Skip to content

Commit 659eba2

Browse files
rousopouloskrousopoulosk
authored
Merge pull request #17 from Workable/upgrade
Upgrade
2 parents 07c42e1 + cb6e5ce commit 659eba2

File tree

161 files changed

+12410
-1444
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

161 files changed

+12410
-1444
lines changed

‎.github/pull_request_template.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Problem Statement
2+
3+
What is the problem you're trying to solve?
4+
5+
## Related Issue
6+
7+
Fixes #...
8+
9+
## Proposed Changes
10+
11+
How do you like to solve the issue and why?
12+
13+
## Checklist
14+
15+
- [ ] I have read the [contribution guidelines](https://external-secrets.io/latest/contributing/process/#submitting-a-pull-request)
16+
- [ ] All commits are signed with `git commit --signoff`
17+
- [ ] My changes have reasonable test coverage
18+
- [ ] All tests pass with `make test`
19+
- [ ] I ensured my PR is ready for review with `make reviewable`

‎.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ jobs:
185185
build-platform: "linux/amd64,linux/arm64"
186186
tag-suffix: "-ubi"
187187
- dockerfile: "Dockerfile.ubi"
188-
build-args: "CGO_ENABLED=1 GOEXPERIMENT=boringcrypto"
188+
build-args: "CGO_ENABLED=0 GOEXPERIMENT=boringcrypto"
189189
build-arch: "amd64"
190190
build-platform: "linux/amd64"
191191
tag-suffix: "-ubi-boringssl"

‎.github/workflows/e2e-managed.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ permissions:
1010
env:
1111
# Common versions
1212
GO_VERSION: '1.19'
13-
GINKGO_VERSION: 'v2.1.6'
13+
GINKGO_VERSION: 'v2.8.0'
1414
DOCKER_BUILDX_VERSION: 'v0.4.2'
1515

1616
# Common users. We can't run a step 'if secrets.GHCR_USERNAME != ""' but we can run

‎.github/workflows/e2e.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ name: e2e tests
1414
env:
1515
# Common versions
1616
GO_VERSION: '1.19'
17-
GINKGO_VERSION: 'v2.1.6'
17+
GINKGO_VERSION: 'v2.8.0'
1818
DOCKER_BUILDX_VERSION: 'v0.4.2'
1919
KIND_VERSION: 'v0.17.0'
2020
KIND_IMAGE: 'kindest/node:v1.26.0'
@@ -36,7 +36,11 @@ env:
3636
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET}}
3737
TENANT_ID: ${{ secrets.TENANT_ID}}
3838
VAULT_URL: ${{ secrets.VAULT_URL}}
39-
39+
SCALEWAY_API_URL: ${{ secrets.SCALEWAY_API_URL }}
40+
SCALEWAY_REGION: ${{ secrets.SCALEWAY_REGION }}
41+
SCALEWAY_PROJECT_ID: ${{ secrets.SCALEWAY_PROJECT_ID }}
42+
SCALEWAY_ACCESS_KEY: ${{ secrets.SCALEWAY_ACCESS_KEY }}
43+
SCALEWAY_SECRET_KEY: ${{ secrets.SCALEWAY_SECRET_KEY }}
4044

4145
jobs:
4246

‎.github/workflows/helm.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,25 @@ jobs:
4343
if [[ -n "$changed" ]]; then
4444
echo "::set-output name=changed::true"
4545
fi
46+
- name: Install chart unittest
47+
run: |
48+
helm env
49+
helm plugin install https://github.com/helm-unittest/helm-unittest
4650
- name: Run chart-testing (lint)
4751
run: ct lint --config=.github/ci/ct.yaml
4852

53+
- name: Create kind cluster
54+
uses: helm/[email protected]
55+
if: steps.list-changed.outputs.changed == 'true'
56+
57+
- name: Run chart-testing (install)
58+
run: ct install --config=.github/ci/ct.yaml --charts deploy/charts/external-secrets
59+
if: steps.list-changed.outputs.changed == 'true'
60+
61+
- name: Run unitests
62+
if: steps.list-changed.outputs.changed == 'true'
63+
run: make helm.test
64+
4965
release:
5066
runs-on: ubuntu-latest
5167
steps:

‎.github/workflows/rebuild-image.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ jobs:
4646
build-args: "CGO_ENABLED=0"
4747
build-arch: "amd64 arm64"
4848
build-platform: "linux/amd64,linux/arm64"
49-
tag-suffix: "-ubi-${{ needs.checkout.outputs.timestamp }}" #ubi
49+
tag-suffix: "-ubi-${{ needs.checkout.outputs.timestamp }}" # ubi
5050
- dockerfile: "Dockerfile.ubi"
51-
build-args: "CGO_ENABLED=1 GOEXPERIMENT=boringcrypto" # fips
51+
build-args: "CGO_ENABLED=0 GOEXPERIMENT=boringcrypto" # fips
5252
build-arch: "amd64"
5353
build-platform: "linux/amd64"
5454
tag-suffix: "-ubi-boringssl-${{ needs.checkout.outputs.timestamp }}"

‎.github/workflows/stale.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,6 @@ jobs:
1313
stale-issue-message: 'This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.'
1414
stale-pr-message: 'This pr is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.'
1515
close-issue-message: 'This issue was closed because it has been stalled for 30 days with no activity.'
16+
exempt-issue-labels: kind/feature
1617
days-before-stale: 90
1718
days-before-close: 30

‎Dockerfile.standalone

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# This version of Dockerfile is for building without external dependencies.
22
# Build a multi-platform image e.g. `docker buildx build --push --platform linux/arm64,linux/amd64 --tag external-secrets:dev --file Dockerfile.standalone .`
3-
FROM golang:1.19.5-alpine AS builder
3+
FROM golang:1.20.2-alpine AS builder
44
ARG TARGETOS
55
ARG TARGETARCH
66
ENV CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH}

‎Makefile

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,12 @@ check-diff: reviewable ## Ensure branch is clean.
8181
@test -z "$$(git status --porcelain)" || (echo "$$(git status --porcelain)" && $(FAIL))
8282
@$(OK) branch is clean
8383

84+
update-deps:
85+
go get -u
86+
cd e2e && go get -u
87+
@go mod tidy
88+
@cd e2e/ && go mod tidy
89+
8490
# ====================================================================================
8591
# Golang
8692

@@ -179,6 +185,22 @@ helm.generate:
179185
./hack/helm.generate.sh $(BUNDLE_DIR) $(HELM_DIR)
180186
@$(OK) Finished generating helm chart files
181187

188+
helm.test: helm.generate
189+
@helm unittest --file tests/*.yaml --file 'tests/**/*.yaml' deploy/charts/external-secrets/
190+
191+
helm.test.update: helm.generate
192+
@helm unittest -u --file tests/*.yaml --file 'tests/**/*.yaml' deploy/charts/external-secrets/
193+
194+
helm.update.appversion:
195+
@chartversion=$$(yq .version ./deploy/charts/external-secrets/Chart.yaml) ; \
196+
chartappversion=$$(yq .appVersion ./deploy/charts/external-secrets/Chart.yaml) ; \
197+
chartname=$$(yq .name ./deploy/charts/external-secrets/Chart.yaml) ; \
198+
$(INFO) Update chartname and chartversion string in test snapshots.; \
199+
sed -s -i "s/^\([[:space:]]\+helm\.sh\/chart:\).*/\1 $${chartname}-$${chartversion}/" ./deploy/charts/external-secrets/tests/__snapshot__/*.yaml.snap ; \
200+
sed -s -i "s/^\([[:space:]]\+app\.kubernetes\.io\/version:\).*/\1 $${chartappversion}/" ./deploy/charts/external-secrets/tests/__snapshot__/*.yaml.snap ; \
201+
sed -s -i "s/^\([[:space:]]\+image: ghcr\.io\/external-secrets\/external-secrets:\).*/\1$${chartappversion}/" ./deploy/charts/external-secrets/tests/__snapshot__/*.yaml.snap ; \
202+
$(OK) "Version strings updated"
203+
182204
# ====================================================================================
183205
# Documentation
184206
.PHONY: docs

