From ed5b1a3bb2c84401a59f8a068195346b0235f0ca Mon Sep 17 00:00:00 2001
From: Arnaud Meukam <ameukam@gmail.com>
Date: Mon, 27 Sep 2021 18:14:38 +0200
Subject: [PATCH] publishing-bot: Add ExternalSecret

Related:
 - Ref: https://github.com/kubernetes/k8s.io/issues/2220
 - Followup of : https://github.com/kubernetes/k8s.io/pull/2825

Signed-off-by: Arnaud Meukam <ameukam@gmail.com>
---
 apps/publishing-bot/deploy.sh            | 50 ++++++++++++++++++++++++
 apps/publishing-bot/externalsecrets.yaml | 15 +++++++
 2 files changed, 65 insertions(+)
 create mode 100755 apps/publishing-bot/deploy.sh
 create mode 100644 apps/publishing-bot/externalsecrets.yaml

diff --git a/apps/publishing-bot/deploy.sh b/apps/publishing-bot/deploy.sh
new file mode 100755
index 00000000000..7d29884da03
--- /dev/null
+++ b/apps/publishing-bot/deploy.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Deploys this app to the aaa cluster, or whatever cluster is pointed to
+# by KUBECTL_CONTEXT if set. Assumes the app's namespace already exists.
+#
+# Members of k8s-infra-rbac-${app}@kubernetes.io can run this.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+
+app=$(basename "${SCRIPT_ROOT}")
+
+# coordinates to locate the target cluster in gke
+cluster_name="aaa"
+cluster_project="kubernetes-public"
+cluster_region="us-central1"
+
+# coordinates to locate the app on the target cluster
+namespace="${app}"
+
+# well known name set by `gcloud container clusters get-credentials`
+gke_context="gke_${cluster_project}_${cluster_region}_${cluster_name}"
+context="${KUBECTL_CONTEXT:-${gke_context}}"
+
+# ensure we have a context to talk to the target cluster
+if ! kubectl config get-contexts "${context}" >/dev/null 2>&1; then
+  gcloud container clusters get-credentials "${cluster_name}" --project="${cluster_project}" --region="${cluster_region}"
+  context="${gke_context}"
+fi
+
+# deploy kubernetes resources
+pushd "${SCRIPT_ROOT}" >/dev/null
+kubectl --context="${context}" --namespace="${namespace}" apply -f .
diff --git a/apps/publishing-bot/externalsecrets.yaml b/apps/publishing-bot/externalsecrets.yaml
new file mode 100644
index 00000000000..b608749b3c6
--- /dev/null
+++ b/apps/publishing-bot/externalsecrets.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: kubernetes-client.io/v1
+kind: ExternalSecret
+metadata:
+  name: triage-party-github-token # Name of the secret
+  namespace: publishing-bot
+  labels:
+    app: publishing-bot
+spec:
+  backendType: gcpSecretsManager
+  projectId: kubernetes-public
+  data:
+  - key: publishing-bot-github-token # The name of the GSM secret
+    name: token                      # The key to write to in the Kubernetes Secret
+    version: latest                  # The version of the GSM secret