Support excluding _raw from the destination #546
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Extends VSO to support configuring Go templates that will be rendered to the K8s Secret data. Template specs can be configured directly in a syncable secret custom resource, or can be shared via references to external ConfigMap resources. Templates can be composed of other templates, and optionally rendered as a K8s Secret data value. The rendered template name is used as the key to the rendered data. Templating support also includes a large subset of the hermetic Sprig text functions that can be used to handle various encoding/decoding tasks, map manipulations, etc. In addition to template support, it is now possible to filter top level secret data fields based on include/exclude regex patterns. Filters can be used in conjunction with templating, and are meant to augment the overall templating experience. Template fields are not considered during field filtering.
Contains all Secret data transformation configuration.
Other fixes
- update the demo to include templated values - other fixes etc...
Add first class SecretTransformation CRD and controller Drop support for getting shared template/tranformation bits from a ConfigMap.
|
Are there any negative implications with the exclude? If not, I wonder why the exclusion is not set to true by default. |
@rgarcia89 not for VSO per-se but there could be for any user that is currently relying on this feature. I can see how having to configure this on all CRs could be burdensome, so it is probably worth making the feature opt-in somehow. |
|
In that case it would be more attractive to make the default parameter configurable. Like the |
1434971 to
3292648
Compare
@rgarcia89 made this a command line configurable as well. See the updated description for more details. |
3292648 to
b2c9ac7
Compare
…o VAULT-21377/make-raw-data-optional
7bbb2d2 to
d6fbc79
Compare
Fixes: - properly set the SyncableSecretMetaData.Name from ObjectMeta - add tests for NewSyncableSecretMetaData()
…o VAULT-21377/make-raw-data-optional
tomhjp
reviewed
Feb 2, 2024
Factors out RenderOptionExcludeRaw global var to GlobalTransformationOption struct.
e2c5d32 to
8f2fa91
Compare
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
…o VAULT-21377/make-raw-data-optional
tomhjp
approved these changes
Feb 7, 2024
Base automatically changed from
VAULT-21159/add-support-for-secret-data-templating
to
main
February 7, 2024 19:42
kishoregv
pushed a commit
to kishoregv/vault-secrets-operator
that referenced
this pull request
Feb 12, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add new transformation configurable
excludeRawto all syncable secret CRDs which controls whether or not the the_rawsecret data is included in the destination secret.Example:
Adds a new commandline flag,
-global-transformation-options, that takes a comma delimited set of options that provide control over global rendering options. The only option isexclude-raw.The global rendering options can also be set from Helm chart values:
Closes #424