‎apis/externalsecrets/v1alpha1/secretstore_akeyless_types.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,16 @@ type AkeylessProvider struct {
2626

2727
// Auth configures how the operator authenticates with Akeyless.
2828
Auth *AkeylessAuth `json:"authSecretRef"`
29+
30+
// PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
31+
// if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
32+
// are used to validate the TLS connection.
33+
// +optional
34+
CABundle []byte `json:"caBundle,omitempty"`
35+
36+
// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
37+
// +optional
38+
CAProvider *CAProvider `json:"caProvider,omitempty"`
2939
}
3040

3141
type AkeylessAuth struct {

‎apis/externalsecrets/v1alpha1/zz_generated.deepcopy.go

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/externalsecrets/v1beta1/provider.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import (
2121
)
2222

2323
const (
24-
// Ready indicates that the client is confgured correctly
24+
// Ready indicates that the client is configured correctly
2525
// and can be used.
2626
ValidationResultReady ValidationResult = iota
2727

‎apis/externalsecrets/v1beta1/secretstore_akeyless_types.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,16 @@ type AkeylessProvider struct {
2626

2727
// Auth configures how the operator authenticates with Akeyless.
2828
Auth *AkeylessAuth `json:"authSecretRef"`
29+
30+
// PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
31+
// if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
32+
// are used to validate the TLS connection.
33+
// +optional
34+
CABundle []byte `json:"caBundle,omitempty"`
35+
36+
// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
37+
// +optional
38+
CAProvider *CAProvider `json:"caProvider,omitempty"`
2939
}
3040

3141
type AkeylessAuth struct {

‎apis/externalsecrets/v1beta1/secretstore_keepersecurity_types.go

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
*/
14+
15+
package v1beta1
16+
17+
import smmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
18+
19+
// KeeperSecurityProvider Configures a store to sync secrets using Keeper Security.
20+
type KeeperSecurityProvider struct {
21+
Auth smmeta.SecretKeySelector `json:"authRef"`
22+
FolderID string `json:"folderID"`
23+
}

‎apis/externalsecrets/v1beta1/secretstore_scaleway_types.go

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
*/
14+
15+
package v1beta1
16+
17+
import esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
18+
19+
type ScalewayProviderSecretRef struct {
20+
21+
// Value can be specified directly to set a value without using a secret.
22+
// +optional
23+
Value string `json:"value,omitempty"`
24+
25+
// SecretRef references a key in a secret that will be used as value.
26+
// +optional
27+
SecretRef *esmeta.SecretKeySelector `json:"secretRef,omitempty"`
28+
}
29+
30+
type ScalewayProvider struct {
31+
32+
// APIURL is the url of the api to use. Defaults to https://api.scaleway.com
33+
// +optional
34+
APIURL string `json:"apiUrl,omitempty"`
35+
36+
// Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone
37+
Region string `json:"region"`
38+
39+
// ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings
40+
ProjectID string `json:"projectId"`
41+
42+
// AccessKey is the non-secret part of the api key.
43+
AccessKey *ScalewayProviderSecretRef `json:"accessKey"`
44+
45+
// SecretKey is the non-secret part of the api key.
46+
SecretKey *ScalewayProviderSecretRef `json:"secretKey"`
47+
}

‎apis/externalsecrets/v1beta1/secretstore_types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,17 @@ type SecretStoreProvider struct {
121121
// +optional
122122
Senhasegura *SenhaseguraProvider `json:"senhasegura,omitempty"`
123123

124+
// Scaleway
125+
// +optional
126+
Scaleway *ScalewayProvider `json:"scaleway,omitempty"`
127+
124128
// Doppler configures this store to sync secrets using the Doppler provider
125129
// +optional
126130
Doppler *DopplerProvider `json:"doppler,omitempty"`
131+
132+
// KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
133+
// +optional
134+
KeeperSecurity *KeeperSecurityProvider `json:"keepersecurity,omitempty"`
127135
}
128136

129137
type CAProviderType string

0 commit comments

Comments
 (0)