Skip to content

Commit 3826ad2

Browse files
oliverbaehleroliverbaehler
authored
feat: add metadata fields (#228)
* feat: add metadata field for sopssecrets and globalsopssecrets Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): add label and annotation vaules Signed-off-by: Oliver Bähler <[email protected]> * fix(helm): correct role binding reference Signed-off-by: Oliver Bähler <[email protected]> * feat: add metadata field for sopssecrets and globalsopssecrets Signed-off-by: Oliver Bähler <[email protected]> * feat: add metadata field for sopssecrets and globalsopssecrets Signed-off-by: Oliver Bähler <[email protected]> * feat: add metadata field for sopssecrets and globalsopssecrets Signed-off-by: Oliver Bähler <[email protected]> --------- Signed-off-by: Oliver Bähler <[email protected]>
1 parent 5e30a75 commit 3826ad2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+727
-231
lines changed

‎api/v1alpha1/globalsopssecret_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ import (
1414
type GlobalSopsSecretSpec struct {
1515
// Define Secrets to replicate, when secret is decrypted
1616
Secrets []*GlobalSopsSecretItem `json:"secrets"`
17+
// Define additional Metadata for the generated secrets
18+
Metadata SecretMetadata `json:"metadata,omitempty"`
1719
}
1820

1921
// GlobalSopsSecretItem defines the desired state of GlobalSopsSecret.

‎api/v1alpha1/secret_metadata.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/*
2+
Copyright 2024-2025 Peak Scale
3+
SPDX-License-Identifier: Apache-2.0
4+
*/
5+
6+
package v1alpha1
7+
8+
// SopsSecretSpec defines the desired state of SopsSecret.
9+
type SecretMetadata struct {
10+
// Prefix added to all generated Secrets names
11+
Prefix string `json:"prefix,omitempty"`
12+
// Suffix added to all generated Secrets names
13+
Suffix string `json:"suffix,omitempty"`
14+
// Labels added to all generated Secrets
15+
Labels map[string]string `json:"labels,omitempty"`
16+
// Annotations added to all generated Secrets
17+
Annotations map[string]string `json:"annotations,omitempty"`
18+
}

‎api/v1alpha1/sopssecret_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ import (
1313
type SopsSecretSpec struct {
1414
// Define Secrets to replicate, when secret is decrypted
1515
Secrets []*SopsSecretItem `json:"secrets"`
16+
// Define additional Metadata for the generated secrets
17+
Metadata SecretMetadata `json:"metadata,omitempty"`
1618
}
1719

1820
// SopsSecretTemplate defines the map of secrets to create

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 31 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/sops-operator/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,15 @@ The following Values are available for this chart.
2929
| Key | Type | Default | Description |
3030
|-----|------|---------|-------------|
3131
| global.jobs.kubectl.affinity | object | `{}` | Set affinity rules |
32-
| global.jobs.kubectl.annotations | object | `{}` | Annotations to add to the certgen job. |
32+
| global.jobs.kubectl.annotations | object | `{}` | Annotations to add to the job. |
3333
| global.jobs.kubectl.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy of the helm chart job |
3434
| global.jobs.kubectl.image.registry | string | `"docker.io"` | Set the image repository of the helm chart job |
3535
| global.jobs.kubectl.image.repository | string | `"clastix/kubectl"` | Set the image repository of the helm chart job |
3636
| global.jobs.kubectl.image.tag | string | `""` | Set the image tag of the helm chart job |
37+
| global.jobs.kubectl.labels | object | `{}` | Labels to add to the job. |
3738
| global.jobs.kubectl.nodeSelector | object | `{}` | Set the node selector |
39+
| global.jobs.kubectl.podAnnotations | object | `{}` | Annotations to add to the job pod |
40+
| global.jobs.kubectl.podLabels | object | `{}` | Labels to add to the job pod |
3841
| global.jobs.kubectl.podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
3942
| global.jobs.kubectl.priorityClassName | string | `""` | Set a pod priorityClassName |
4043
| global.jobs.kubectl.resources | object | `{}` | Job resources |

‎charts/sops-operator/ci/test-values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
replicaCount: 2
12
image:
23
pullPolicy: Never
34
tag: "latest"

