Add Conjur Support for FindByName, FindByTag by szh · Pull Request #3364 · external-secrets/external-secrets

szh · 2024-04-11T17:56:55Z

Problem Statement

The Conjur provider does not yet support the FindByName and FindByTag features. It also doesn't support extracting JSON properties from secrets.

Related Issue

CyberArk internal issue ID: CNJR-4505, CNJR-4510

Proposed Changes

Added support for FindByName and FindByTag via GetAllSecrets()
Added support for extracting fields from JSON secrets using the Property attribute, via GetSecret()
Added unit tests for GetSecretMap()
Updated the "Stability and Support" doc page to:
- List the Conjur provider as stable
- Indicate support for FindByName and FindByTag
- Add myself as a maintainer

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

benskelker · 2024-04-16T14:07:39Z

docs/provider/conjur.md

 ```

-### External secret store with apiKey authentication
+### External secret store


@szh - not sure if we need this section, does it anything that isn't stated above?

benskelker · 2024-04-16T14:09:12Z

docs/provider/conjur.md

+* `apikey` - Uses a Conjur `hostid` and `apikey` to authenticate with Conjur.
+* `jwt` - Uses a JWT token to authenticate with Conjur.
+
+#### Option 1: External secret store with apiKey authentication


I'd set this as a level-three heading (###), and move the heading levels below up one

My idea here is that the outline should look like this:

This way External secret store is an L3 heading, with the two options (apikey and jwt) as L4 headings.

@szh, yep, makes sense. but adding a comment to the intro paragraph above

docs/provider/conjur.md

szh · 2024-04-18T18:32:24Z

Rebased on main. Ready for review whenever you are @Skarlso

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

Skarlso · 2024-04-28T07:22:24Z

/ok-to-test sha=9bf160e

Skarlso · 2024-04-28T07:23:50Z

Dang it, why did this fail? 😭 There are no logs.

https://github.com/external-secrets/external-secrets/actions/runs/8852999760/job/24318219100?pr=3364

Skarlso · 2024-04-28T07:34:54Z

/ok-to-test sha=9bf160eba6339c0860e3184a95b6478f6cb660dc

Skarlso · 2024-04-28T07:42:46Z

ah, found it


 
--
Command failed: go env GOPATH go: downloading go1.22 (linux/amd64) go: download go1.22 for linux/amd64: toolchain not available
 

<br class="Apple-interchange-newline">

Skarlso · 2024-04-28T07:51:00Z

@szh Please update go 1.22 to go 1.22.0 as one of our dependencies requires a correct toolchain version now.

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

szh · 2024-04-28T14:36:25Z

@Skarlso done

sonarqubecloud · 2024-04-28T14:36:48Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.3% Duplication on New Code

See analysis details on SonarCloud

Skarlso · 2024-04-28T14:49:55Z

/ok-to-test sha=fef212e

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | patch | `0.9.16` -> `0.9.17` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v0.9.17`](https://github.com/external-secrets/external-secrets/releases/tag/v0.9.17) [Compare Source](external-secrets/external-secrets@v0.9.16...v0.9.17) Image: `ghcr.io/external-secrets/external-secrets:v0.9.17` Image: `ghcr.io/external-secrets/external-secrets:v0.9.17-ubi` Image: `ghcr.io/external-secrets/external-secrets:v0.9.17-ubi-boringssl` #### What's Changed - bump 0.9.16 by [@gusfcarvalho](https://github.com/gusfcarvalho) in external-secrets/external-secrets#3385 - Fix typo in webhook.md by [@Bo0km4n](https://github.com/Bo0km4n) in external-secrets/external-secrets#3388 - Publish the secret updated events only when they are updated by [@shuheiktgw](https://github.com/shuheiktgw) in external-secrets/external-secrets#3293 - Feat/add validations to external secret data from remote ref by [@shuheiktgw](https://github.com/shuheiktgw) in external-secrets/external-secrets#3390 - chore(deps): bump github/codeql-action from 3.24.10 to 3.25.1 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3406 - chore(deps): bump actions/checkout from 4.1.2 to 4.1.3 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3405 - chore(deps): bump regex from 2023.12.25 to 2024.4.16 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3404 - chore(deps): bump mkdocs-material from 9.5.17 to 9.5.