Support setting kv-v2 version for VaultStaticSecret

CHANGELOG.md

@@ -11,6 +11,7 @@ Features:
 Improvements:
 * VaultDynamicSecrets (VDS): Generate new credentials if lease renewal TTL is truncated [GH-170](https://github.com/hashicorp/vault-secrets-operator/pull/170)
 * VaultDynamicSecrets (VDS): Replace `Spec.Role` with `Spec.Path` (**breaking change**) [GH-172](https://github.com/hashicorp/vault-secrets-operator/pull/172)
+* VaultStaticSecrets (VSS): Add `Spec.Version` field to support fetching a specific kv-v2 secret version [GH-200](https://github.com/hashicorp/vault-secrets-operator/pull/200)
 
 ## 0.1.0-beta (March 29th, 2023)
 

api/v1alpha1/vaultstaticsecret_types.go

@@ -22,6 +22,10 @@ type VaultStaticSecretSpec struct {
 	Mount string `json:"mount"`
 	// Name of the secret in Vault
 	Name string `json:"name"`
+	// Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:
+	// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version
+	// +kubebuilder:validation:Minimum=0
+	Version int `json:"version,omitempty"`
 	// Type of the Vault static secret
 	// +kubebuilder:validation:Enum={kv-v1,kv-v2}
 	Type string `json:"type"`

chart/crds/secrets.hashicorp.com_vaultstaticsecrets.yaml

@@ -131,6 +131,11 @@ spec:
                   specified the Operator will default to the `default` VaultAuth,
                   configured in its own Kubernetes namespace.
                 type: string
+              version:
+                description: 'Version of the secret to fetch. Only valid for type
+                  kv-v2. Corresponds to version query parameter: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version'
+                minimum: 0
+                type: integer
             required:
             - destination
             - mount

config/crd/bases/secrets.hashicorp.com_vaultstaticsecrets.yaml

@@ -131,6 +131,11 @@ spec:
                   specified the Operator will default to the `default` VaultAuth,
                   configured in its own Kubernetes namespace.
                 type: string
+              version:
+                description: 'Version of the secret to fetch. Only valid for type
+                  kv-v2. Corresponds to version query parameter: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version'
+                minimum: 0
+                type: integer
             required:
             - destination
             - mount

controllers/vaultstaticsecret_controller.go

@@ -93,7 +93,11 @@ func (r *VaultStaticSecretReconciler) Reconcile(ctx context.Context, req ctrl.Re
 		if err != nil {
 			return ctrl.Result{}, err
 		}
-		resp, err = w.Get(ctx, o.Spec.Name)
+		if o.Spec.Version == 0 {
+			resp, err = w.Get(ctx, o.Spec.Name)
+		} else {
+			resp, err = w.GetVersion(ctx, o.Spec.Name, o.Spec.Version)
+		}
 	default:
 		err = fmt.Errorf("unsupported secret type %q", o.Spec.Type)
 		logger.Error(err, "")

test/integration/vaultstaticsecret_integration_test.go

@@ -275,6 +275,7 @@ func TestVaultStaticSecret_kv(t *testing.T) {
 		expectedExisting []expectedData
 		create           int
 		createTypes      []string
+		version          int
 	}{
 		{
 			name: "existing",
@@ -300,6 +301,12 @@ func TestVaultStaticSecret_kv(t *testing.T) {
 			create:      2,
 			createTypes: []string{consts.KVSecretTypeV2},
 		},
+		{
+			name:        "create-kv-v2-fixed-version",
+			create:      2,
+			createTypes: []string{consts.KVSecretTypeV2},
+			version:     1,
+		},
 		{
 			name:        "create-both",
 			create:      2,
@@ -355,7 +362,11 @@ func TestVaultStaticSecret_kv(t *testing.T) {
 		} else {
 			putKV(t, obj, expected.update)
 
-			data = expected.update
+			if obj.Spec.Version == 1 {
+				data = expected.initial
+			} else {
+				data = expected.update
+			}
 		}
 
 		secret, err := waitForSecretData(t, ctx, crdClient, 30, 1*time.Second, obj.Spec.Destination.Name,
@@ -442,6 +453,9 @@ func TestVaultStaticSecret_kv(t *testing.T) {
 								HMACSecretData: true,
 							},
 						}
+						if tt.version != 0 {
+							vssObj.Spec.Version = tt.version
+						}
 
 						if !skipCleanup {
 							t.Cleanup(func() {