diff --git a/chart/chart-index/Chart.yaml b/chart/chart-index/Chart.yaml index 4210fb2d2f..24599e0a4e 100644 --- a/chart/chart-index/Chart.yaml +++ b/chart/chart-index/Chart.yaml @@ -32,7 +32,7 @@ dependencies: version: 1.21.1 repository: https://kubernetes-sigs.github.io/external-dns - name: external-secrets - version: 2.7.0 + version: 2.8.0 repository: https://charts.external-secrets.io - name: gitea version: 12.6.0 diff --git a/charts/external-secrets/Chart.yaml b/charts/external-secrets/Chart.yaml index bd863d000f..4c134a3efa 100644 --- a/charts/external-secrets/Chart.yaml +++ b/charts/external-secrets/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: v2.7.0 +appVersion: v2.8.0 dependencies: - condition: bitwarden-sdk-server.enabled name: bitwarden-sdk-server @@ -17,4 +17,4 @@ maintainers: name: mcavoyk name: external-secrets type: application -version: 2.7.0 +version: 2.8.0 diff --git a/charts/external-secrets/README.md b/charts/external-secrets/README.md index 7803dca38a..43fc772af2 100644 --- a/charts/external-secrets/README.md +++ b/charts/external-secrets/README.md @@ -4,7 +4,7 @@ [//]: # (README.md generated by gotmpl. DO NOT EDIT.) -![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 2.7.0](https://img.shields.io/badge/Version-2.7.0-informational?style=flat-square) +![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 2.8.0](https://img.shields.io/badge/Version-2.8.0-informational?style=flat-square) External secrets management for Kubernetes @@ -70,12 +70,16 @@ The command removes all the Kubernetes components associated with the chart and | certController.metrics.service.annotations | object | `{}` | Additional service annotations | | certController.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics | | certController.metrics.service.port | int | `8080` | Metrics service port to scrape | +| certController.networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets certController | +| certController.networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are: DNS (53/udp, 53/tcp) API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs | +| certController.networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. | +| certController.networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"}]}]` | The ingress traffic Should match the health and (optionally) metrics port | | certController.nodeSelector | object | `{}` | | | certController.podAnnotations | object | `{}` | Annotations to add to Pod | | certController.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1,"nameOverride":""}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | | certController.podLabels | object | `{}` | | | certController.podSecurityContext.enabled | bool | `true` | | -| certController.priorityClassName | string | `""` | Pod priority class name. | +| certController.priorityClassName | string | `""` | | | certController.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. | | certController.readinessProbe.address | string | `""` | | | certController.readinessProbe.enabled | bool | `true` | | @@ -101,9 +105,10 @@ The command removes all the Kubernetes components associated with the chart and | certController.serviceAccount.create | bool | `true` | Specifies whether a service account should be created. | | certController.serviceAccount.extraLabels | object | `{}` | Extra Labels to add to the service account. | | certController.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. | -| certController.startupProbe.enabled | bool | `false` | Enabled determines if the startup probe should be used or not. By default it's enabled | -| certController.startupProbe.port | string | `""` | Port for startup probe. | -| certController.startupProbe.useReadinessProbePort | bool | `true` | whether to use the readiness probe port for startup probe. | +| certController.startupProbe.enabled | bool | `false` | Enabled determines if the startup probe should be used or not. By default it's disabled. | +| certController.startupProbe.failureThreshold | int | `30` | Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds. | +| certController.startupProbe.initialDelaySeconds | int | `10` | Number of seconds after the container has started before the startup probe is initiated. | +| certController.startupProbe.periodSeconds | int | `10` | How often (in seconds) to perform the startup probe. | | certController.strategy | object | `{}` | Set deployment strategy | | certController.tolerations | list | `[]` | | | certController.topologySpreadConstraints | list | `[]` | | @@ -162,6 +167,9 @@ The command removes all the Kubernetes components associated with the chart and | installCRDs | bool | `true` | If set, install and upgrade CRDs through helm chart. | | leaderElect | bool | `false` | If true, external-secrets will perform leader election between instances to ensure no more than one instance of external-secrets operates at a time. | | leaderElectionID | string | "external-secrets-controller" | ID of the lease object used for leader election. Leave empty to use the default ('external-secrets-controller'). Set to a unique value when running multiple independent ESO deployments in the same namespace. | +| leaderElectionLeaseDuration | string | "15s" | Duration that non-leader candidates will wait to force acquire leadership. Increase this along with renewDeadline to tolerate a busy or briefly unavailable API server (for example during control plane maintenance) without churning leadership. Leave empty to use the controller default ('15s'). | +| leaderElectionRenewDeadline | string | "10s" | Duration that the acting leader will retry refreshing leadership before giving up. Must be less than leaderElectionLeaseDuration. Leave empty to use the controller default ('10s'). | +| leaderElectionRetryPeriod | string | "2s" | Duration the leader election client waits between tries of actions. Leave empty to use the controller default ('2s'). | | livenessProbe.enabled | bool | `false` | Enabled determines if the liveness probe should be used or not. By default it's disabled. | | livenessProbe.spec | object | `{"address":"","failureThreshold":5,"httpGet":{"path":"/healthz","port":"live"},"initialDelaySeconds":10,"periodSeconds":10,"port":8082,"successThreshold":1,"timeoutSeconds":5}` | The body of the liveness probe settings. | | livenessProbe.spec.address | string | `""` | Bind address for the health server used by both liveness and readiness probes (--live-addr flag). | @@ -186,6 +194,10 @@ The command removes all the Kubernetes components associated with the chart and | metrics.service.port | int | `8080` | Metrics service port to scrape | | nameOverride | string | `""` | | | namespaceOverride | string | `""` | | +| networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8082,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets | +| networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are: DNS (53/udp, 53/tcp) API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs | +| networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. | +| networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8082,"protocol":"TCP"}]}]` | The ingress traffic Should match the health and (optionally) metrics port | | nodeSelector | object | `{}` | | | openshiftFinalizers | bool | `true` | If true the OpenShift finalizer permissions will be added to RBAC | | podAnnotations | object | `{}` | Annotations to add to Pod | @@ -200,6 +212,7 @@ The command removes all the Kubernetes components associated with the chart and | processClusterStore | bool | `true` | if true, the operator will process cluster store. Else, it will ignore them. | | processPushSecret | bool | `true` | if true, the operator will process push secret. Else, it will ignore them. | | processSecretStore | bool | `true` | if true, the operator will process secret store. Else, it will ignore them. | +| rbac.aggregateToAdmin | bool | `true` | Specifies whether permissions are aggregated to the admin ClusterRole | | rbac.aggregateToEdit | bool | `true` | Specifies whether permissions are aggregated to the edit ClusterRole | | rbac.aggregateToView | bool | `true` | Specifies whether permissions are aggregated to the view ClusterRole | | rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. | @@ -299,6 +312,10 @@ The command removes all the Kubernetes components associated with the chart and | webhook.metrics.service.annotations | object | `{}` | Additional service annotations | | webhook.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics | | webhook.metrics.service.port | int | `8080` | Metrics service port to scrape | +| webhook.networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"},{"port":10250,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets webhook | +| webhook.networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are: DNS (53/udp, 53/tcp) API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs | +| webhook.networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. | +| webhook.networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"},{"port":10250,"protocol":"TCP"}]}]` | The ingress traffic Should match the webhook, health, and (optionally) metrics port | | webhook.nodeSelector | object | `{}` | | | webhook.podAnnotations | object | `{}` | Annotations to add to Pod | | webhook.