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3402 - Fix Azure Container Registry Generator invalid YAML by [@ppatel1604](https://github.com/ppatel1604) in external-secrets/external-secrets#3414 - Update Go and golangci-lint version by [@shuheiktgw](https://github.com/shuheiktgw) in external-secrets/external-secrets#3396 - chore(deps): bump pymdown-extensions from 10.7.1 to 10.8 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3401 - ADOPTERS.md: add Fivetran by [@felipeneuwald](https://github.com/felipeneuwald) in external-secrets/external-secrets#3409 - Add Conjur Support for FindByName, FindByTag by [@szh](https://github.com/szh) in external-secrets/external-secrets#3364 - chore(deps): bump mkdocs from 1.5.3 to 1.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3403 - Add support for specifying extra manifests via helm by [@upodroid](https://github.com/upodroid) in external-secrets/external-secrets#3421 - Methods for managing securityContext and OpenShift support by [@sabre1041](https://github.com/sabre1041) in external-secrets/external-secrets#3420 - Refactor the SecretStore client manager by [@shuheiktgw](https://github.com/shuheiktgw) in external-secrets/external-secrets#3419 - chore(deps): bump golang from `cdc86d9` to `cdc86d9` by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3423 - chore(deps): bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3425 - chore(deps): bump actions/checkout from 4.1.3 to 4.1.4 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3426 - chore(deps): bump github/codeql-action from 3.25.1 to 3.25.3 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3427 - chore(deps): bump helm/kind-action from 1.9.0 to 1.10.0 by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3428 - chore(deps): bump platformdirs from 4.2.0 to 4.2.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3429 - chore(deps): bump pymdown-extensions from 10.8 to 10.8.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3430 - chore(deps): bump regex from 2024.4.16 to 2024.4.28 in /hack/api-docs by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3431 - chore(deps): bump golang from `b03f3ba` to `d0902ba` in /e2e by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3432 - Update common-k8s-secret-types.md to fix get secret jsonpath by [@tyki6](https://github.com/tyki6) in external-secrets/external-secrets#3434 - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app) in external-secrets/external-secrets#3433 - chore(deps): bump distroless/static from `6d31326` to `4197211` by [@dependabot](https://github.com/dependabot) in external-secrets/external-secrets#3424 - Improve bitwarden example by [@imstevenxyz](https://github.com/imstevenxyz) in external-secrets/external-secrets#3435 #### New Contributors - [@Bo0km4n](https://github.com/Bo0km4n) made their first contribution in external-secrets/external-secrets#3388 - [@felipeneuwald](https://github.com/felipeneuwald) made their first contribution in external-secrets/external-secrets#3409 - [@upodroid](https://github.com/upodroid) made their first contribution in external-secrets/external-secrets#3421 - [@sabre1041](https://github.com/sabre1041) made their first contribution in external-secrets/external-secrets#3420 - [@tyki6](https://github.com/tyki6) made their first contribution in external-secrets/external-secrets#3434 - [@imstevenxyz](https://github.com/imstevenxyz) made their first contribution in external-secrets/external-secrets#3435 **Full Changelog**: external-secrets/external-secrets@v0.9.16...v0.9.17 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.internal/nrdufour/home-ops/pulls/460 Co-authored-by: Renovate <renovate@ptinem.casa> Co-committed-by: Renovate <renovate@ptinem.casa>

Signed-off-by: Bude8 <henryblee8@gmail.com>

Signed-off-by: Bill Hamilton <bill.hamilton@delinea.com>

szh force-pushed the conjur-findbyname branch 4 times, most recently from 61127dc to bf9f20e Compare April 11, 2024 20:35

szh marked this pull request as ready for review April 11, 2024 20:36

szh requested a review from a team as a code owner April 11, 2024 20:36

szh requested a review from Skarlso April 11, 2024 20:36

szh force-pushed the conjur-findbyname branch 6 times, most recently from 024a17f to 343f48a Compare April 16, 2024 13:15