feat(obj): source linode accessKeyId from obj-secrets

src/common/obj-secret-paths.test.ts

@@ -0,0 +1,13 @@
+import { getSchemaSecretsPaths } from './utils'
+
+describe('object storage credential paths', () => {
+  it('should classify both halves of the linode credential as secrets', async () => {
+    // Linode OBJ keys rotate as a pair, so the id has to travel the same route as its secret half:
+    // into obj-secrets, out via ExternalSecret. Keeping the id in git settings forces a values-repo
+    // write on every rotation just to keep the pair together.
+    const secretPaths = await getSchemaSecretsPaths([])
+
+    expect(secretPaths).toContain('obj.provider.linode.accessKeyId')
+    expect(secretPaths).toContain('obj.provider.linode.secretAccessKey')
+  })
+})

tests/fixtures/env/manifests/namespaces/apl-secrets/sealedsecrets/obj-secrets.yaml

@@ -7,6 +7,7 @@ metadata:
   namespace: apl-secrets
 spec:
   encryptedData:
+    provider_linode_accessKeyId: someaccessKeyId
     provider_linode_secretAccessKey: somesecretvalue
   template:
     immutable: false

tests/fixtures/env/settings/obj.yaml

@@ -4,7 +4,6 @@ metadata:
 spec:
     provider:
         linode:
-            accessKeyId: someaccessKeyId
             buckets:
                 cnpg: my-clusterid-cnpg
                 gitea: my-clusterid-gitea

values-schema.yaml

@@ -2897,6 +2897,7 @@ properties:
                 type: string
                 description: The ID of the access key
                 $ref: '#/definitions/wordCharacterPattern'
+                x-secret: ''
               secretAccessKey:
                 type: string
                 description: The secret of the access key

values/gitea/gitea-raw.gotmpl

@@ -61,9 +61,13 @@ resources:
       template:
         type: Opaque
         data:
-          S3_STORAGE_ACCOUNT: {{ $obj.linode.accessKeyId }}
+          S3_STORAGE_ACCOUNT: '{{ "{{ .accessKeyId | toString }}" }}'
           S3_STORAGE_KEY: '{{ "{{ .secretAccessKey | toString }}" }}'
     data:
+      - secretKey: accessKeyId
+        remoteRef:
+          key: obj-secrets
+          property: provider_linode_accessKeyId
       - secretKey: secretAccessKey
         remoteRef:
           key: obj-secrets

values/harbor/harbor-raw.gotmpl

@@ -207,9 +207,13 @@ resources:
       template:
         type: Opaque
         data:
-          S3_STORAGE_ACCOUNT: {{ $obj.linode.accessKeyId }}
+          S3_STORAGE_ACCOUNT: '{{ "{{ .accessKeyId | toString }}" }}'
           S3_STORAGE_KEY: '{{ "{{ .secretAccessKey | toString }}" }}'
     data:
+      - secretKey: accessKeyId
+        remoteRef:
+          key: obj-secrets
+          property: provider_linode_accessKeyId
       - secretKey: secretAccessKey
         remoteRef:
           key: obj-secrets
@@ -229,9 +233,13 @@ resources:
       template:
         type: Opaque
         data:
-          REGISTRY_STORAGE_S3_ACCESSKEY: {{ $obj.linode.accessKeyId }}
+          REGISTRY_STORAGE_S3_ACCESSKEY: '{{ "{{ .accessKeyId | toString }}" }}'
           REGISTRY_STORAGE_S3_SECRETKEY: '{{ "{{ .secretAccessKey | toString }}" }}'
     data:
+      - secretKey: accessKeyId
+        remoteRef:
+          key: obj-secrets
+          property: provider_linode_accessKeyId
       - secretKey: secretAccessKey
         remoteRef:
           key: obj-secrets

values/keycloak/keycloak-raw.gotmpl

@@ -48,9 +48,13 @@ resources:
       template:
         type: Opaque
         data:
-          S3_STORAGE_ACCOUNT: {{ $obj.linode.accessKeyId }}
+          S3_STORAGE_ACCOUNT: '{{ "{{ .accessKeyId | toString }}" }}'
           S3_STORAGE_KEY: '{{ "{{ .secretAccessKey | toString }}" }}'
     data:
+      - secretKey: accessKeyId
+        remoteRef:
+          key: obj-secrets
+          property: provider_linode_accessKeyId
       - secretKey: secretAccessKey
         remoteRef:
           key: obj-secrets

values/kubeflow-pipelines/kubeflow-pipelines-raw.gotmpl

@@ -41,9 +41,13 @@ resources:
         template:
           type: Opaque
           data:
-            accesskey: {{ $obj.linode.accessKeyId }}
+            accesskey: '{{ "{{ .accessKeyId | toString }}" }}'
             secretkey: '{{ "{{ .secretAccessKey | toString }}" }}'
       data:
+        - secretKey: accessKeyId
+          remoteRef:
+            key: obj-secrets
+            property: provider_linode_accessKeyId
         - secretKey: secretAccessKey
           remoteRef:
             key: obj-secrets

values/loki/loki-raw.gotmpl

@@ -62,9 +62,13 @@ resources:
         template:
           type: Opaque
           data:
-            AWS_ACCESS_KEY_ID: {{ $obj.linode.accessKeyId }}
+            AWS_ACCESS_KEY_ID: '{{ "{{ .accessKeyId | toString }}" }}'
             AWS_SECRET_ACCESS_KEY: '{{ "{{ .secretAccessKey | toString }}" }}'
       data:
+        - secretKey: accessKeyId
+          remoteRef:
+            key: obj-secrets
+            property: provider_linode_accessKeyId
         - secretKey: secretAccessKey
           remoteRef:
             key: obj-secrets