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1,"nameOverride":""}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | @@ -336,6 +353,10 @@ The command removes all the Kubernetes components associated with the chart and | webhook.serviceAccount.create | bool | `true` | Specifies whether a service account should be created. | | webhook.serviceAccount.extraLabels | object | `{}` | Extra Labels to add to the service account. | | webhook.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. | +| webhook.startupProbe.enabled | bool | `false` | Enabled determines if the startup probe should be used or not. By default it's disabled. | +| webhook.startupProbe.failureThreshold | int | `30` | Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds. | +| webhook.startupProbe.initialDelaySeconds | int | `10` | Number of seconds after the container has started before the startup probe is initiated. | +| webhook.startupProbe.periodSeconds | int | `10` | How often (in seconds) to perform the startup probe. | | webhook.strategy | object | `{}` | Set deployment strategy | | webhook.tolerations | list | `[]` | | | webhook.topologySpreadConstraints | list | `[]` | | diff --git a/charts/external-secrets/crds/clustersecretstore.yaml b/charts/external-secrets/crds/clustersecretstore.yaml index f9e0ff9058..1274c3f4a6 100644 --- a/charts/external-secrets/crds/clustersecretstore.yaml +++ b/charts/external-secrets/crds/clustersecretstore.yaml @@ -309,6 +309,38 @@ spec: type: string type: object type: object + serviceAccountRef: + description: |- + ServiceAccountRef specifies a Kubernetes ServiceAccount used for azure_ad + authentication on AKS Workload Identity. The operator obtains a federated + identity token from this ServiceAccount via the TokenRequest API instead + of using the ESO controller pod identity. Ignored for other access types. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object type: object caBundle: description: |- @@ -350,6 +382,11 @@ spec: - name - type type: object + ignoreCache: + description: |- + IgnoreCache bypasses the Gateway cache for secret reads when true. + Only relevant when akeylessGWApiURL points to an Akeyless Gateway. + type: boolean required: - akeylessGWApiURL - authSecretRef @@ -536,6 +573,7 @@ spec: enum: - SecretsManager - ParameterStore + - CertificateManager type: string sessionTags: description: AWS STS assume role session tags @@ -1439,6 +1477,8 @@ spec: properties: auth: description: Defines authentication settings for connecting to Conjur. + maxProperties: 1 + minProperties: 1 properties: apikey: description: Authenticates with Conjur using an API key. @@ -1507,6 +1547,80 @@ spec: - apiKeyRef - userRef type: object + cert: + description: Cert enables certificate-based authentication using a client certificate and key. + properties: + account: + description: Account is the Conjur organization account name. + type: string + clientCertRef: + description: |- + ClientCertRef is a reference to a specific 'key' containing the client certificate + within a Secret resource. The certificate must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKeyRef: + description: |- + ClientKeyRef is a reference to a specific 'key' containing the private RSA client key + within a Secret resource. The key must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + hostId: + description: Optional HostID for cert authentication (can be omitted when using 'spiffe' mode). + type: string + serviceID: + description: The conjur authn cert webservice id + type: string + required: + - account + - clientCertRef + - clientKeyRef + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. properties: @@ -1630,6 +1744,288 @@ spec: - auth - url type: object + crd: + description: |- + CRD configures this store to sync secrets from arbitrary Kubernetes resources, + including both custom resources (CRDs) and core API resources. Resources are + selected by API group, version and kind, where group can be "" (empty string) + for core resources such as ConfigMap. Reading the core v1 Secret is + intentionally blocked — use the Kubernetes provider for that. + properties: + auth: + description: |- + Auth configures authentication to the Kubernetes API, same as the + Kubernetes provider. Required when Server.URL is set (unless using AuthRef). + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKey: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientCert + - clientKey + type: object + serviceAccount: + description: points to a service account that should be used for authentication + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - bearerToken + type: object + type: object + authRef: + description: |- + AuthRef references a Secret containing a kubeconfig. Same semantics as the + Kubernetes provider. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + resource: + description: Resource identifies the CRD by its API group, version and kind. + properties: + group: + description: |- + Group is the API group of the resource. Use "" (empty string) for core + Kubernetes resources such as ConfigMap; use e.g. "config.example.io" + for a CRD. The field is required to be present in the manifest — write + `group: ""` explicitly for core resources so typos fail at admission + time rather than later at discovery. + type: string + kind: + description: Kind is the Kubernetes resource kind (e.g. "MyCustomResource"). + minLength: 1 + type: string + version: + description: Version is the API version of the resource (e.g. "v1alpha1"). + minLength: 1 + type: string + required: + - group + - kind + - version + type: object + server: + description: |- + Server configures the Kubernetes API address and TLS trust, same as the + Kubernetes provider. When omitted, the URL defaults to the in-cluster API. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can be found in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + whitelist: + description: |- + Whitelist optionally restricts which object names and requested properties + are allowed to be read. + properties: + rules: + description: |- + Rules is a list of allow rules. If rules are set, at least one rule must + match for a request to be allowed. + items: + description: CRDProviderWhitelistRule defines a single allow rule for CRD reads. + properties: + name: + description: |- + Name is an optional regular expression matched against the bare object name. + For both SecretStore and ClusterSecretStore this is always the object name + without any namespace prefix (e.g. "my-db-spec", not "prod/my-db-spec"). + type: string + namespace: + description: |- + Namespace is an optional regular expression matched against the namespace of + the object. Applies only when a ClusterSecretStore is used; it is ignored + for SecretStore (where the namespace is fixed to the store namespace). + type: string + properties: + description: |- + Properties is an optional list of regular expressions matched against + requested property keys (for example: "spec.secretValue"). + items: + type: string + type: array + type: object + type: array + type: object + required: + - resource + type: object + x-kubernetes-validations: + - message: one of auth or authRef is required + rule: has(self.auth) || has(self.authRef) + - message: at most one of the fields in [auth authRef] may be set + rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() <= 1' delinea: description: |- Delinea DevOps Secrets Vault @@ -3357,6 +3753,9 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - clientCert + - clientKey type: object serviceAccount: description: points to a service account that should be used for authentication @@ -3417,6 +3816,8 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - bearerToken type: object type: object authRef: @@ -3460,7 +3861,7 @@ spec: format: byte type: string caProvider: - description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' properties: key: description: The key where the CA certificate can be found in the Secret or ConfigMap. @@ -4932,7 +5333,9 @@ spec: description: Domain is the secret server domain. type: string password: - description: Password is the secret server account password. + description: |- + Password is the secret server account password. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -4962,15 +5365,61 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) serverURL: description: |- ServerURL URL to your secret server installation type: string + token: + description: |- + Token is an access token used to authenticate to the secret server, + as an alternative to Username and Password. When set, Username and + Password are not required and are ignored. + properties: + secretRef: + description: SecretRef references a key in a secret that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a value without using a secret. + minLength: 1 + type: string + type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) username: - description: Username is the secret server account username. + description: |- + Username is the secret server account username. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -5000,13 +5449,18 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) required: - - password - serverURL - - username type: object + x-kubernetes-validations: + - message: either token, or both username and password, must be set + rule: has(self.token) || (has(self.username) && has(self.password)) senhasegura: description: Senhasegura configures this store to sync secrets using senhasegura provider properties: @@ -6434,8 +6888,14 @@ spec: type: object type: object refreshInterval: - description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config. - type: integer + anyOf: + - type: integer + - type: string + description: |- + Used to configure store refresh interval. Accepts either an integer number + of seconds (legacy) or a Go duration string such as "1h" or "5m". Empty or + 0 will default to the controller config. + x-kubernetes-int-or-string: true retrySettings: description: Used to configure HTTP retries on failures. properties: diff --git a/charts/external-secrets/crds/externalsecret.yaml b/charts/external-secrets/crds/externalsecret.yaml index 07b2ea3aa9..61f21bd60e 100644 --- a/charts/external-secrets/crds/externalsecret.yaml +++ b/charts/external-secrets/crds/externalsecret.yaml @@ -153,6 +153,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -401,6 +402,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -546,6 +548,7 @@ spec: - Orphan - Merge - None + - CreateOrMerge type: string deletionPolicy: default: Retain diff --git a/charts/external-secrets/crds/gitlabdeploytoken.yaml b/charts/external-secrets/crds/gitlabdeploytoken.yaml new file mode 100644 index 0000000000..c33a03235a --- /dev/null +++ b/charts/external-secrets/crds/gitlabdeploytoken.yaml @@ -0,0 +1,150 @@ +--- +# Source: external-secrets/templates/crds/gitlabdeploytoken.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + labels: + external-secrets.io/component: controller + name: gitlabdeploytokens.generators.external-secrets.io +spec: + group: generators.external-secrets.io + names: + categories: + - external-secrets + - external-secrets-generators + kind: GitlabDeployToken + listKind: GitlabDeployTokenList + plural: gitlabdeploytokens + singular: gitlabdeploytoken + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: GitlabDeployToken generates a GitLab deploy token. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token. + properties: + auth: + description: Auth configures how ESO authenticates with the GitLab API. + properties: + token: + description: |- + Token references a secret containing a GitLab access token (personal, group, or + project) with the api scope and at least the Maintainer role on the target. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + required: + - token + type: object + expiresAt: + description: |- + ExpiresAt is an optional expiry for the deploy token. If omitted the token does + not expire on the GitLab side and is revoked only when the generator state is + cleaned up (on regeneration or when the consuming ExternalSecret is deleted). + format: date-time + type: string + groupID: + description: |- + GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to + create the deploy token in. The generator URL-escapes paths before calling the + GitLab API, so do not pre-encode. Mutually exclusive with projectID. + minLength: 1 + type: string + name: + description: Name of the deploy token. + minLength: 1 + type: string + projectID: + description: |- + ProjectID is the numeric ID or unescaped path (e.g. group/project) of the + project to create the deploy token in. The generator URL-escapes paths before + calling the GitLab API, so do not pre-encode. Mutually exclusive with groupID. + minLength: 1 + type: string + scopes: + description: Scopes granted to the deploy token. At least one scope is required. + items: + description: GitlabDeployTokenScope is a scope that can be granted to a GitLab deploy token. + enum: + - read_repository + - read_registry + - write_registry + - read_package_registry + - write_package_registry + - read_virtual_registry + - write_virtual_registry + type: string + minItems: 1 + type: array + url: + description: URL configures the GitLab instance URL. Defaults to https://gitlab.com. + type: string + username: + description: |- + Username is an optional username for the deploy token. GitLab defaults it to + gitlab+deploy-token-{n} when omitted. + type: string + required: + - auth + - name + - scopes + type: object + x-kubernetes-validations: + - message: exactly one of projectID or groupID must be set + rule: has(self.projectID) != has(self.groupID) + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/external-secrets/crds/grafana.yaml b/charts/external-secrets/crds/grafana.yaml index ec13f400ff..8f32062206 100644 --- a/charts/external-secrets/crds/grafana.yaml +++ b/charts/external-secrets/crds/grafana.yaml @@ -115,6 +115,13 @@ spec: See here for the documentation on basic roles offered by Grafana: https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/ type: string + secondsToLive: + description: |- + SecondsToLive is the number of seconds before the generated service account token will expire. + Some Grafana deployments (e.g. AWS Managed Grafana) require this value to be set. + format: int64 + minimum: 1 + type: integer required: - name - role diff --git a/charts/external-secrets/crds/pushsecret.yaml b/charts/external-secrets/crds/pushsecret.yaml index 8815881473..6bfd15ed06 100644 --- a/charts/external-secrets/crds/pushsecret.yaml +++ b/charts/external-secrets/crds/pushsecret.yaml @@ -335,6 +335,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey diff --git a/charts/external-secrets/crds/secretstore.yaml b/charts/external-secrets/crds/secretstore.yaml index 4f121f3bbc..d8e46cd03e 100644 --- a/charts/external-secrets/crds/secretstore.yaml +++ b/charts/external-secrets/crds/secretstore.yaml @@ -309,6 +309,38 @@ spec: type: string type: object type: object + serviceAccountRef: + description: |- + ServiceAccountRef specifies a Kubernetes ServiceAccount used for azure_ad + authentication on AKS Workload Identity. The operator obtains a federated + identity token from this ServiceAccount via the TokenRequest API instead + of using the ESO controller pod identity. Ignored for other access types. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object type: object caBundle: description: |- @@ -350,6 +382,11 @@ spec: - name - type type: object + ignoreCache: + description: |- + IgnoreCache bypasses the Gateway cache for secret reads when true. + Only relevant when akeylessGWApiURL points to an Akeyless Gateway. + type: boolean required: - akeylessGWApiURL - authSecretRef @@ -536,6 +573,7 @@ spec: enum: - SecretsManager - ParameterStore + - CertificateManager type: string sessionTags: description: AWS STS assume role session tags @@ -1439,6 +1477,8 @@ spec: properties: auth: description: Defines authentication settings for connecting to Conjur. + maxProperties: 1 + minProperties: 1 properties: apikey: description: Authenticates with Conjur using an API key. @@ -1507,6 +1547,80 @@ spec: - apiKeyRef - userRef type: object + cert: + description: Cert enables certificate-based authentication using a client certificate and key. + properties: + account: + description: Account is the Conjur organization account name. + type: string + clientCertRef: + description: |- + ClientCertRef is a reference to a specific 'key' containing the client certificate + within a Secret resource. The certificate must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKeyRef: + description: |- + ClientKeyRef is a reference to a specific 'key' containing the private RSA client key + within a Secret resource. The key must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + hostId: + description: Optional HostID for cert authentication (can be omitted when using 'spiffe' mode). + type: string + serviceID: + description: The conjur authn cert webservice id + type: string + required: + - account + - clientCertRef + - clientKeyRef + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. properties: @@ -1630,6 +1744,288 @@ spec: - auth - url type: object + crd: + description: |- + CRD configures this store to sync secrets from arbitrary Kubernetes resources, + including both custom resources (CRDs) and core API resources. Resources are + selected by API group, version and kind, where group can be "" (empty string) + for core resources such as ConfigMap. Reading the core v1 Secret is + intentionally blocked — use the Kubernetes provider for that. + properties: + auth: + description: |- + Auth configures authentication to the Kubernetes API, same as the + Kubernetes provider. Required when Server.URL is set (unless using AuthRef). + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKey: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientCert + - clientKey + type: object + serviceAccount: + description: points to a service account that should be used for authentication + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - bearerToken + type: object + type: object + authRef: + description: |- + AuthRef references a Secret containing a kubeconfig. Same semantics as the + Kubernetes provider. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + resource: + description: Resource identifies the CRD by its API group, version and kind. + properties: + group: + description: |- + Group is the API group of the resource. Use "" (empty string) for core + Kubernetes resources such as ConfigMap; use e.g. "config.example.io" + for a CRD. The field is required to be present in the manifest — write + `group: ""` explicitly for core resources so typos fail at admission + time rather than later at discovery. + type: string + kind: + description: Kind is the Kubernetes resource kind (e.g. "MyCustomResource"). + minLength: 1 + type: string + version: + description: Version is the API version of the resource (e.g. "v1alpha1"). + minLength: 1 + type: string + required: + - group + - kind + - version + type: object + server: + description: |- + Server configures the Kubernetes API address and TLS trust, same as the + Kubernetes provider. When omitted, the URL defaults to the in-cluster API. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can be found in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + whitelist: + description: |- + Whitelist optionally restricts which object names and requested properties + are allowed to be read. + properties: + rules: + description: |- + Rules is a list of allow rules. If rules are set, at least one rule must + match for a request to be allowed. + items: + description: CRDProviderWhitelistRule defines a single allow rule for CRD reads. + properties: + name: + description: |- + Name is an optional regular expression matched against the bare object name. + For both SecretStore and ClusterSecretStore this is always the object name + without any namespace prefix (e.g. "my-db-spec", not "prod/my-db-spec"). + type: string + namespace: + description: |- + Namespace is an optional regular expression matched against the namespace of + the object. Applies only when a ClusterSecretStore is used; it is ignored + for SecretStore (where the namespace is fixed to the store namespace). + type: string + properties: + description: |- + Properties is an optional list of regular expressions matched against + requested property keys (for example: "spec.secretValue"). + items: + type: string + type: array + type: object + type: array + type: object + required: + - resource + type: object + x-kubernetes-validations: + - message: one of auth or authRef is required + rule: has(self.auth) || has(self.authRef) + - message: at most one of the fields in [auth authRef] may be set + rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() <= 1' delinea: description: |- Delinea DevOps Secrets Vault @@ -3357,6 +3753,9 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - clientCert + - clientKey type: object serviceAccount: description: points to a service account that should be used for authentication @@ -3417,6 +3816,8 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - bearerToken type: object type: object authRef: @@ -3460,7 +3861,7 @@ spec: format: byte type: string caProvider: - description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' properties: key: description: The key where the CA certificate can be found in the Secret or ConfigMap. @@ -4932,7 +5333,9 @@ spec: description: Domain is the secret server domain. type: string password: - description: Password is the secret server account password. + description: |- + Password is the secret server account password. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -4962,15 +5365,61 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) serverURL: description: |- ServerURL URL to your secret server installation type: string + token: + description: |- + Token is an access token used to authenticate to the secret server, + as an alternative to Username and Password. When set, Username and + Password are not required and are ignored. + properties: + secretRef: + description: SecretRef references a key in a secret that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a value without using a secret. + minLength: 1 + type: string + type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) username: - description: Username is the secret server account username. + description: |- + Username is the secret server account username. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -5000,13 +5449,18 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) required: - - password - serverURL - - username type: object + x-kubernetes-validations: + - message: either token, or both username and password, must be set + rule: has(self.token) || (has(self.username) && has(self.password)) senhasegura: description: Senhasegura configures this store to sync secrets using senhasegura provider properties: @@ -6434,8 +6888,14 @@ spec: type: object type: object refreshInterval: - description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config. - type: integer + anyOf: + - type: integer + - type: string + description: |- + Used to configure store refresh interval. Accepts either an integer number + of seconds (legacy) or a Go duration string such as "1h" or "5m". Empty or + 0 will default to the controller config. + x-kubernetes-int-or-string: true retrySettings: description: Used to configure HTTP retries on failures. properties: diff --git a/charts/external-secrets/templates/cert-controller-deployment.yaml b/charts/external-secrets/templates/cert-controller-deployment.yaml index 61f1023ae0..b354dabe26 100644 --- a/charts/external-secrets/templates/cert-controller-deployment.yaml +++ b/charts/external-secrets/templates/cert-controller-deployment.yaml @@ -115,11 +115,6 @@ spec: - containerPort: {{ .Values.certController.readinessProbe.port }} protocol: TCP name: ready - {{- if and .Values.certController.startupProbe.enabled (not .Values.certController.startupProbe.useReadinessProbePort) }} - - containerPort: {{ .Values.certController.startupProbe.port }} - protocol: TCP - name: startup - {{- end }} {{- if .Values.certController.livenessProbe.enabled }} livenessProbe: httpGet: @@ -145,14 +140,11 @@ spec: {{- if .Values.certController.startupProbe.enabled }} startupProbe: httpGet: - {{- if .Values.certController.startupProbe.useReadinessProbePort }} port: ready - {{- else }} - port: startup - {{- end }} path: /readyz - initialDelaySeconds: 20 - periodSeconds: 5 + initialDelaySeconds: {{ .Values.certController.startupProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.certController.startupProbe.periodSeconds }} + failureThreshold: {{ .Values.certController.startupProbe.failureThreshold }} {{- end }} {{- with .Values.certController.extraEnv }} env: diff --git a/charts/external-secrets/templates/cert-controller-networkpolicy.yaml b/charts/external-secrets/templates/cert-controller-networkpolicy.yaml new file mode 100644 index 0000000000..763d819f58 --- /dev/null +++ b/charts/external-secrets/templates/cert-controller-networkpolicy.yaml @@ -0,0 +1,28 @@ +{{- if .Values.certController.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ template "external-secrets.fullname" . }}-cert-controller-network-policy + namespace: {{ include "external-secrets.namespace" . }} + labels: + {{- include "external-secrets-cert-controller.labels" . | nindent 4 }} + {{- with .Values.certController.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + egress: + {{- with .Values.certController.networkPolicy.egress }} + {{- toYaml . | nindent 4 }} + {{- end }} + ingress: + {{- with .Values.certController.networkPolicy.ingress }} + {{- toYaml . | nindent 4 }} + {{- end }} + podSelector: + matchLabels: + {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + - Ingress +{{- end }} diff --git a/charts/external-secrets/templates/crds/clusterexternalsecret.yaml b/charts/external-secrets/templates/crds/clusterexternalsecret.yaml index 12fe2df303..7bb9e641d2 100644 --- a/charts/external-secrets/templates/crds/clusterexternalsecret.yaml +++ b/charts/external-secrets/templates/crds/clusterexternalsecret.yaml @@ -170,6 +170,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -418,6 +419,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -563,6 +565,7 @@ spec: - Orphan - Merge - None + - CreateOrMerge type: string deletionPolicy: default: Retain diff --git a/charts/external-secrets/templates/crds/clustergenerator.yaml b/charts/external-secrets/templates/crds/clustergenerator.yaml index 20ee1e6dbb..2419887b2e 100644 --- a/charts/external-secrets/templates/crds/clustergenerator.yaml +++ b/charts/external-secrets/templates/crds/clustergenerator.yaml @@ -849,6 +849,107 @@ spec: - auth - installID type: object + gitlabDeployTokenSpec: + description: GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token. + properties: + auth: + description: Auth configures how ESO authenticates with the GitLab API. + properties: + token: + description: |- + Token references a secret containing a GitLab access token (personal, group, or + project) with the api scope and at least the Maintainer role on the target. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + required: + - token + type: object + expiresAt: + description: |- + ExpiresAt is an optional expiry for the deploy token. If omitted the token does + not expire on the GitLab side and is revoked only when the generator state is + cleaned up (on regeneration or when the consuming ExternalSecret is deleted). + format: date-time + type: string + groupID: + description: |- + GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to + create the deploy token in. The generator URL-escapes paths before calling the + GitLab API, so do not pre-encode. Mutually exclusive with projectID. + minLength: 1 + type: string + name: + description: Name of the deploy token. + minLength: 1 + type: string + projectID: + description: |- + ProjectID is the numeric ID or unescaped path (e.g. group/project) of the + project to create the deploy token in. The generator URL-escapes paths before + calling the GitLab API, so do not pre-encode. Mutually exclusive with groupID. + minLength: 1 + type: string + scopes: + description: Scopes granted to the deploy token. At least one scope is required. + items: + description: GitlabDeployTokenScope is a scope that can be granted to a GitLab deploy token. + enum: + - read_repository + - read_registry + - write_registry + - read_package_registry + - write_package_registry + - read_virtual_registry + - write_virtual_registry + type: string + minItems: 1 + type: array + url: + description: URL configures the GitLab instance URL. Defaults to https://gitlab.com. + type: string + username: + description: |- + Username is an optional username for the deploy token. GitLab defaults it to + gitlab+deploy-token-{n} when omitted. + type: string + required: + - auth + - name + - scopes + type: object + x-kubernetes-validations: + - message: exactly one of projectID or groupID must be set + rule: has(self.projectID) != has(self.groupID) grafanaSpec: description: GrafanaSpec controls the behavior of the grafana generator. properties: @@ -922,6 +1023,13 @@ spec: See here for the documentation on basic roles offered by Grafana: https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/ type: string + secondsToLive: + description: |- + SecondsToLive is the number of seconds before the generated service account token will expire. + Some Grafana deployments (e.g. AWS Managed Grafana) require this value to be set. + format: int64 + minimum: 1 + type: integer required: - name - role @@ -2413,6 +2521,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey diff --git a/charts/external-secrets/templates/crds/clusterpushsecret.yaml b/charts/external-secrets/templates/crds/clusterpushsecret.yaml index 749278a483..3842a8bf8a 100644 --- a/charts/external-secrets/templates/crds/clusterpushsecret.yaml +++ b/charts/external-secrets/templates/crds/clusterpushsecret.yaml @@ -408,6 +408,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey diff --git a/charts/external-secrets/templates/crds/clustersecretstore.yaml b/charts/external-secrets/templates/crds/clustersecretstore.yaml index fb9e9521bf..9f7db33035 100644 --- a/charts/external-secrets/templates/crds/clustersecretstore.yaml +++ b/charts/external-secrets/templates/crds/clustersecretstore.yaml @@ -314,6 +314,38 @@ spec: type: string type: object type: object + serviceAccountRef: + description: |- + ServiceAccountRef specifies a Kubernetes ServiceAccount used for azure_ad + authentication on AKS Workload Identity. The operator obtains a federated + identity token from this ServiceAccount via the TokenRequest API instead + of using the ESO controller pod identity. Ignored for other access types. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object type: object caBundle: description: |- @@ -355,6 +387,11 @@ spec: - name - type type: object + ignoreCache: + description: |- + IgnoreCache bypasses the Gateway cache for secret reads when true. + Only relevant when akeylessGWApiURL points to an Akeyless Gateway. + type: boolean required: - akeylessGWApiURL - authSecretRef @@ -541,6 +578,7 @@ spec: enum: - SecretsManager - ParameterStore + - CertificateManager type: string sessionTags: description: AWS STS assume role session tags @@ -1444,6 +1482,8 @@ spec: properties: auth: description: Defines authentication settings for connecting to Conjur. + maxProperties: 1 + minProperties: 1 properties: apikey: description: Authenticates with Conjur using an API key. @@ -1512,6 +1552,80 @@ spec: - apiKeyRef - userRef type: object + cert: + description: Cert enables certificate-based authentication using a client certificate and key. + properties: + account: + description: Account is the Conjur organization account name. + type: string + clientCertRef: + description: |- + ClientCertRef is a reference to a specific 'key' containing the client certificate + within a Secret resource. The certificate must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKeyRef: + description: |- + ClientKeyRef is a reference to a specific 'key' containing the private RSA client key + within a Secret resource. The key must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + hostId: + description: Optional HostID for cert authentication (can be omitted when using 'spiffe' mode). + type: string + serviceID: + description: The conjur authn cert webservice id + type: string + required: + - account + - clientCertRef + - clientKeyRef + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. properties: @@ -1635,6 +1749,288 @@ spec: - auth - url type: object + crd: + description: |- + CRD configures this store to sync secrets from arbitrary Kubernetes resources, + including both custom resources (CRDs) and core API resources. Resources are + selected by API group, version and kind, where group can be "" (empty string) + for core resources such as ConfigMap. Reading the core v1 Secret is + intentionally blocked — use the Kubernetes provider for that. + properties: + auth: + description: |- + Auth configures authentication to the Kubernetes API, same as the + Kubernetes provider. Required when Server.URL is set (unless using AuthRef). + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKey: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientCert + - clientKey + type: object + serviceAccount: + description: points to a service account that should be used for authentication + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - bearerToken + type: object + type: object + authRef: + description: |- + AuthRef references a Secret containing a kubeconfig. Same semantics as the + Kubernetes provider. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + resource: + description: Resource identifies the CRD by its API group, version and kind. + properties: + group: + description: |- + Group is the API group of the resource. Use "" (empty string) for core + Kubernetes resources such as ConfigMap; use e.g. "config.example.io" + for a CRD. The field is required to be present in the manifest — write + `group: ""` explicitly for core resources so typos fail at admission + time rather than later at discovery. + type: string + kind: + description: Kind is the Kubernetes resource kind (e.g. "MyCustomResource"). + minLength: 1 + type: string + version: + description: Version is the API version of the resource (e.g. "v1alpha1"). + minLength: 1 + type: string + required: + - group + - kind + - version + type: object + server: + description: |- + Server configures the Kubernetes API address and TLS trust, same as the + Kubernetes provider. When omitted, the URL defaults to the in-cluster API. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can be found in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + whitelist: + description: |- + Whitelist optionally restricts which object names and requested properties + are allowed to be read. + properties: + rules: + description: |- + Rules is a list of allow rules. If rules are set, at least one rule must + match for a request to be allowed. + items: + description: CRDProviderWhitelistRule defines a single allow rule for CRD reads. + properties: + name: + description: |- + Name is an optional regular expression matched against the bare object name. + For both SecretStore and ClusterSecretStore this is always the object name + without any namespace prefix (e.g. "my-db-spec", not "prod/my-db-spec"). + type: string + namespace: + description: |- + Namespace is an optional regular expression matched against the namespace of + the object. Applies only when a ClusterSecretStore is used; it is ignored + for SecretStore (where the namespace is fixed to the store namespace). + type: string + properties: + description: |- + Properties is an optional list of regular expressions matched against + requested property keys (for example: "spec.secretValue"). + items: + type: string + type: array + type: object + type: array + type: object + required: + - resource + type: object + x-kubernetes-validations: + - message: one of auth or authRef is required + rule: has(self.auth) || has(self.authRef) + - message: at most one of the fields in [auth authRef] may be set + rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() <= 1' delinea: description: |- Delinea DevOps Secrets Vault @@ -3362,6 +3758,9 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - clientCert + - clientKey type: object serviceAccount: description: points to a service account that should be used for authentication @@ -3422,6 +3821,8 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - bearerToken type: object type: object authRef: @@ -3465,7 +3866,7 @@ spec: format: byte type: string caProvider: - description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' properties: key: description: The key where the CA certificate can be found in the Secret or ConfigMap. @@ -4937,7 +5338,9 @@ spec: description: Domain is the secret server domain. type: string password: - description: Password is the secret server account password. + description: |- + Password is the secret server account password. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -4967,15 +5370,61 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) serverURL: description: |- ServerURL URL to your secret server installation type: string + token: + description: |- + Token is an access token used to authenticate to the secret server, + as an alternative to Username and Password. When set, Username and + Password are not required and are ignored. + properties: + secretRef: + description: SecretRef references a key in a secret that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a value without using a secret. + minLength: 1 + type: string + type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) username: - description: Username is the secret server account username. + description: |- + Username is the secret server account username. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -5005,13 +5454,18 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) required: - - password - serverURL - - username type: object + x-kubernetes-validations: + - message: either token, or both username and password, must be set + rule: has(self.token) || (has(self.username) && has(self.password)) senhasegura: description: Senhasegura configures this store to sync secrets using senhasegura provider properties: @@ -6439,8 +6893,14 @@ spec: type: object type: object refreshInterval: - description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config. - type: integer + anyOf: + - type: integer + - type: string + description: |- + Used to configure store refresh interval. Accepts either an integer number + of seconds (legacy) or a Go duration string such as "1h" or "5m". Empty or + 0 will default to the controller config. + x-kubernetes-int-or-string: true retrySettings: description: Used to configure HTTP retries on failures. properties: diff --git a/charts/external-secrets/templates/crds/externalsecret.yaml b/charts/external-secrets/templates/crds/externalsecret.yaml index 835752bbf6..b7a03b4582 100644 --- a/charts/external-secrets/templates/crds/externalsecret.yaml +++ b/charts/external-secrets/templates/crds/externalsecret.yaml @@ -158,6 +158,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -406,6 +407,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey @@ -551,6 +553,7 @@ spec: - Orphan - Merge - None + - CreateOrMerge type: string deletionPolicy: default: Retain diff --git a/charts/external-secrets/templates/crds/gitlabdeploytoken.yaml b/charts/external-secrets/templates/crds/gitlabdeploytoken.yaml new file mode 100644 index 0000000000..0c959bf60a --- /dev/null +++ b/charts/external-secrets/templates/crds/gitlabdeploytoken.yaml @@ -0,0 +1,156 @@ +{{- if .Values.installCRDs }} +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + {{- with .Values.crds.annotations }} + {{- toYaml . | nindent 4}} + {{- end }} + {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }} + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook + {{- end }} + controller-gen.kubebuilder.io/version: v0.19.0 + labels: + external-secrets.io/component: controller + name: gitlabdeploytokens.generators.external-secrets.io +spec: + group: generators.external-secrets.io + names: + categories: + - external-secrets + - external-secrets-generators + kind: GitlabDeployToken + listKind: GitlabDeployTokenList + plural: gitlabdeploytokens + singular: gitlabdeploytoken + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: GitlabDeployToken generates a GitLab deploy token. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token. + properties: + auth: + description: Auth configures how ESO authenticates with the GitLab API. + properties: + token: + description: |- + Token references a secret containing a GitLab access token (personal, group, or + project) with the api scope and at least the Maintainer role on the target. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + required: + - token + type: object + expiresAt: + description: |- + ExpiresAt is an optional expiry for the deploy token. If omitted the token does + not expire on the GitLab side and is revoked only when the generator state is + cleaned up (on regeneration or when the consuming ExternalSecret is deleted). + format: date-time + type: string + groupID: + description: |- + GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to + create the deploy token in. The generator URL-escapes paths before calling the + GitLab API, so do not pre-encode. Mutually exclusive with projectID. + minLength: 1 + type: string + name: + description: Name of the deploy token. + minLength: 1 + type: string + projectID: + description: |- + ProjectID is the numeric ID or unescaped path (e.g. group/project) of the + project to create the deploy token in. The generator URL-escapes paths before + calling the GitLab API, so do not pre-encode. Mutually exclusive with groupID. + minLength: 1 + type: string + scopes: + description: Scopes granted to the deploy token. At least one scope is required. + items: + description: GitlabDeployTokenScope is a scope that can be granted to a GitLab deploy token. + enum: + - read_repository + - read_registry + - write_registry + - read_package_registry + - write_package_registry + - read_virtual_registry + - write_virtual_registry + type: string + minItems: 1 + type: array + url: + description: URL configures the GitLab instance URL. Defaults to https://gitlab.com. + type: string + username: + description: |- + Username is an optional username for the deploy token. GitLab defaults it to + gitlab+deploy-token-{n} when omitted. + type: string + required: + - auth + - name + - scopes + type: object + x-kubernetes-validations: + - message: exactly one of projectID or groupID must be set + rule: has(self.projectID) != has(self.groupID) + type: object + served: true + storage: true + subresources: + status: {} +{{- end }} diff --git a/charts/external-secrets/templates/crds/grafana.yaml b/charts/external-secrets/templates/crds/grafana.yaml index 45486e819d..ba03485b71 100644 --- a/charts/external-secrets/templates/crds/grafana.yaml +++ b/charts/external-secrets/templates/crds/grafana.yaml @@ -120,6 +120,13 @@ spec: See here for the documentation on basic roles offered by Grafana: https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/ type: string + secondsToLive: + description: |- + SecondsToLive is the number of seconds before the generated service account token will expire. + Some Grafana deployments (e.g. AWS Managed Grafana) require this value to be set. + format: int64 + minimum: 1 + type: integer required: - name - role diff --git a/charts/external-secrets/templates/crds/pushsecret.yaml b/charts/external-secrets/templates/crds/pushsecret.yaml index 8a888891bf..abefbdb509 100644 --- a/charts/external-secrets/templates/crds/pushsecret.yaml +++ b/charts/external-secrets/templates/crds/pushsecret.yaml @@ -340,6 +340,7 @@ spec: - Fake - GCRAccessToken - GithubAccessToken + - GitlabDeployToken - QuayAccessToken - Password - SSHKey diff --git a/charts/external-secrets/templates/crds/secretstore.yaml b/charts/external-secrets/templates/crds/secretstore.yaml index 952424d3d6..8c505d0f03 100644 --- a/charts/external-secrets/templates/crds/secretstore.yaml +++ b/charts/external-secrets/templates/crds/secretstore.yaml @@ -314,6 +314,38 @@ spec: type: string type: object type: object + serviceAccountRef: + description: |- + ServiceAccountRef specifies a Kubernetes ServiceAccount used for azure_ad + authentication on AKS Workload Identity. The operator obtains a federated + identity token from this ServiceAccount via the TokenRequest API instead + of using the ESO controller pod identity. Ignored for other access types. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object type: object caBundle: description: |- @@ -355,6 +387,11 @@ spec: - name - type type: object + ignoreCache: + description: |- + IgnoreCache bypasses the Gateway cache for secret reads when true. + Only relevant when akeylessGWApiURL points to an Akeyless Gateway. + type: boolean required: - akeylessGWApiURL - authSecretRef @@ -541,6 +578,7 @@ spec: enum: - SecretsManager - ParameterStore + - CertificateManager type: string sessionTags: description: AWS STS assume role session tags @@ -1444,6 +1482,8 @@ spec: properties: auth: description: Defines authentication settings for connecting to Conjur. + maxProperties: 1 + minProperties: 1 properties: apikey: description: Authenticates with Conjur using an API key. @@ -1512,6 +1552,80 @@ spec: - apiKeyRef - userRef type: object + cert: + description: Cert enables certificate-based authentication using a client certificate and key. + properties: + account: + description: Account is the Conjur organization account name. + type: string + clientCertRef: + description: |- + ClientCertRef is a reference to a specific 'key' containing the client certificate + within a Secret resource. The certificate must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKeyRef: + description: |- + ClientKeyRef is a reference to a specific 'key' containing the private RSA client key + within a Secret resource. The key must be PEM-encoded. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + hostId: + description: Optional HostID for cert authentication (can be omitted when using 'spiffe' mode). + type: string + serviceID: + description: The conjur authn cert webservice id + type: string + required: + - account + - clientCertRef + - clientKeyRef + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. properties: @@ -1635,6 +1749,288 @@ spec: - auth - url type: object + crd: + description: |- + CRD configures this store to sync secrets from arbitrary Kubernetes resources, + including both custom resources (CRDs) and core API resources. Resources are + selected by API group, version and kind, where group can be "" (empty string) + for core resources such as ConfigMap. Reading the core v1 Secret is + intentionally blocked — use the Kubernetes provider for that. + properties: + auth: + description: |- + Auth configures authentication to the Kubernetes API, same as the + Kubernetes provider. Required when Server.URL is set (unless using AuthRef). + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKey: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientCert + - clientKey + type: object + serviceAccount: + description: points to a service account that should be used for authentication + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - bearerToken + type: object + type: object + authRef: + description: |- + AuthRef references a Secret containing a kubeconfig. Same semantics as the + Kubernetes provider. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + resource: + description: Resource identifies the CRD by its API group, version and kind. + properties: + group: + description: |- + Group is the API group of the resource. Use "" (empty string) for core + Kubernetes resources such as ConfigMap; use e.g. "config.example.io" + for a CRD. The field is required to be present in the manifest — write + `group: ""` explicitly for core resources so typos fail at admission + time rather than later at discovery. + type: string + kind: + description: Kind is the Kubernetes resource kind (e.g. "MyCustomResource"). + minLength: 1 + type: string + version: + description: Version is the API version of the resource (e.g. "v1alpha1"). + minLength: 1 + type: string + required: + - group + - kind + - version + type: object + server: + description: |- + Server configures the Kubernetes API address and TLS trust, same as the + Kubernetes provider. When omitted, the URL defaults to the in-cluster API. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can be found in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + whitelist: + description: |- + Whitelist optionally restricts which object names and requested properties + are allowed to be read. + properties: + rules: + description: |- + Rules is a list of allow rules. If rules are set, at least one rule must + match for a request to be allowed. + items: + description: CRDProviderWhitelistRule defines a single allow rule for CRD reads. + properties: + name: + description: |- + Name is an optional regular expression matched against the bare object name. + For both SecretStore and ClusterSecretStore this is always the object name + without any namespace prefix (e.g. "my-db-spec", not "prod/my-db-spec"). + type: string + namespace: + description: |- + Namespace is an optional regular expression matched against the namespace of + the object. Applies only when a ClusterSecretStore is used; it is ignored + for SecretStore (where the namespace is fixed to the store namespace). + type: string + properties: + description: |- + Properties is an optional list of regular expressions matched against + requested property keys (for example: "spec.secretValue"). + items: + type: string + type: array + type: object + type: array + type: object + required: + - resource + type: object + x-kubernetes-validations: + - message: one of auth or authRef is required + rule: has(self.auth) || has(self.authRef) + - message: at most one of the fields in [auth authRef] may be set + rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() <= 1' delinea: description: |- Delinea DevOps Secrets Vault @@ -3362,6 +3758,9 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - clientCert + - clientKey type: object serviceAccount: description: points to a service account that should be used for authentication @@ -3422,6 +3821,8 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + required: + - bearerToken type: object type: object authRef: @@ -3465,7 +3866,7 @@ spec: format: byte type: string caProvider: - description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' properties: key: description: The key where the CA certificate can be found in the Secret or ConfigMap. @@ -4937,7 +5338,9 @@ spec: description: Domain is the secret server domain. type: string password: - description: Password is the secret server account password. + description: |- + Password is the secret server account password. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -4967,15 +5370,61 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) serverURL: description: |- ServerURL URL to your secret server installation type: string + token: + description: |- + Token is an access token used to authenticate to the secret server, + as an alternative to Username and Password. When set, Username and + Password are not required and are ignored. + properties: + secretRef: + description: SecretRef references a key in a secret that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a value without using a secret. + minLength: 1 + type: string + type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) username: - description: Username is the secret server account username. + description: |- + Username is the secret server account username. + Required unless Token is set. properties: secretRef: description: SecretRef references a key in a secret that will be used as value. @@ -5005,13 +5454,18 @@ spec: type: object value: description: Value can be specified directly to set a value without using a secret. + minLength: 1 type: string type: object + x-kubernetes-validations: + - message: exactly one of value or secretRef must be set + rule: has(self.value) != has(self.secretRef) required: - - password - serverURL - - username type: object + x-kubernetes-validations: + - message: either token, or both username and password, must be set + rule: has(self.token) || (has(self.username) && has(self.password)) senhasegura: description: Senhasegura configures this store to sync secrets using senhasegura provider properties: @@ -6439,8 +6893,14 @@ spec: type: object type: object refreshInterval: - description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config. - type: integer + anyOf: + - type: integer + - type: string + description: |- + Used to configure store refresh interval. Accepts either an integer number + of seconds (legacy) or a Go duration string such as "1h" or "5m". Empty or + 0 will default to the controller config. + x-kubernetes-int-or-string: true retrySettings: description: Used to configure HTTP retries on failures. properties: diff --git a/charts/external-secrets/templates/deployment.yaml b/charts/external-secrets/templates/deployment.yaml index a92e03c5ce..b5b958f418 100644 --- a/charts/external-secrets/templates/deployment.yaml +++ b/charts/external-secrets/templates/deployment.yaml @@ -76,6 +76,15 @@ spec: {{- if .Values.leaderElectionID }} - --leader-election-id={{ .Values.leaderElectionID }} {{- end }} + {{- if .Values.leaderElectionLeaseDuration }} + - --leader-election-lease-duration={{ .Values.leaderElectionLeaseDuration }} + {{- end }} + {{- if .Values.leaderElectionRenewDeadline }} + - --leader-election-renew-deadline={{ .Values.leaderElectionRenewDeadline }} + {{- end }} + {{- if .Values.leaderElectionRetryPeriod }} + - --leader-election-retry-period={{ .Values.leaderElectionRetryPeriod }} + {{- end }} {{- if or .Values.scopedNamespace .Values.scopedRBAC }} - --namespace={{ .Values.scopedNamespace | default .Release.Namespace }} {{- end }} diff --git a/charts/external-secrets/templates/networkpolicy.yaml b/charts/external-secrets/templates/networkpolicy.yaml new file mode 100644 index 0000000000..9819f22c63 --- /dev/null +++ b/charts/external-secrets/templates/networkpolicy.yaml @@ -0,0 +1,28 @@ +{{- if .Values.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ template "external-secrets.fullname" . }}-network-policy + namespace: {{ include "external-secrets.namespace" . }} + labels: + {{- include "external-secrets.labels" . | nindent 4 }} + {{- with .Values.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + egress: + {{- with .Values.networkPolicy.egress }} + {{- toYaml . | nindent 4 }} + {{- end }} + ingress: + {{- with .Values.networkPolicy.ingress }} + {{- toYaml . | nindent 4 }} + {{- end }} + podSelector: + matchLabels: + {{- include "external-secrets.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + - Ingress +{{- end }} diff --git a/charts/external-secrets/templates/rbac.yaml b/charts/external-secrets/templates/rbac.yaml index 8b5802c576..ecfdc8ceef 100644 --- a/charts/external-secrets/templates/rbac.yaml +++ b/charts/external-secrets/templates/rbac.yaml @@ -104,6 +104,7 @@ rules: - "fakes" - "gcraccesstokens" - "githubaccesstokens" + - "gitlabdeploytokens" - "quayaccesstokens" - "passwords" - "sshkeys" @@ -250,7 +251,9 @@ metadata: {{- if .Values.rbac.aggregateToEdit }} rbac.authorization.k8s.io/aggregate-to-edit: "true" {{- end }} + {{- if .Values.rbac.aggregateToAdmin }} rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- end }} rules: - apiGroups: - "external-secrets.io" @@ -283,6 +286,7 @@ rules: - "fakes" - "gcraccesstokens" - "githubaccesstokens" + - "gitlabdeploytokens" - "quayaccesstokens" - "passwords" - "sshkeys" @@ -313,7 +317,9 @@ metadata: {{- if .Values.rbac.aggregateToEdit }} rbac.authorization.k8s.io/aggregate-to-edit: "true" {{- end }} + {{- if .Values.rbac.aggregateToAdmin }} rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- end }} rules: - apiGroups: - "external-secrets.io" @@ -347,6 +353,7 @@ rules: - "fakes" - "gcraccesstokens" - "githubaccesstokens" + - "gitlabdeploytokens" - "quayaccesstokens" - "passwords" - "sshkeys" diff --git a/charts/external-secrets/templates/webhook-deployment.yaml b/charts/external-secrets/templates/webhook-deployment.yaml index 43c24d9be1..c3066c8595 100644 --- a/charts/external-secrets/templates/webhook-deployment.yaml +++ b/charts/external-secrets/templates/webhook-deployment.yaml @@ -132,6 +132,15 @@ spec: failureThreshold: {{ .Values.webhook.readinessProbe.failureThreshold }} successThreshold: {{ .Values.webhook.readinessProbe.successThreshold }} {{- end }} + {{- if .Values.webhook.startupProbe.enabled }} + startupProbe: + httpGet: + port: ready + path: /readyz + initialDelaySeconds: {{ .Values.webhook.startupProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.webhook.startupProbe.periodSeconds }} + failureThreshold: {{ .Values.webhook.startupProbe.failureThreshold }} + {{- end }} {{- with .Values.webhook.extraEnv }} env: {{- toYaml . | nindent 12 }} diff --git a/charts/external-secrets/templates/webhook-networkpolicy.yaml b/charts/external-secrets/templates/webhook-networkpolicy.yaml new file mode 100644 index 0000000000..1e5fedcf99 --- /dev/null +++ b/charts/external-secrets/templates/webhook-networkpolicy.yaml @@ -0,0 +1,28 @@ +{{- if .Values.webhook.