‎charts/sops-operator/crds/addons.projectcapsule.dev_globalsopssecrets.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,26 @@ spec:
302302
spec:
303303
description: SopsSecretSpec defines the desired state of SopsSecret.
304304
properties:
305+
metadata:
306+
description: Define additional Metadata for the generated secrets
307+
properties:
308+
annotations:
309+
additionalProperties:
310+
type: string
311+
description: Annotations added to all generated Secrets
312+
type: object
313+
labels:
314+
additionalProperties:
315+
type: string
316+
description: Labels added to all generated Secrets
317+
type: object
318+
prefix:
319+
description: Prefix added to all generated Secrets names
320+
type: string
321+
suffix:
322+
description: Suffix added to all generated Secrets names
323+
type: string
324+
type: object
305325
secrets:
306326
description: Define Secrets to replicate, when secret is decrypted
307327
items:

‎charts/sops-operator/crds/addons.projectcapsule.dev_sopssecrets.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,26 @@ spec:
302302
spec:
303303
description: SopsSecretSpec defines the desired state of SopsSecret.
304304
properties:
305+
metadata:
306+
description: Define additional Metadata for the generated secrets
307+
properties:
308+
annotations:
309+
additionalProperties:
310+
type: string
311+
description: Annotations added to all generated Secrets
312+
type: object
313+
labels:
314+
additionalProperties:
315+
type: string
316+
description: Labels added to all generated Secrets
317+
type: object
318+
prefix:
319+
description: Prefix added to all generated Secrets names
320+
type: string
321+
suffix:
322+
description: Suffix added to all generated Secrets names
323+
type: string
324+
type: object
305325
secrets:
306326
description: Define Secrets to replicate, when secret is decrypted
307327
items:

‎charts/sops-operator/templates/crd-lifecycle/job.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,36 @@ metadata:
88
# create hook dependencies in the right order
99
"helm.sh/hook-weight": "-1"
1010
{{- include "crds.annotations" . | nindent 4 }}
11+
{{- with .Values.global.jobs.kubectl.annotations }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
1114
labels:
1215
app.kubernetes.io/component: {{ include "crds.component" . | quote }}
1316
{{- include "helm.labels" . | nindent 4 }}
17+
{{- with .Values.global.jobs.kubectl.labels }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
1420
spec:
1521
ttlSecondsAfterFinished: {{ .Values.global.jobs.kubectl.ttlSecondsAfterFinished }}
1622
template:
1723
metadata:
1824
name: "{{ include "crds.name" . }}"
25+
annotations:
26+
{{- with .Values.global.jobs.kubectl.podAnnotations }}
27+
{{- toYaml . | nindent 8 }}
28+
{{- end }}
29+
{{- with .Values.podAnnotations }}
30+
{{- toYaml . | nindent 8 }}
31+
{{- end }}
1932
labels:
2033
app.kubernetes.io/component: {{ include "crds.component" . | quote }}
2134
{{- include "helm.selectorLabels" . | nindent 8 }}
35+
{{- with .Values.global.jobs.kubectl.podLabels }}
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{- with .Values.podLabels }}
39+
{{- toYaml . | nindent 8 }}
40+
{{- end }}
2241
spec:
2342
restartPolicy: {{ $.Values.global.jobs.kubectl.restartPolicy }}
2443
{{- if $.Values.global.jobs.kubectl.podSecurityContext.enabled }}

‎charts/sops-operator/templates/rbac.yaml‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,21 +60,39 @@ subjects:
6060
apiVersion: rbac.authorization.k8s.io/v1
6161
kind: Role
6262
metadata:
63-
name: {{ include "helm.fullname" . }}-controller
63+
name: {{ include "helm.fullname" . }}
6464
labels:
6565
{{- include "helm.labels" . | nindent 4 }}
6666
rules:
6767
- apiGroups:
68-
- "coordination.k8s.io"
68+
- ""
6969
resources:
70-
- leases
70+
- configmaps
7171
verbs:
72-
- "*"
72+
- get
73+
- list
74+
- watch
75+
- create
76+
- update
77+
- patch
78+
- delete
79+
- apiGroups:
80+
- coordination.k8s.io
81+
resources:
82+
- leases
83+
verbs:
84+
- get
85+
- list
86+
- watch
87+
- create
88+
- update
89+
- patch
90+
- delete
7391
---
7492
apiVersion: rbac.authorization.k8s.io/v1
7593
kind: RoleBinding
7694
metadata:
77-
name: {{ include "helm.fullname" . }}-controller
95+
name: {{ include "helm.fullname" . }}
7896
labels:
7997
{{- include "helm.labels" . | nindent 4 }}
8098
namespace: {{ .Release.Namespace | quote }}

0 commit comments

Comments
 (0)