-rolebinding
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
namespace: {{ .Values.scopedNamespace | quote }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: Role
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRole
|
|
||||||
{{- end }}
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-manager-role'
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-controller-manager'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: Role
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRole
|
|
||||||
{{- end }}
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-metrics-auth-role
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
namespace: {{ .Values.scopedNamespace | quote }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- authentication.k8s.io
|
|
||||||
resources:
|
|
||||||
- tokenreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- authorization.k8s.io
|
|
||||||
resources:
|
|
||||||
- subjectaccessreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: RoleBinding
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
{{- end }}
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-metrics-auth-rolebinding
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
namespace: {{ .Values.scopedNamespace | quote }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
|
|
||||||
kind: Role
|
|
||||||
{{- else }}
|
|
||||||
kind: ClusterRole
|
|
||||||
{{- end }}
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-metrics-auth-role'
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: '{{ include "secrets-operator.fullname" . }}-controller-manager'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
{{- if not .Values.scopedNamespace }}
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-metrics-reader
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- nonResourceURLs:
|
|
||||||
- /metrics
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
|
|
||||||
{{- end }}
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service
|
|
||||||
labels:
|
|
||||||
control-plane: controller-manager
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
type: {{ .Values.metricsService.type }}
|
|
||||||
selector:
|
|
||||||
control-plane: controller-manager
|
|
||||||
{{- include "secrets-operator.selectorLabels" . | nindent 4 }}
|
|
||||||
ports:
|
|
||||||
{{- .Values.metricsService.ports | toYaml | nindent 2 }}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: {{ include "secrets-operator.fullname" . }}-controller-manager
|
|
||||||
labels:
|
|
||||||
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
{{- toYaml .Values.controllerManager.serviceAccount.annotations | nindent 4 }}
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
controllerManager:
|
|
||||||
manager:
|
|
||||||
args:
|
|
||||||
- --metrics-bind-address=:8443
|
|
||||||
- --leader-elect
|
|
||||||
- --health-probe-bind-address=:8081
|
|
||||||
containerSecurityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
image:
|
|
||||||
repository: infisical/kubernetes-operator
|
|
||||||
tag: v0.10.3
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 128Mi
|
|
||||||
requests:
|
|
||||||
cpu: 10m
|
|
||||||
memory: 64Mi
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
replicas: 1
|
|
||||||
serviceAccount:
|
|
||||||
annotations: {}
|
|
||||||
nodeSelector: {}
|
|
||||||
tolerations: []
|
|
||||||
metricsService:
|
|
||||||
ports:
|
|
||||||
- name: https
|
|
||||||
port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8443
|
|
||||||
type: ClusterIP
|
|
||||||
kubernetesClusterDomain: cluster.local
|
|
||||||
scopedNamespace: ""
|
|
||||||
scopedRBAC: false
|
|
||||||
installCRDs: true
|
|
||||||
imagePullSecrets: []
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
cd secrets-operator
|
|
||||||
helm dependency update
|
|
||||||
helm package .
|
|
||||||
for i in *.tgz; do
|
|
||||||
[ -f "$i" ] || break
|
|
||||||
cloudsmith push helm --republish infisical/helm-charts "$i"
|
|
||||||
done
|
|
||||||
cd ..
|
|
||||||
Reference in New Issue
Block a user