Skip to content

Commit 234f8dc

Browse files
benashzbenashz
authored
VA: support default VaultAuthGlobal refs (#847)
Add support for inheriting from a default VaultAuthGlobal in the case where one is not explicitly set on the referring VaultAuth instance.
1 parent a1da009 commit 234f8dc

24 files changed

+683
-237
lines changed

‎api/v1beta1/vaultauth_types.go

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -320,14 +320,25 @@ func (a *VaultAuthConfigGCP) Validate() error {
320320
type VaultAuthGlobalRef struct {
321321
// Name of the VaultAuthGlobal resource.
322322
// +kubebuilder:validation:Pattern=`^([a-z0-9.-]{1,253})$`
323-
Name string `json:"name"`
323+
Name string `json:"name,omitempty"`
324324
// Namespace of the VaultAuthGlobal resource. If not provided, the namespace of
325325
// the referring VaultAuth resource is used.
326326
// +kubebuilder:validation:Pattern=`^([a-z0-9.-]{1,253})$`
327327
Namespace string `json:"namespace,omitempty"`
328328
// MergeStrategy configures the merge strategy for HTTP headers and parameters
329329
// that are included in all Vault authentication requests.
330330
MergeStrategy *MergeStrategy `json:"mergeStrategy,omitempty"`
331+
// AllowDefault when set to true will use the default VaultAuthGlobal resource
332+
// as the default if Name is not set. The 'allow-default-globals' option must be
333+
// set on the operator's '-global-vault-auth-options' flag
334+
//
335+
// The default VaultAuthGlobal search is conditional.
336+
// When a ref Namespace is not set, the search follows the order:
337+
// 1. The referring VaultAuth Namespace.
338+
// 2. The Operator's namespace.
339+
// Otherwise, the search follows the order:
340+
// 1. The VaultAuthGlobal ref Namespace.
341+
AllowDefault *bool `json:"allowDefault,omitempty"`
331342
}
332343

333344
// MergeStrategy provides the configuration for merging HTTP headers and
@@ -423,8 +434,8 @@ type VaultAuthStatus struct {
423434
SpecHash string `json:"specHash,omitempty"`
424435
}
425436

426-
//+kubebuilder:object:root=true
427-
//+kubebuilder:subresource:status
437+
// +kubebuilder:object:root=true
438+
// +kubebuilder:subresource:status
428439

429440
// VaultAuth is the Schema for the vaultauths API
430441
type VaultAuth struct {
@@ -444,7 +455,7 @@ type StorageEncryption struct {
444455
KeyName string `json:"keyName"`
445456
}
446457

447-
//+kubebuilder:object:root=true
458+
// +kubebuilder:object:root=true
448459

449460
// VaultAuthList contains a list of VaultAuth
450461
type VaultAuthList struct {

‎api/v1beta1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎chart/crds/secrets.hashicorp.com_vaultauths.yaml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,20 @@ spec:
246246
vaultAuthGlobalRef:
247247
description: VaultAuthGlobalRef.
248248
properties:
249+
allowDefault:
250+
description: |-
251+
AllowDefault when set to true will use the default VaultAuthGlobal resource
252+
as the default if Name is not set. The 'allow-default-globals' option must be
253+
set on the operator's '-global-vault-auth-options' flag
254+
255+
256+
The default VaultAuthGlobal search is conditional.
257+
When a ref Namespace is not set, the search follows the order:
258+
1. The referring VaultAuth Namespace.
259+
2. The Operator's namespace.
260+
Otherwise, the search follows the order:
261+
1. The VaultAuthGlobal ref Namespace.
262+
type: boolean
249263
mergeStrategy:
250264
description: |-
251265
MergeStrategy configures the merge strategy for HTTP headers and parameters
@@ -307,8 +321,6 @@ spec:
307321
the referring VaultAuth resource is used.
308322
pattern: ^([a-z0-9.-]{1,253})$
309323
type: string
310-
required:
311-
- name
312324
type: object
313325
vaultConnectionRef:
314326
description: |-