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ template "external-secrets.fullname" . }}-webhook-network-policy + namespace: {{ include "external-secrets.namespace" . }} + labels: + {{- include "external-secrets-webhook.labels" . | nindent 4 }} + {{- with .Values.webhook.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + egress: + {{- with .Values.webhook.networkPolicy.egress }} + {{- toYaml . | nindent 4 }} + {{- end }} + ingress: + {{- with .Values.webhook.networkPolicy.ingress }} + {{- toYaml . | nindent 4 }} + {{- end }} + podSelector: + matchLabels: + {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + - Ingress +{{- end }} diff --git a/charts/external-secrets/values.schema.json b/charts/external-secrets/values.schema.json index 720be1c368..7a31c7f40d 100644 --- a/charts/external-secrets/values.schema.json +++ b/charts/external-secrets/values.schema.json @@ -167,6 +167,42 @@ } } }, + "networkPolicy": { + "type": "object", + "properties": { + "egress": { + "type": "array" + }, + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ports": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": [ + "string", + "integer" + ] + }, + "protocol": { + "type": "string" + } + } + } + } + } + } + } + } + }, "nodeSelector": { "type": "object" }, @@ -321,11 +357,14 @@ "enabled": { "type": "boolean" }, - "port": { - "type": "string" + "failureThreshold": { + "type": "integer" }, - "useReadinessProbePort": { - "type": "boolean" + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" } } }, @@ -545,6 +584,15 @@ "leaderElectionID": { "type": "string" }, + "leaderElectionLeaseDuration": { + "type": "string" + }, + "leaderElectionRenewDeadline": { + "type": "string" + }, + "leaderElectionRetryPeriod": { + "type": "string" + }, "livenessProbe": { "type": "object", "properties": { @@ -662,6 +710,42 @@ "namespaceOverride": { "type": "string" }, + "networkPolicy": { + "type": "object", + "properties": { + "egress": { + "type": "array" + }, + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ports": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": [ + "string", + "integer" + ] + }, + "protocol": { + "type": "string" + } + } + } + } + } + } + } + } + }, "nodeSelector": { "type": "object" }, @@ -726,6 +810,9 @@ "rbac": { "type": "object", "properties": { + "aggregateToAdmin": { + "type": "boolean" + }, "aggregateToEdit": { "type": "boolean" }, @@ -1155,6 +1242,42 @@ } } }, + "networkPolicy": { + "type": "object", + "properties": { + "egress": { + "type": "array" + }, + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ports": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": [ + "string", + "integer" + ] + }, + "protocol": { + "type": "string" + } + } + } + } + } + } + } + } + }, "nodeSelector": { "type": "object" }, @@ -1318,6 +1441,23 @@ } } }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + } + } + }, "strategy": { "type": "object" }, diff --git a/charts/external-secrets/values.yaml b/charts/external-secrets/values.yaml index 3f246fab31..e4ebff8a80 100644 --- a/charts/external-secrets/values.yaml +++ b/charts/external-secrets/values.yaml @@ -96,6 +96,24 @@ leaderElect: false # @default -- "external-secrets-controller" leaderElectionID: "" +# -- Duration that non-leader candidates will wait to force acquire leadership. +# Increase this along with renewDeadline to tolerate a busy or briefly unavailable API server +# (for example during control plane maintenance) without churning leadership. +# Leave empty to use the controller default ('15s'). +# @default -- "15s" +leaderElectionLeaseDuration: "" + +# -- Duration that the acting leader will retry refreshing leadership before giving up. +# Must be less than leaderElectionLeaseDuration. +# Leave empty to use the controller default ('10s'). +# @default -- "10s" +leaderElectionRenewDeadline: "" + +# -- Duration the leader election client waits between tries of actions. +# Leave empty to use the controller default ('2s'). +# @default -- "2s" +leaderElectionRetryPeriod: "" + # -- If set external secrets will filter matching # Secret Stores with the appropriate controller values. controllerClass: "" @@ -215,6 +233,9 @@ rbac: # -- Specifies whether permissions are aggregated to the edit ClusterRole aggregateToEdit: true + # -- Specifies whether permissions are aggregated to the admin ClusterRole + aggregateToAdmin: true + ## -- Extra environment variables to add to container. extraEnv: [] @@ -440,6 +461,27 @@ hostNetwork: false # @schema type: [boolean, null] hostUsers: +# -- Setup a networkPolicy for external-secrets +networkPolicy: + # -- Specifies whether the networkPolicy should be created. + enabled: false + # -- The ingress traffic + # Should match the health and (optionally) metrics port + ingress: + - ports: + - protocol: TCP + # @schema type: [string, integer] + port: 8080 # metrics port + - protocol: TCP + # @schema type: [string, integer] + port: 8082 # health port + # -- The egress traffic + # The minimum egress ports required to function are: + # DNS (53/udp, 53/tcp) + # API server (80/tcp, 443/tcp, or 6443/tcp) + # You will need to customize this value to meet your needs + egress: [] + webhook: # -- Annotations to place on validating webhook configuration. annotations: {} @@ -465,6 +507,31 @@ webhook: # -- (bool) Specifies if webhook pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33. # @schema type: [boolean, null] hostUsers: + + # -- Setup a networkPolicy for external-secrets webhook + networkPolicy: + # -- Specifies whether the networkPolicy should be created. + enabled: false + # -- The ingress traffic + # Should match the webhook, health, and (optionally) metrics port + ingress: + - ports: + - protocol: TCP + # @schema type: [string, integer] + port: 8080 # metrics port + - protocol: TCP + # @schema type: [string, integer] + port: 8081 # health port + - protocol: TCP + # @schema type: [string, integer] + port: 10250 # webhook port + # -- The egress traffic + # The minimum egress ports required to function are: + # DNS (53/udp, 53/tcp) + # API server (80/tcp, 443/tcp, or 6443/tcp) + # You will need to customize this value to meet your needs + egress: [] + image: repository: ghcr.io/external-secrets/external-secrets pullPolicy: IfNotPresent @@ -609,6 +676,16 @@ webhook: successThreshold: 1 initialDelaySeconds: 20 + startupProbe: + # -- Enabled determines if the startup probe should be used or not. By default it's disabled. + enabled: false + # -- Number of seconds after the container has started before the startup probe is initiated. + initialDelaySeconds: 10 + # -- How often (in seconds) to perform the startup probe. + periodSeconds: 10 + # -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds. + failureThreshold: 30 + ## -- Extra environment variables to add to container. extraEnv: [] @@ -724,6 +801,27 @@ certController: # @schema type: [boolean, null] hostUsers: + # -- Setup a networkPolicy for external-secrets certController + networkPolicy: + # -- Specifies whether the networkPolicy should be created. + enabled: false + # -- The ingress traffic + # Should match the health and (optionally) metrics port + ingress: + - ports: + - protocol: TCP + # @schema type: [string, integer] + port: 8080 # metrics port + - protocol: TCP + # @schema type: [string, integer] + port: 8081 # health port + # -- The egress traffic + # The minimum egress ports required to function are: + # DNS (53/udp, 53/tcp) + # API server (80/tcp, 443/tcp, or 6443/tcp) + # You will need to customize this value to meet your needs + egress: [] + # -- Pod priority class name. priorityClassName: "" @@ -785,12 +883,14 @@ certController: initialDelaySeconds: 20 startupProbe: - # -- Enabled determines if the startup probe should be used or not. By default it's enabled + # -- Enabled determines if the startup probe should be used or not. By default it's disabled. enabled: false - # -- whether to use the readiness probe port for startup probe. - useReadinessProbePort: true - # -- Port for startup probe. - port: "" + # -- Number of seconds after the container has started before the startup probe is initiated. + initialDelaySeconds: 10 + # -- How often (in seconds) to perform the startup probe. + periodSeconds: 10 + # -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds. + failureThreshold: 30 ## -- Extra environment variables to add to container. extraEnv: []