Retain the secret's key from KV backend When using transformation API to decode secret values.

[gauravkr19]

Is your feature request related to a problem? Please describe. When using transformation API with VSS or SecretTransformation, we are not able to retain the secret's key from KV backend of Vault. Transformation API forces to use template name as the Secret's Key instead of using the key from Vault.

Describe the solution you'd like I should be able to range though the KV pairs from Vault and perform any manipulations in the templates. In the example below, the template name can be made optional to retrieve KV pairs from Vault.

    transformation:
      excludeRaw: true
      templates:
          text: |-
            {{- range $key, $value := .Secrets }}
            {{- printf "%s=%s\n" $key ( $value | b64dec ) -}}
            {{- end }}

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. With the existing transformation API, I am forced to provide a templates.key in VSS yaml and it discards the Key from Vault KV backend. In the example below, I have to explicitly pass the Keys - constants.pwd & somexml.xml

transformation:
      excludes:
      - .*
      excludeRaw: true
      templates:
        constants.pwd:
          text: |-
            {{- $value := get .Secrets "constants.pwd" }}
            {{- printf "%s" ( $value | b64dec ) -}}
        somexml.xml:
          text: |-
            {{- $value := get .Secrets "somexml.xml" }}
            {{- printf "%s" ( $value | b64dec ) -}}

Current Experience Our TIBCO application has 300+ microservices with 300+ Secrets. Providing and maintaining 300+ VSS with unique transformation template will be tedious. With the proposed feature, we can use a standard transformation template across all the VSS yamls.

Expectations With the proposed solution, we should be able to convert Vault KV secrets into K8s Secrets as indicated below: Secrets in Vault KV-v2 backend (encoded values)

vault kv get -format=json ngil/tibcobwce/performance/test-uploaddocuments | jq -r '.data.data'
{
  "constants.pwd": "c29tZVBhc3N3b3JkCg==",
  "somexml.xml": "VGhlIHZhbHVlIGlzIGI2NCBlbmNvZGluZyBvZiBYTUwK"
}

to

oc get secrets test-uploaddocuments -o json | jq -r '.data'
{
  "constants.pwd": "c29tZVBhc3N3b3JkCg==",
  "somexml.xml": "VGhlIHZhbHVlIGlzIGI2NCBlbmNvZGluZyBvZiBYTUwK"  
}

[sebastian-stephan]

We have a similar use-case where we would like to do transformations on all keys that end in some prefix without knowing the full list of keys. This would allow us to base64 decode all values of keys with a certain file extension.