‎chart/templates/_helpers.tpl

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ imagePullSecrets:
164164

165165

166166
{{/*
167-
globalTransformationOptions configures the manager's --global-transformation-options
167+
globalTransformationOptions configures the manager's --global-transformation-options flag.
168168
*/}}
169169
{{- define "vso.globalTransformationOptions" -}}
170170
{{- $opts := list -}}
@@ -176,6 +176,19 @@ globalTransformationOptions configures the manager's --global-transformation-opt
176176
{{- end -}}
177177
{{- end -}}
178178
179+
{{/*
180+
globalVaultAuthOptions configures the manager's --global-vault-auth-options flag.
181+
*/}}
182+
{{- define "vso.globalVaultAuthOptions" -}}
183+
{{- $opts := list -}}
184+
{{- if .Values.controller.manager.globalVaultAuthOptions.allowDefaultGlobals }}
185+
{{- $opts = mustAppend $opts "allow-default-globals" -}}
186+
{{- end -}}
187+
{{- if $opts -}}
188+
{{- $opts | join "," -}}
189+
{{- end -}}
190+
{{- end -}}
191+
179192
{{/*
180193
backoffOnSecretSourceError provides the backoff options for the manager when a
181194
secret source error occurs.

‎chart/templates/deployment.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,13 @@ spec:
7878
{{- if .Values.controller.manager.maxConcurrentReconciles }}
7979
- --max-concurrent-reconciles={{ .Values.controller.manager.maxConcurrentReconciles }}
8080
{{- end }}
81-
{{- $opts := include "vso.globalTransformationOptions" . -}}
82-
{{- if $opts }}
83-
- --global-transformation-options={{ $opts }}
81+
{{- $gTransOpts := include "vso.globalTransformationOptions" . -}}
82+
{{- if $gTransOpts }}
83+
- --global-transformation-options={{ $gTransOpts }}
84+
{{- end }}
85+
{{- $gVaultAuthOpts := include "vso.globalVaultAuthOptions" . -}}
86+
{{- if $gVaultAuthOpts }}
87+
- --global-vault-auth-options={{ $gVaultAuthOpts }}
8488
{{- end }}
8589
{{- with include "vso.backoffOnSecretSourceError" . }}
8690
{{- . -}}

‎chart/values.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,17 @@ controller:
192192
# in the destination K8s Secret.
193193
excludeRaw: false
194194

195+
# Global Vault auth options. In addition to the boolean options
196+
# below, these options may be set via the
197+
# `VSO_GLOBAL_VAULT_OPTION_OPTIONS` environment variable as a
198+
# comma-separated list. Valid values are: `allow-default-globals`
199+
globalVaultAuthOptions:
200+
# allowDefaultGlobals directs the operator search for a "default"
201+
# VaultAuthGlobal if none is specified on the referring VaultAuth CR.
202+
# Default: true
203+
# @type: boolean
204+
allowDefaultGlobals: true
205+
195206
# Backoff settings for the controller manager. These settings control the backoff behavior
196207
# when the controller encounters an error while fetching secrets from the SecretSource.
197208
# For example given the following settings:

‎config/crd/bases/secrets.hashicorp.com_vaultauths.yaml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,20 @@ spec:
246246
vaultAuthGlobalRef:
247247
description: VaultAuthGlobalRef.
248248
properties:
249+
allowDefault:
250+
description: |-
251+
AllowDefault when set to true will use the default VaultAuthGlobal resource
252+
as the default if Name is not set. The 'allow-default-globals' option must be
253+
set on the operator's '-global-vault-auth-options' flag
254+
255+
256+
The default VaultAuthGlobal search is conditional.
257+
When a ref Namespace is not set, the search follows the order:
258+
1. The referring VaultAuth Namespace.
259+
2. The Operator's namespace.
260+
Otherwise, the search follows the order:
261+
1. The VaultAuthGlobal ref Namespace.
262+
type: boolean
249263
mergeStrategy:
250264
description: |-
251265
MergeStrategy configures the merge strategy for HTTP headers and parameters
@@ -307,8 +321,6 @@ spec:
307321
the referring VaultAuth resource is used.
308322
pattern: ^([a-z0-9.-]{1,253})$
309323
type: string
310-
required:
311-
- name
312324
type: object
313325
vaultConnectionRef:
314326
description: |-

