search

phasehq / kubernetes-secrets-operator

Securely sync secrets and environment variables with Phase in your Kubernetes cluster
GNU General Public License v3.0
5 stars 1 forks source link

Phase Kubernetes Operator v1.0.0 #6

Closed nimish-ks closed 9 months ago

nimish-ks commented 9 months ago

This PR adds support for the following new features as well as minor fixes and refactors:

Tests:

  1. Automatic re-deployments:

Add to any deployment:

  annotations:
    secrets.phase.dev/redeploy: "true"

Example:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: env-echo
  labels:
    app: env-echo
  annotations:
    secrets.phase.dev/redeploy: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: env-echo
  template:
    metadata:
      labels:
        app: env-echo
    spec:
      containers:
        - name: echo
          image: mendhak/http-https-echo
          ports:
            - containerPort: 80
          env:
            - name: ECHO_INCLUDE_ENV_VARS
              value: "1"
          envFrom:
            - secretRef:
                name: my-application-secret
  1. kubernetes.io/tls secret type and tags filters and secret name processors

CR:

apiVersion: secrets.phase.dev/v1alpha1
kind: PhaseSecret
metadata:
  name: example-phase-secret
  namespace: default
spec:
  phaseAppEnv: "prod"
  phaseAppEnvTag: "certs" # This is the tag used to filter for this secret
  phaseHost: "https://console.phase.dev"
  authentication:
    serviceToken:
      serviceTokenSecretReference:
        secretName: "phase-service-token"
        secretNamespace: "default"
  managedSecretReferences:
    - secretName: "my-tls-secret"
      secretNamespace: "default"
      secretType: "kubernetes.io/tls"
      processors:
        PKCS12_CERTIFICATE:
          asName: "tls.crt"
          type: "base64"
        PKCS12_PRIVATE_KEY:
          asName: "tls.key"
          type: "base64"

PKCS12_CERTIFICATE:

LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN6RENDQWllZ0F3SUJBZ0lSQUk4VjluK2F3RmJ5MjA3YklUekFLQmdncWhrak9QUVFEQWpBaE1STXdFUVlEVlFRREV3MUpkSGRwZEhSbGNsOHRZV2RwYm1jaU1Td0dBMVVFQXd3YlEyeHBZMkYwWlM1amIyMHdIaGNOTWpBd016QTNNREl3TmpBME1CNFhEVEl4TURreE9ERTNNRGMxT0ZvWERUSXlNVEF3TXpBM01EY3dNakF4T0Zvd0l6RWhNQjhHQTFVRUF3d1pTVzUwWld3Z1UwZFlXNGdVbTl2ZENCRGIyNXVaVzUwYVhSNU1JSUJJakFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBd0VBZm1tRm5kWm5xWDNjaEh0NDI1QXoySTVvVThOckRyZkF0bG5VaTZxT1h4S3ZpQjYyak9GMGpienB5Q3ZKZ1NiVndBTjBUaGw1MDNwRWhBSUV4cXJoMzA0VWxHMWx4Y3dBSTVwT09lNFRqN0xkMm5jNDFkTzR2M0N5QXVkN1EwN05CbUdQOGN4YU5WQ3Q5V0JyZ0NZVjB3ZUZaQ1RvQXZjYk1TSzBieGx4M3ZzQnZZbG9lUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K

PKCS12_PRIVATE_KEY:

LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUNqakNDQWlhZ0F3SUJBZ0lSQUk4VjluK2F3RmJ5MjA3YklUekFLQmdncWhrak9QUVFEQWpBaE1STXdFUVlEVlFRREV3MUpkSGRwZEhSbGNsOHRZV2RwYm1jaU1Td0dBMVVFQXd3YlEyeHBZMkYwWlM1amIyMHdIaGNOTWpBd016QTNNREl3TmpBME1CNFhEVEl4TURreE9ERTNNRGMxT0ZvWERUSXlNVEF3TXpBM01EY3dNakF4T0Zvd0p6RWhNQjhHQTFVRUF3d1pTVzUwWld3Z1UwZFlXNGdVbTl2ZENCRGIyNXVaVzUwYVhSNU1JSUJJakFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBd0VBZm1tRm5kWm5xWDNjaEh0NDI1QXoySTVvVThOckRyZkF0bG5VaTZxT1h4S3ZpQjYyak9GMGpienB5Q3ZKZ1NiVndBTjBUaGw1MDNwRWhBSUV4cXJoMzA0VWxHMWx4Y3dBSTVwT09lNFRqN0xkMm5jNDFkTzR2M0N5QXVkN1EwN05CbUdQOGN4YU5WQ3Q5V0JyZ0NZVjB3ZUZaQ1RvQXZjYk1TSzBieGx4M3ZzQnZZbG9lUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
cloudflare-workers-and-pages[bot] commented 9 months ago

Deploying with  Cloudflare Pages  Cloudflare Pages

Latest commit: f78ac67
Status: ✅  Deploy successful!
Preview URL: https://1dd37ce6.helm-repo-kubernetes-secrets-operator.pages.dev
Branch Preview URL: https://feat--auto-redeploy.helm-repo-kubernetes-secrets-operator.pages.dev

View logs

nimish-ks commented 9 months ago

@nimish-ks Lets add the test suite to the github actions workflow, and add some instructions on running them locally in the Readme

having some trouble fixing the python imports. will do in a separate PR. let's roll this out.