GitHub provider by mike-serchenia · Pull Request #3014 · external-secrets/external-secrets

mike-serchenia · 2024-01-10T16:42:37Z

I'd like to propose new provider Github.

I uses Github application privateKey and appID to get github accessToken of format ghs_*
The token can be used to access GH repositories, pull/push to registry, etc.

Can be used for tekton auth with GH instead of using personal access tokens'

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

apis/externalsecrets/v1beta1/secretstore_github_types.go

moolen

I think that your proposal to create access tokens for GitHub App installations would better fit for a Generator API:
https://external-secrets.io/latest/guides/generator/

apis/externalsecrets/v1alpha1/secretstore_github_types.go

apis/externalsecrets/v1beta1/secretstore_github_types.go

moolen · 2024-01-12T21:25:11Z

apis/externalsecrets/v1beta1/secretstore_github_types.go

+	Auth GithubAuth `json:"auth"`
+}
+
+type GithubAuth struct {
+	SecretRef GithubSecretRef `json:"secretRef"`
+}
+
+type GithubSecretRef struct {
+	PrivatKey esmeta.SecretKeySelector `json:"privatKey"`
+}


I think this can be improved, the secretRef isn't needed, i suggest:

auth: privateKey: secretRef: {} # ...

can you please elaborate why secretRef can be omitted?

--- apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: github-secret-stor namespace: external-secrets spec: provider: github: appID: "0000000" installID: "00000000" auth: SecretRef: privatKey: name: github-app-pem key: key

I suggest to swap both secretRef and privateKey. In case there is another way to fetch a privateKey or there is a different way to authenticate we can easier extend it that way.

The auth node contains different authentication strategies, privateKey is one of them. You can fetch the private key through a secretRef.

fixed, thanks

docs/snippets/github-secret-store.yaml

pkg/provider/github/github.go

mike-sirs · 2024-01-16T18:48:19Z

I think that your proposal to create access tokens for GitHub App installations would better fit for a Generator API: https://external-secrets.io/latest/guides/generator/

Hi, your suggestion looks reasonable, thank you for your advice.

…pplication private key Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…teKey Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: External Secrets Operator <ExternalSecretsOperator@users.noreply.github.com> Co-authored-by: External Secrets Operator <ExternalSecretsOperator@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…l-secrets#3040) Bumps alpine from `13b7e62` to `51b6726`. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…l-secrets#3038) Bumps golang from `04cf306` to `c4b696f`. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…cs (external-secrets#3043) Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.5.3 to 9.5.4. - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](squidfunk/mkdocs-material@9.5.3...9.5.4) --- updated-dependencies: - dependency-name: mkdocs-material dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…-secrets#3045) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.2 to 2.3.1. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@e38b190...0864cf1) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…ernal-secrets#3054) The snippet[1] was not aligning with the schema defined in CRD. [1] https://external-secrets.io/latest/guides/security-best-practices/ Signed-off-by: kyasbal <kyasbal1994@gmail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

* chore: refactor/centralise secretKeyRef usage Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…secrets#3058) This allows providers to issue warnings, e.g. during a migration/deprecation period Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…l-secrets#3039) Bumps alpine from 3.18 to 3.19. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…crets#3063) Bumps [mkdocs-minify-plugin](https://github.com/byrnereese/mkdocs-minify-plugin) from 0.5.0 to 0.7.2. - [Release notes](https://github.com/byrnereese/mkdocs-minify-plugin/releases) - [Commits](byrnereese/mkdocs-minify-plugin@0.5.0...0.7.2) --- updated-dependencies: - dependency-name: mkdocs-minify-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…xternal-secrets#3062) Bumps [markupsafe](https://github.com/pallets/markupsafe) from 2.1.3 to 2.1.4. - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@2.1.3...2.1.4) --- updated-dependencies: - dependency-name: markupsafe dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

* update dependencies Signed-off-by: External Secrets Operator <ExternalSecretsOperator@users.noreply.github.com> * fix: re-generate CRDs with new controller-runtime version Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> --------- Signed-off-by: External Secrets Operator <ExternalSecretsOperator@users.noreply.github.com> Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: External Secrets Operator <ExternalSecretsOperator@users.noreply.github.com> Co-authored-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

* added metrics support for akeyles Signed-off-by: Sai Charan Godasi <saicharangodasi@Sais-MacBook-Air.local>

Bump to v2 to address CVE-2024-21664. Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…ernal-secrets#3078) * remove deprecated code for fetching secret by name Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com> * update the documentation Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com> * fix linting Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com> --------- Signed-off-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com> Co-authored-by: shanti.gundumalla@ibm.com <shanti.gundumalla@ibm.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…dated ValidateStore func Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com>

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

sonarqubecloud · 2024-01-30T04:00:09Z

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

mike-serchenia · 2024-01-30T04:19:56Z

@moolen I also plan to extend github provider to pull github secrets and vars in a few next iterantions.
Please let me know if you see something else should be fixed before it can be merged.

