1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
Commit graph

685 commits

Author SHA1 Message Date
Shuhei Kitagawa
150e3dfde1
Use locks for GCP PushSecrets (#2678)
* Use locks for GCP PushSecrets

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Share locks among providers

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-09-21 17:15:16 +02:00
Markus Lackner
a025b77e49
fix: do not recreate secret if deletion timestamp is set (#2718)
Signed-off-by: Markus Lackner <33040521+markuslackner@users.noreply.github.com>
2023-09-20 23:21:47 +02:00
Moritz Johner
9559c2a124
fix: ensure to correctly encode binary data as base64 (#2681)
Also disable HTML escape.

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-09-15 19:34:53 +02:00
Moritz Johner
b78ce75218
fix: do not swallow errors when create or update fails (#2693)
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-09-15 06:21:34 +02:00
Alexander Kurata
e85b76f1d3
Convert IBM auth struct fields to pointers (#2669)
* Convert SecretStore IBMAuth contents to struct pointers

Signed-off-by: akurata <akurata100@gmail.com>

* update ibm provider logic + tests

Signed-off-by: akurata <akurata100@gmail.com>

* refactor ibm provider validatestore to reduce complexity

Signed-off-by: akurata <akurata100@gmail.com>

* update ibm provider container auth profile check to return an error for a missing profile def

Signed-off-by: akurata <akurata100@gmail.com>

---------

Signed-off-by: akurata <akurata100@gmail.com>
Co-authored-by: Alex Kurata <alexander.kurata@ibm.com>
2023-09-05 12:03:49 +02:00
Florent Viel
012ece2b15
Refacto scaleway provider (#2667)
* replace API calls by ListSecrets

Scalewaw will deprecate soon the Secret Manager endpoints *ByName, the
idea is to use the ListSecrets instead and to filter by name

Signed-off-by: Florent Viel <fviel@scaleway.com>

* allow to filter by name for the fake scw secret api

Signed-off-by: Florent Viel <fviel@scaleway.com>

* improve scaleway fake api

Signed-off-by: Florent Viel <fviel@scaleway.com>

the fake implementation of the ListSecrets for the Scaleway API was too
naive and returns too many secrets based on the input filters

* scaleway: fix calls to the ListSecrets endpoint

Signed-off-by: Florent Viel <fviel@scaleway.com>

* scaleway: fix lint issues

Signed-off-by: Florent Viel <fviel@scaleway.com>

---------

Signed-off-by: Florent Viel <fviel@scaleway.com>
2023-09-04 20:01:38 +02:00
Shuhei Kitagawa
da85f80d97
Support PushSecret metadata (#2600)
* Support PushSecret metadata

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Refactor GCP PushSecret

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-28 23:50:21 +02:00
Shuhei Kitagawa
005fb4d123
Report not ready when no namespace matches (#2582)
* Report not ready when no namespace matches

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Fix flaky a test

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Simplify ClusterExternalSecret status

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-28 12:03:57 +02:00
Moritz Johner
97df83b518
chore: bump dependencies (#2654)
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-08-28 11:50:46 +02:00
Alexandre Gaudreault
21928a45b9
fix(externalsecret): infinite reconcile loop with Merge secret (#2525)
* fix(externalsecret): infinite reconcile loop with Merge secret

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* code review

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* lint

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* add unit tests

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* lint

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* Use objectHash instead of value

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

---------

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>
2023-08-28 11:46:38 +02:00
Andrea Stacchiotti
b50415edf0
Introduce RetrySettings support for Hashicorp Vault (#2528)
* Ensure use of BuildKit in the Docker builds

The builds rely on `TARGETOS` and `TARGETARCH` being set, which is
automatically accomplished by the new builder.

Add the explicit envvar selector in the Makefile, until most users
update to docker 23+.

Signed-off-by: Andrea Stacchiotti <andreastacchiotti@gmail.com>

* Update docker build command in developer guide

Signed-off-by: Andrea Stacchiotti <andreastacchiotti@gmail.com>

* Introduce RetrySettings support for Hashicorp Vault

Leave default retries to 0 (not the default of the vault sdk of 2),
as this was decided in abec2a64cc .