‎controllers/hcpvaultsecretsapp_controller.go

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -47,26 +47,26 @@ var userAgent = fmt.Sprintf("vso/%s", version.Version().String())
4747
// HCPVaultSecretsAppReconciler reconciles a HCPVaultSecretsApp object
4848
type HCPVaultSecretsAppReconciler struct {
4949
client.Client
50-
Scheme *runtime.Scheme
51-
Recorder record.EventRecorder
52-
SecretDataBuilder *helpers.SecretDataBuilder
53-
HMACValidator helpers.HMACValidator
54-
MinRefreshAfter time.Duration
55-
referenceCache ResourceReferenceCache
56-
GlobalTransformationOption *helpers.GlobalTransformationOption
57-
BackOffRegistry *BackOffRegistry
50+
Scheme *runtime.Scheme
51+
Recorder record.EventRecorder
52+
SecretDataBuilder *helpers.SecretDataBuilder
53+
HMACValidator helpers.HMACValidator
54+
MinRefreshAfter time.Duration
55+
referenceCache ResourceReferenceCache
56+
GlobalTransformationOptions *helpers.GlobalTransformationOptions
57+
BackOffRegistry *BackOffRegistry
5858
}
5959

60-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps,verbs=get;list;watch;create;update;patch;delete
61-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps/status,verbs=get;update;patch
62-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps/finalizers,verbs=update
63-
//+kubebuilder:rbac:groups="",resources=events,verbs=create;patch
60+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps,verbs=get;list;watch;create;update;patch;delete
61+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps/status,verbs=get;update;patch
62+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=hcpvaultsecretsapps/finalizers,verbs=update
63+
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
6464
//
6565
// required for rollout-restart
66-
//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;patch
67-
//+kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;patch
68-
//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;patch
69-
//+kubebuilder:rbac:groups=argoproj.io,resources=rollouts,verbs=get;list;watch;patch
66+
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;patch
67+
// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;patch
68+
// +kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;patch
69+
// +kubebuilder:rbac:groups=argoproj.io,resources=rollouts,verbs=get;list;watch;patch
7070
//
7171

7272
// Reconcile a secretsv1beta1.HCPVaultSecretsApp Custom Resource instance. Each
@@ -104,7 +104,7 @@ func (r *HCPVaultSecretsAppReconciler) Reconcile(ctx context.Context, req ctrl.R
104104
}
105105
}
106106

107-
transOption, err := helpers.NewSecretTransformationOption(ctx, r.Client, o, r.GlobalTransformationOption)
107+
transOption, err := helpers.NewSecretTransformationOption(ctx, r.Client, o, r.GlobalTransformationOptions)
108108
if err != nil {
109109
r.Recorder.Eventf(o, corev1.EventTypeWarning, consts.ReasonTransformationError,
110110
"Failed setting up SecretTransformationOption: %s", err)

‎controllers/vaultauth_controller.go

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,19 @@ type VaultAuthReconciler struct {
3838
Recorder record.EventRecorder
3939
ClientFactory vault.CachingClientFactory
4040
referenceCache ResourceReferenceCache
41+
// GlobalVaultAuthOptions is a struct that contains global VaultAuth options.
42+
GlobalVaultAuthOptions *common.GlobalVaultAuthOptions
4143
}
4244