I may have issue with DCO signoff git rebase HEAD~75 --signoff results in multiple manual rebase conflicts. Would appreciate advice on how to pass it

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

mike-serchenia · 2024-02-05T17:57:36Z

@moolen, I moved changes to the new PR and properly sign , can you please check and approve or comment the new PR
Closed in favor of #3115

* github provider signed, supersedes #3014 Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * tests pass, + crd + docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * fix sonarLint alert Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * refactoring, replace secretStore with generator Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * cosmetics + tst + lint pass Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * clean-up + lint + test Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * small refactor, fix issues left in comments Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> --------- Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

…3115) * github provider signed, supersedes external-secrets#3014 Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * tests pass, + crd + docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * fix sonarLint alert Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * refactoring, replace secretStore with generator Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * cosmetics + tst + lint pass Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * clean-up + lint + test Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * small refactor, fix issues left in comments Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> --------- Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> Signed-off-by: Bude8 <henryblee8@gmail.com>

…3115) * github provider signed, supersedes external-secrets#3014 Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * tests pass, + crd + docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * fix sonarLint alert Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * refactoring, replace secretStore with generator Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * cosmetics + tst + lint pass Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * docs Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * clean-up + lint + test Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> * small refactor, fix issues left in comments Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> --------- Signed-off-by: Mike Serchenia <michael_serchenia@epam.com> Signed-off-by: Bill Hamilton <bill.hamilton@delinea.com>

mike-serchenia requested a review from a team as a code owner January 10, 2024 16:42

mike-serchenia requested review from moolen and removed request for a team January 10, 2024 16:42

mike-serchenia force-pushed the github-provider branch 2 times, most recently from 1db8786 to 854e72c Compare January 10, 2024 18:13

Skarlso reviewed Jan 10, 2024

View reviewed changes

apis/externalsecrets/v1beta1/secretstore_github_types.go Outdated Show resolved Hide resolved

mike-serchenia requested a review from Skarlso January 11, 2024 18:05

moolen reviewed Jan 12, 2024

View reviewed changes

mike-serchenia force-pushed the github-provider branch from 5db325c to c6167ec Compare January 17, 2024 05:20

mike-serchenia requested a review from moolen January 22, 2024 23:59

mike-serchenia and others added 19 commits January 29, 2024 21:39

added github provider to generate private access token using github a…

6193531

…pplication private key Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added validateion for store and and type

fd8c98a

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added validateion for store and and type

d8aa4a2

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added github-external-secret-example comment

034bbc2

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added ref key

aafd56e

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

fix url selector

00bd168

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added key ref to follow common approach

4627e75

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

init mock gen

f3b3d87

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

WIP: refactor

088f46c

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

WIP: added get token test, small refactoring

c9024e7

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

WIP: added get secret test, small refactoring

89b6512

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

tests pass, lint pass

af9573b

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

fix duplication

096ac87

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Update apis/externalsecrets/v1beta1/secretstore_github_types.go

7aa2e28

Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Update apis/externalsecrets/v1alpha1/secretstore_github_types.go

6cbb2c3

Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Update apis/externalsecrets/v1beta1/secretstore_github_types.go

3385314

Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added doc hot to create github app and get appID, installID and priva…

77a420f

…teKey Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

token signing in NewClient()

9117823

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

dependabot bot and others added 18 commits January 29, 2024 21:41

docs: add security response process (external-secrets#3037)

8d859ee

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

chore: refactor/centralise secretKeyRef usage (external-secrets#3022)

59cea7f

* chore: refactor/centralise secretKeyRef usage Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

chore: fixup security response suggestions (external-secrets#3056)

adb5849

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

chore: add tests for AWS/SM (external-secrets#3057)

b39971b

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

added metrics support for akeyless (external-secrets#3069)

4a60a3c

* added metrics support for akeyles Signed-off-by: Sai Charan Godasi <saicharangodasi@Sais-MacBook-Air.local>

chore: bump jwx pkg (external-secrets#3075)

e737b69

Bump to v2 to address CVE-2024-21664. Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

small refactor for github provider, swap privatKey with secretRef. Up…

b9196a6

…dated ValidateStore func Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

mike-serchenia force-pushed the github-provider branch from 4151253 to b9196a6 Compare January 30, 2024 03:42

mike-serchenia and others added 2 commits January 29, 2024 23:43

Merge branch 'main' into github-provider

0a975a9

Signed-off-by: Michael Serchenia <76994369+mike-serchenia@users.noreply.github.com>

fix github doc snipet

67682d0

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

mike-serchenia added a commit to mike-serchenia/external-secrets that referenced this pull request Feb 5, 2024

github provider signed, supersedes external-secrets#3014

dd315a2

Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

mike-serchenia mentioned this pull request Feb 5, 2024

GitHub provider (supersedes #3014) #3115

Merged

5 tasks

mike-serchenia closed this Feb 5, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GitHub provider#3014

GitHub provider#3014
mike-serchenia wants to merge 75 commits intoexternal-secrets:mainfrom
mike-serchenia:github-provider

mike-serchenia commented Jan 10, 2024

Uh oh!

Uh oh!

moolen left a comment

Uh oh!

Uh oh!

Uh oh!

moolen Jan 12, 2024

Uh oh!

mike-serchenia Jan 17, 2024

Uh oh!

moolen Jan 24, 2024

Uh oh!

mike-sirs Jan 30, 2024

Uh oh!

Uh oh!

Uh oh!

mike-sirs commented Jan 16, 2024

Uh oh!

sonarqubecloud bot commented Jan 30, 2024

Uh oh!

mike-serchenia commented Jan 30, 2024 •

edited

Loading

Uh oh!

mike-serchenia commented Feb 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Uh oh!

Conversation

mike-serchenia commented Jan 10, 2024

Checklist

Uh oh!

Uh oh!

moolen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

moolen Jan 12, 2024

Choose a reason for hiding this comment

Uh oh!

mike-serchenia Jan 17, 2024

Choose a reason for hiding this comment

Uh oh!

moolen Jan 24, 2024

Choose a reason for hiding this comment

Uh oh!

mike-sirs Jan 30, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mike-sirs commented Jan 16, 2024

Uh oh!

sonarqubecloud bot commented Jan 30, 2024

Quality Gate passed

Uh oh!

mike-serchenia commented Jan 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mike-serchenia commented Feb 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

mike-serchenia commented Jan 30, 2024 •

edited

Loading