Towards #3443. This PR enhances the Kubernetes provider to support both .spec.template.metadata and .spec.data[0].metadata. It allows users to define both labels and annotations on the target secret.

⚠️ Both labels and annotations will be pushed by default into the target secret. It is not a opt-in feature and may cause undesired side-effects. Users can opt out by setting targetMergePolicy=Ignore.

👆 this is up for discussion. My point is that it should push the metadata by default, as expected by users described in #3443.

TODOs:

• update documentation
  • write section about metadata support
  • display structure of PushSecretMetadata
  • precedence of metadata
• add spec.targetMergePolicy to control the behaviour when writing the metadata to the target secret, e.g. Merge or Override
• add spec.metadataMergePolicy to control if the source secret metadata (that includes the template metadata) and the .data[].metadata is merged or replaced.

PushSecret Metadata

The Kubernetes provider is able to manage both metadata.labels and metadata.annotations of the secret on the target cluster.

Users have different preferences on what metadata should be pushed. ESO by default pushes both labels and annotations to the target secret and merges them with the existing metadata.

You can specify the metadata in the spec.template.metadata section if you want to decouple it from the existing secret.

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: example
spec:
  # ...
  template:
    metadata:
      labels:
        app.kubernetes.io/part-of: argocd
    data:
      mysql_connection_string: "mysql://{{ .hostname }}:3306/{{ .database }}"
  data:
  - match:
      secretKey: mysql_connection_string
      remoteRef:
        remoteKey: backend_secrets
        property: mysql_connection_string

Further, you can leverage the .data[].metadata section to fine-tine the behaviour of the metadata merge strategy. The metadata section is a versioned custom-resource alike structure, the behaviour is detailed below.

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: example
spec:
  # ...
  data:
  - match:
      secretKey: example-1
      remoteRef:
        remoteKey: example-remote-secret
        property: url
        
    metadata:
      apiVersion: kubernetes.external-secrets.io/v1alpha1
      kind: PushSecretMetadata
      spec:
        sourceMergePolicy: Merge # or Replace
        targetMergePolicy: Merge # or Replace / Ignore
        labels:
          color: red
        annotations:
          yes: please