Skip to content

Commit 6a1169b

Browse files
syedhaseebahmedsyedhaseebahmed
committed
global-secrets-sync chart
1 parent 6c4e862 commit 6a1169b

File tree

11 files changed

+195
-14
lines changed

11 files changed

+195
-14
lines changed

‎apps/appsets/project-understack.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ spec:
2929
server: '*'
3030
- namespace: 'kube-system'
3131
server: '*'
32-
- namespace: 'projectsveltos'
32+
- namespace: 'global-secrets-sync'
3333
server: '*'
3434
clusterResourceWhitelist:
3535
- group: '*'

‎apps/global/projectsveltos.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
---
2-
component: projectsveltos
3-
sources:
4-
- repoURL: https://projectsveltos.github.io/helm-charts
5-
chart: projectsveltos
6-
targetRevision: "1.0.2"
7-
helm:
8-
releaseName: projectsveltos
9-
valuesObject:
10-
installCRDs: true
11-
- ref: understack
12-
path: 'components/projectsveltos'
13-
componentNamespace: projectsveltos
1+
#---
2+
#component: projectsveltos
3+
#sources:
4+
# - repoURL: https://projectsveltos.github.io/helm-charts
5+
# chart: projectsveltos
6+
# targetRevision: "1.0.2"
7+
# helm:
8+
# releaseName: projectsveltos
9+
# valuesObject:
10+
# installCRDs: true
11+
# - ref: understack
12+
# path: 'components/projectsveltos'
13+
#componentNamespace: projectsveltos

‎apps/global/secrets-sync.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
component: secrets-sync
3+
sources:
4+
- repoURL: https://github.com/rackerlabs/understack.git
5+
chart: global-secretes-sync
6+
helm:
7+
releaseName: global-secretes-sync
8+
valueFiles:
9+
- $understack/components/global-secretes-sync/values.yaml
10+
- $deploy/{{.name}}/helm-configs/global-secretes-sync.yaml
11+
ignoreMissingValueFiles: true
12+
- ref: understack
13+
path: 'components/global-secretes-sync'
14+
- ref: deploy
15+
path: '{{.name}}/manifests/global-secretes-sync'

‎components/global-secrets-sync/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎components/global-secrets-sync/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: global-secrets-sync
3+
description: Helm chart to sync Kubernetes secrets between clusters using External Secrets
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0"

‎components/global-secrets-sync/templates/global-rbac.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if .Values.global.createRBAC }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
namespace: {{ .Values.global.targetNamespace }}
6+
name: secrets-reader
7+
rules:
8+
- apiGroups: [""]
9+
resources: ["secrets"]
10+
verbs: ["get", "list"]
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: RoleBinding
14+
metadata:
15+
name: secrets-reader-binding
16+
namespace: {{ .Values.global.targetNamespace }}
17+
subjects:
18+
- kind: ServiceAccount
19+
name: {{ .Values.global.serviceAccountName }}
20+
namespace: {{ .Values.global.namespace }}
21+
roleRef:
22+
kind: Role
23+
name: secrets-reader
24+
apiGroup: rbac.authorization.k8s.io
25+
{{- end }}

‎components/global-secrets-sync/templates/global-secret.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ .Values.global.serviceAccountName }}
5+
namespace: {{ .Values.global.namespace }}
6+
annotations:
7+
kubernetes.io/service-account.name: "{{ .Values.global.serviceAccountName }}"
8+
type: kubernetes.io/service-account-token

‎components/global-secrets-sync/templates/global-serviceaccount.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{{- if .Values.global.createServiceAccount }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ .Values.global.serviceAccountName }}
6+
namespace: {{ .Values.global.namespace }}
7+
{{- end }}

‎components/global-secrets-sync/templates/site-clustersecretstore.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- range .Values.sites }}
2+
apiVersion: external-secrets.io/v1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: secret-sync-{{ .name }}
6+
spec:
7+
provider:
8+
kubernetes:
9+
remoteNamespace: {{ $.Values.global.targetNamespace }}
10+
server:
11+
url: {{ .apiServerURL | quote }}
12+
caProvider:
13+
type: Secret
14+
name: {{ $.Values.global.serviceAccountName }}
15+
key: ca.crt
16+
namespace: {{ .namespace }}
17+
auth:
18+
token:
19+
bearerToken:
20+
name: {{ $.Values.global.serviceAccountName }}
21+
key: token
22+
namespace: {{ .namespace }}
23+
---
24+
{{- end }}

‎components/global-secrets-sync/templates/sync-job.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: sync-secrets-job
5+
namespace: {{ .Values.global.namespace }}
6+
spec:
7+
template:
8+
spec:
9+
serviceAccountName: {{ .Values.global.serviceAccountName }}
10+
restartPolicy: Never
11+
containers:
12+
- name: sync-secrets
13+
image: bitnami/kubectl:latest
14+
command:
15+
- /bin/sh
16+
- -c
17+
- |
18+
set -e
19+
echo "Extracting ServiceAccount Secret from source..."
20+
kubectl get secret {{ .Values.global.serviceAccountName }} -n {{ .Values.global.namespace }} -o yaml > /tmp/sa-secret.yaml
21+
22+
{{- range .Values.destinations }}
23+
echo "Syncing credentials and ClusterSecretStore to {{ .name }}..."
24+
KUBECONFIG=/kubeconfigs/{{ .name }}/config \
25+
kubectl -n {{ .namespace }} apply -f /tmp/sa-secret.yaml
26+
27+
cat <<EOF | KUBECONFIG=/kubeconfigs/{{ .name }}/config kubectl apply -f -
28+
apiVersion: external-secrets.io/v1
29+
kind: ClusterSecretStore
30+
metadata:
31+
name: dex-sso-sync-{{ .name }}
32+
spec:
33+
provider:
34+
kubernetes:
35+
remoteNamespace: {{ $.Values.global.targetNamespace }}
36+
server:
37+
url: {{ .apiServerURL | quote }}
38+
caProvider:
39+
type: Secret
40+
name: {{ $.Values.global.serviceAccountName }}
41+
key: ca.crt
42+
namespace: {{ .namespace }}
43+
auth:
44+
token:
45+
bearerToken:
46+
name: {{ $.Values.global.serviceAccountName }}
47+
key: token
48+
namespace: {{ .namespace }}
49+
EOF
50+
{{- end }}
51+
volumeMounts:
52+
{{- range .Values.destinations }}
53+
- name: kubeconfig-{{ .name }}
54+
mountPath: /kubeconfigs/{{ .name }}
55+
{{- end }}
56+
volumes:
57+
{{- range .Values.destinations }}
58+
- name: kubeconfig-{{ .name }}
59+
secret:
60+
secretName: {{ .kubeconfigSecret }}
61+
{{- end }}

0 commit comments

Comments
 (0)