chore: refactor/centralise secretKeyRef usage by moolen · Pull Request #3022 · external-secrets/external-secrets

moolen · 2024-01-13T20:06:53Z

This PR standardizes and centralizes the secret fetching process. This is to avoid having too much duplication across providers and to secure it.

moolen · 2024-01-13T21:15:14Z

/ok-to-test-managed sha=c7daf16 provider=aws

moolen · 2024-01-13T21:15:18Z

/ok-to-test-managed sha=c7daf16 provider=gcp

moolen · 2024-01-13T21:15:26Z

/ok-to-test-managed sha=c7daf16 provider=azure

Skarlso · 2024-01-19T19:57:27Z

Ooo. Is that sonar issue new?

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

moolen · 2024-01-19T20:56:50Z

fixed the duplication issues, i'll tackle the cognitive complexity one separately, i want to restructure & refactor the vault provider. It's not maintainable 😆 🫠

pkg/generator/gcr/gcr.go

pkg/provider/akeyless/akeyless.go

pkg/provider/alibaba/kms.go

pkg/utils/secret_ref.go

Skarlso

LGTM with a few suggests and findings. :) Well done! :)))

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

sonarqubecloud · 2024-01-20T21:15:13Z

Quality Gate passed

The SonarCloud Quality Gate passed, but some issues were introduced.

1 New issue
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

moolen · 2024-01-20T21:35:41Z

Thank you @Skarlso for your review and the good suggestions, much appreciated! 🙇

Skarlso

Thanks! Looks fantastic. Nice work doing this. The codebase got a lot better. 😊

Skarlso · 2024-01-21T07:17:52Z

pkg/generator/gcr/gcr.go

 		SecretRef:        (*esv1beta1.GCPSMAuthSecretRef)(res.Spec.Auth.SecretRef),
 		WorkloadIdentity: (*esv1beta1.GCPWorkloadIdentity)(res.Spec.Auth.WorkloadIdentity),
-	}, res.Spec.ProjectID, false, kube, namespace)
+	}, res.Spec.ProjectID, resolvers.EmptyStoreKind, kube, namespace)


❤️❤️

Skarlso · 2024-01-21T07:19:30Z

pkg/utils/resolvers/secret_ref.go

+	// cannot be resolved across namespaces.
+	// TODO: when we implement cluster-scoped generators
+	// we can remove this and replace it with a interface.
+	EmptyStoreKind = "EmptyStoreKind"


* chore: refactor/centralise secretKeyRef usage Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Sai Charan Godasi <saicharangodasi@Sais-MacBook-Air.local>

* chore: refactor/centralise secretKeyRef usage Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

* main: (38 commits) chore: bump ubi image (external-secrets#3096) 🧹 refactor vault provider (external-secrets#3072) chore(deps): bump alpine from `51b6726` to `c5b1261` (external-secrets#3087) chore(deps): bump golang from `c4b696f` to `d8c365d` in /e2e (external-secrets#3084) chore(deps): bump github/codeql-action from 3.23.1 to 3.23.2 (external-secrets#3089) chore(deps): bump alpine from `51b6726` to `c5b1261` in /hack/api-docs (external-secrets#3088) chore(deps): bump golang from `fd78f2f` to `a6a7f1f` (external-secrets#3086) chore(deps): bump codecov/codecov-action from 3.1.4 to 3.1.5 (external-secrets#3090) IBM provider: remove deprecated code for fetching secret by name (external-secrets#3078) chore: bump jwx pkg (external-secrets#3075) added metrics support for akeyless (external-secrets#3069) chore: update dependencies (external-secrets#3065) chore(deps): bump markupsafe from 2.1.3 to 2.1.4 in /hack/api-docs (external-secrets#3062) chore(deps): bump mkdocs-minify-plugin in /hack/api-docs (external-secrets#3063) chore: add tests for AWS/SM (external-secrets#3057) chore(deps): bump alpine from 3.18 to 3.19 in /hack/api-docs (external-secrets#3039) feat: expose admission warnings to ValidateStore interface (external-secrets#3058) chore: fixup security response suggestions (external-secrets#3056) chore: refactor/centralise secretKeyRef usage (external-secrets#3022) Fix wrong namespaceSelector configuration in snippet in document (external-secrets#3054) ...

* chore: refactor/centralise secretKeyRef usage Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

moolen force-pushed the mj-refactor-secretRef branch from 6dbe631 to 415e7b0 Compare January 13, 2024 20:14

moolen marked this pull request as ready for review January 13, 2024 20:52

moolen requested a review from a team as a code owner January 13, 2024 20:52

moolen requested review from gusfcarvalho and removed request for a team January 13, 2024 20:52

moolen force-pushed the mj-refactor-secretRef branch from 415e7b0 to c7daf16 Compare January 13, 2024 21:10

moolen force-pushed the mj-refactor-secretRef branch from c7daf16 to 3fdaaa7 Compare January 19, 2024 19:37

moolen force-pushed the mj-refactor-secretRef branch from 3fdaaa7 to f59ad1c Compare January 19, 2024 20:26

chore: refactor/centralise secretKeyRef usage

4a160cf

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

moolen force-pushed the mj-refactor-secretRef branch from f59ad1c to 4a160cf Compare January 19, 2024 20:54