43-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths,verbs=get;list;watch;create;update;patch;delete
44-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths/status,verbs=get;update;patch
45-
//+kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths/finalizers,verbs=update
46-
//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
47-
//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=get;list;create;watch
48-
//+kubebuilder:rbac:groups="",resources=events,verbs=create;patch
45+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths,verbs=get;list;watch;create;update;patch;delete
46+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths/status,verbs=get;update;patch
47+
// +kubebuilder:rbac:groups=secrets.hashicorp.com,resources=vaultauths/finalizers,verbs=update
48+
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
49+
// +kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=get;list;create;watch
50+
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
4951
// needed for managing cached Clients, duplicated in vaultconnection_controller.go
50-
//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;delete;update;patch;deletecollection
51-
//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
52+
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;delete;update;patch;deletecollection
53+
// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
5254

5355
// Reconcile reconciles the secretsv1beta1.VaultAuth resource.
5456
// Each reconciliation will validate the resource's configuration
@@ -79,11 +81,6 @@ func (r *VaultAuthReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
7981

8082
var conditions []metav1.Condition
8183
if o.Spec.VaultAuthGlobalRef != nil {
82-
globalRef, err := common.VaultAuthGlobalResourceRef(o)
83-
r.referenceCache.Set(
84-
VaultAuthGlobal, req.NamespacedName,
85-
globalRef)
86-
8784
condition := metav1.Condition{
8885
Type: "VaultAuthGlobalRef",
8986
Status: "True",
@@ -92,7 +89,7 @@ func (r *VaultAuthReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
9289
Reason: "VaultAuthGlobalRef",
9390
}
9491

95-
mObj, gObj, err := common.MergeInVaultAuthGlobal(ctx, r.Client, o)
92+
mObj, gObj, err := common.MergeInVaultAuthGlobal(ctx, r.Client, o, r.GlobalVaultAuthOptions)
9693
if err != nil {
9794
condition.Message = err.Error()
9895
condition.Status = "False"

‎controllers/vaultdynamicsecret_controller.go

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,14 @@ var _ reconcile.Reconciler = &VaultDynamicSecretReconciler{}
5555
// VaultDynamicSecretReconciler reconciles a VaultDynamicSecret object
5656
type VaultDynamicSecretReconciler struct {
5757
client.Client
58-
Scheme *runtime.Scheme
59-
Recorder record.EventRecorder
60-
ClientFactory vault.ClientFactory
61-
HMACValidator helpers.HMACValidator
62-
SyncRegistry *SyncRegistry
63-
BackOffRegistry *BackOffRegistry
64-
referenceCache ResourceReferenceCache
65-
GlobalTransformationOption *helpers.GlobalTransformationOption
58+
Scheme *runtime.Scheme
59+
Recorder record.EventRecorder
60+
ClientFactory vault.ClientFactory
61+
HMACValidator helpers.HMACValidator
62+
SyncRegistry *SyncRegistry
63+
BackOffRegistry *BackOffRegistry
64+
referenceCache ResourceReferenceCache
65+
GlobalTransformationOptions *helpers.GlobalTransformationOptions
6666
// sourceCh is used to trigger a requeue of resource instances from an
6767
// external source. Should be set on a source.Channel in SetupWithManager.
6868
// This channel should be closed when the controller is stopped.
@@ -263,7 +263,7 @@ func (r *VaultDynamicSecretReconciler) Reconcile(ctx context.Context, req ctrl.R
263263
reason = consts.ReasonSecretRotated
264264
}
265265

266-
transOption, err := helpers.NewSecretTransformationOption(ctx, r.Client, o, r.GlobalTransformationOption)
266+
transOption, err := helpers.NewSecretTransformationOption(ctx, r.Client, o, r.GlobalTransformationOptions)
267267
if err != nil {
268268
r.Recorder.Eventf(o, corev1.EventTypeWarning, consts.ReasonTransformationError,
269269
"Failed setting up SecretTransformationOption: %s", err)

0 commit comments

Comments
 (0)