Signed-off-by: Andrea Stacchiotti <andreastacchiotti@gmail.com>

---------

Signed-off-by: Andrea Stacchiotti <andreastacchiotti@gmail.com>
2023-08-28 11:45:27 +02:00
Shuhei Kitagawa
d5271d0dab
Delete old ClusterExternalSecrets when name changed (#2601)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-25 20:44:01 +02:00
Shuhei Kitagawa
6afdba88c9
Remove metrics when a resource has been deleted (#2576)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-24 21:57:34 +02:00
Shuhei Kitagawa
3164df0c08
Stop ignoring ExternalSecret reconciliation error (#2583)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-24 20:51:16 +02:00
Shuhei Kitagawa
57dece9b7a
Stop using builder.OnlyMetadata for ExternalSecrets (#2626)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-24 19:28:29 +02:00
Shuhei Kitagawa
ba1caed791
Fix a ClusterExternalSecret flaky test (#2641)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-24 19:28:15 +02:00
Gustavo Fernandes de Carvalho
77a70d08fa
fixing label limits (#2645)
Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>
2023-08-23 13:16:16 -03:00
Shanti G
75726582ad
convert the fetched secret to map to access the properties (#2637)
Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
Co-authored-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
2023-08-22 16:19:25 +03:00
Shuhei Kitagawa
851e6ff66c
Set builder.OnlyMetadata back for Secrets (#2625)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-22 08:05:23 +09:00
Shanti G
bccb12c8ff
handle special case for imported cert secret type (#2629)
Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
Co-authored-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
2023-08-21 11:07:59 +03:00
Gustavo Fernandes de Carvalho
6319977e63
Fixing when orphaned secret deletion when target.Name is not set (#2609)
* Fixing  when orphaned secret deletion when target.Name is not set

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Linting

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Fixing e2e tests

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

---------

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>
2023-08-15 07:26:00 -03:00
Gustavo Fernandes de Carvalho
ad111cc180
Fix orphaned secrets logic with CreationPolicy=Merge (#2587)
* Fix orphaned secrets logic with CreationPolicy=Merge

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Fix lint

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

---------

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>
2023-08-14 20:44:30 -03:00
Shanti G
45cf966ce2
convert the fetched secret to map to access the properties (#2603)
Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
Co-authored-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com>
2023-08-14 06:51:48 +03:00
Idan Adar
872ded2290
Revert "convert the fetched secret to map to access the properties (#2597)" (#2602)
This reverts commit 7d91981beb.
2023-08-14 07:13:21 +09:00
Shanti G
7d91981beb
convert the fetched secret to map to access the properties (#2597) 2023-08-13 13:18:57 +02:00
Shuhei Kitagawa
7edb8f6752
Remove paginating namespaces (#2580)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-08 08:26:46 +09:00
Daniel Campos Olivares
9c9bd73e90
feat: Include remove orphans logic (#1389)
* feat: Include remove orphans logic

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* chore: Introduce deletion based on CR Status

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* chore: Simplify exit condition

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* fix: Check-diff and Unit Test

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* fix: Consume PR comments

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* chore: Change test string value for JSON

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* fix: New secret requires new name

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>

* bumping docs

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Adding unit test instead of e2e test for orphaned secrets compatibility

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Improving readability

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Using Label approach

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* fixing lint

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* bumping docs

Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>

* Update apis/externalsecrets/v1beta1/externalsecret_types.go

Signed-off-by: Moritz Johner <moolen@users.noreply.github.com>

---------

Signed-off-by: Daniel Campos Olivares <dacamposol@gmail.com>
Signed-off-by: Gustavo Carvalho <gusfcarvalho@gmail.com>
Signed-off-by: Moritz Johner <moolen@users.noreply.github.com>
Co-authored-by: Daniel Campos Olivares <daniel.campos.olivares@sap.com>
Co-authored-by: Gustavo Carvalho <gusfcarvalho@gmail.com>
Co-authored-by: Moritz Johner <moolen@users.noreply.github.com>
2023-08-05 10:02:04 -03:00
Moritz Johner
416deb3303
chore: bump dependencies (#2568)
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-08-02 21:42:03 +02:00
Shuhei Kitagawa
12a4470949
Support PushSecret Property for GCP (#2465)
* Support PushSecret Property for GCP

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Take over the ownership if the label does not exist

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-08-01 14:38:47 +02:00
Martin Schuessler
f777a85156
added userPass authentication to the hashicorp vault provider (#2539)
Signed-off-by: Martin Schuessler <1407812+c0ffee@users.noreply.github.com>
Co-authored-by: Moritz Johner <moolen@users.noreply.github.com>
2023-08-01 14:16:19 +02:00
Shuhei Kitagawa
ec81db7a1b
Fix flaky ClusterExternalSecret test (#2558)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-31 22:45:47 +02:00
arnouthoebreckx
1e281b92ca
Bug/escape special characters vault (#2537)
* Change json.Marshal to Encoder to support special characters

Signed-off-by: Arnout Hoebreckx <arnouthoebreckx@gmail.com>

* Add test for special characters

Signed-off-by: Arnout Hoebreckx <arnouthoebreckx@gmail.com>

* Handle error of encoder

Signed-off-by: Arnout Hoebreckx <arnouthoebreckx@gmail.com>

---------

Signed-off-by: Arnout Hoebreckx <arnouthoebreckx@gmail.com>
2023-07-26 17:16:25 +02:00
Shuhei Kitagawa
5c2f2ee741
Fix CES problems (#2526)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-24 09:02:18 +02:00
Shuhei Kitagawa
59bf53e7a3
Fix ClusterExternalSecret FailedNamespaces and ProvisionedNamespaces (#2506)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-19 20:08:09 +02:00
Shuhei Kitagawa
b912c334aa
Remove builder.OnlyMetadata (#2505) 2023-07-17 19:47:38 +02:00
Shuhei Kitagawa
63d1917269
Use PartialObjectMetadata to get ExternalSecret (#2504)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-17 19:35:53 +02:00
Shuhei Kitagawa
e5f953bd5f
Refactor ClusterExternalSecretController tests (#2499)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-17 09:24:21 +02:00
Shuhei Kitagawa
ce52c98bef
Kick ClusterExternalSecret reconciliation when a Namespace is updated (#2486)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-07-14 20:21:11 +02:00
Michael Sauter
bdf437c2e1
Add support for Delinea DevOps Secrets Vault (#2415)
* Add support for Delinea DevOps Secrets Vault

Closes #1709.

Signed-off-by: Michael Sauter <michael.sauter@boehringer-ingelheim.com>

* fix: remove merge conflict

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

* Improve documentation

Signed-off-by: Michael Sauter <michael.sauter@boehringer-ingelheim.com>

---------

Signed-off-by: Michael Sauter <michael.sauter@boehringer-ingelheim.com>
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Moritz Johner <moolen@users.noreply.github.com>
2023-07-06 18:01:43 +02:00
Moritz Johner
69fe93ea49
fix: make vault provider return NoSecretErr to respect deletionPolicy (#2455)
relates to #1512 #1502

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-07-06 08:22:34 +02:00
Vishal Singha Roy
a755a49422
Add IBM provider metadata to secret labels and/or annotations (#2429)
* Set metadata to external secrets managed by cluster external secrets (#2413)

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Pull secret metadata from IBM Secrets Manager

Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Add lower-kebab name transformer to Doppler provider (#2418)

Signed-off-by: Joel Watson <joel.watson@doppler.com>
Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Fix E2E test setup on non-linux machines (#2414)

Signed-off-by: Michael Sauter <michael.sauter@boehringer-ingelheim.com>
Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Removing IncludeSecretMetadata from externalsecret_types.go

Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Changes to call IBM Secrets Manager once in case of KV Secret

Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Removing extra parameters to getKVSecret() is not required

Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

* Removing linting errors

Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
Signed-off-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>
Signed-off-by: Joel Watson <joel.watson@doppler.com>
Signed-off-by: Michael Sauter <michael.sauter@boehringer-ingelheim.com>
Co-authored-by: Shuhei Kitagawa <shuheiktgw@users.noreply.github.com>
Co-authored-by: Vishal Singha Roy <vishal.singha.roy@ibm.com>
Co-authored-by: Joel Watson <joel@watsonian.net>
Co-authored-by: Michael Sauter <mail@michaelsauter.net>
2023-07-03 08:50:45 +02:00
DusanCar11
298f580d1e
Add more context to error handling for parsing certs in order for log format to display properly (#2428)
* Add more context to error handling for parsing certs in order for
log format to display properly

Signed-off-by: Dusan Nikolic <dusannikolic11@gmail.com>

* Create error instead of string as arg

Signed-off-by: Dusan Nikolic <dusannikolic11@gmail.com>

* fix: unit test

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

---------

Signed-off-by: Dusan Nikolic <dusannikolic11@gmail.com>
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Dusan Nikolic <dusannikolic@MacBook-Pro-66.local>
Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2023-07-02 22:49:51 +02:00
Jordi Prats
10b15db2b2
Sanitize credentials from AWS client err (#2431)
Signed-off-by: Jordi Prats <jordi.prats@gmail.com>
2023-06-26 13:19:21 +02:00
Shuhei Kitagawa
b58b4505d5
Add status_condition metrics for the secret store controllers (#2404)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-06-21 21:59:23 +02:00
David Hisel
de491a2790
Add Conjur provider (#2412)
* Add Conjur provider

Signed-off-by: David Hisel <David.Hisel@CyberArk.com>

* fix: lint

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

* fix: unit tests

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

---------

Signed-off-by: David Hisel <David.Hisel@CyberArk.com>
Signed-off-by: David Hisel <132942678+davidh-cyberark@users.noreply.github.com>
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-21 11:17:00 +02:00
Shuhei Kitagawa
9dd4186df1
Set metadata to external secrets managed by cluster external secrets (#2413)
Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-06-14 23:23:04 +02:00
Moritz Johner
05803f7aff
feat: add e2e tests for aws role-based auth (#2376)
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-12 12:58:29 +02:00
Shuhei Kitagawa
5a6d661c9e
Fix the test Make task (#2381)
* Fix the test Make task

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* fix: retry shutdown of testEnv

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-06 11:25:51 +02:00
Shuhei Kitagawa
36ae1c1a5e
Add status_condition metric for ClusterExternalSecret (#2380)
* Add status_condition metric for ClusterExternalSecret

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Register ClusterExternalSecretCondition metric

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* Stop setting namespace for ClusterExternalSecretStatusCondition

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
2023-06-06 09:29:30 +02:00
Shuhei Kitagawa
8a05e2f8ae
Add reconcile_duration metrics (#2382)
* Add reconcile_duration metrics

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>

* fix: increase dupl threshold

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

---------

Signed-off-by: shuheiktgw <s-kitagawa@mercari.com>
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-05 21:26:25 +02:00