feat(provider): add Barbican provider support#5398
feat(provider): add Barbican provider support#5398Skarlso merged 23 commits intoexternal-secrets:mainfrom
Conversation
9c3a9a2 to
b515b62
Compare
|
fixed license, it was in a different comment format. make check-diff is no longer running properly on mac arm, I should take some time to see that... |
|
That's interesting. I'm running mac arm and it's fine. 🤔 |
|
|
I also find interesting... LoL |
It run successfully. 🤔 |
|
I found the issue, it was with lima vm. Fast mode: Intel containers on ARM VM on ARM Host / ARM containers on Intel VM on Intel Host worked like a charm... |
b515b62 to
2ca4e88
Compare
Skarlso
left a comment
There was a problem hiding this comment.
There are a bunch of other problems, but I'll take a look at those once the obvious ones are gone. :)
cba5bbd to
f944f8f
Compare
|
do you have new checks ? locally check-diff and fmt are all ok. maybe my branch is no up to date |
it seems it changed to "esutils"... |
239032f to
8652d27
Compare
|
Oh so it's okay now, right? |
|
I will review this again hopefully today. :) |
|
The move was that we put providers under |
Skarlso
left a comment
There was a problem hiding this comment.
Two remarks then we are good. :)
8652d27 to
ea818ff
Compare
Signed-off-by: Rodrigo Kellermann <kellermann@gmail.com>
|
Could you please take care of the unused parameter errors? :) |
Signed-off-by: Rodrigo Kellermann <kellermann@gmail.com>
I changed then to not used _ Still complaining about "GetPayload" mock, but then its the expected interface name |
gusfcarvalho
left a comment
There was a problem hiding this comment.
thanks for these changes 😄 it looks much cleaner as a front-end for users
|
tests erros seems not my fault... |
|
I'm not a 100% sure it's not the pr's fault. :D |
|
Yeah, on this pr it fails locally as well. Main it does not fail. So definitely this PR. |
locally it was clean... I will get latest updates, as main was merged. |
|
yeah... with latest it breaks... but break at points I didn't touch :) |
providers/v1/barbican/provider.go
Outdated
| // ProviderSpec returns a sample Barbican provider spec. | ||
| func ProviderSpec() *esv1.SecretStoreProvider { | ||
| return &esv1.SecretStoreProvider{ | ||
| SecretServer: &esv1.SecretServerProvider{}, |
There was a problem hiding this comment.
This is incorrect. It's a wonder how this worked. 🤔
There was a problem hiding this comment.
// ProviderSpec returns a sample Barbican provider spec.
func ProviderSpec() *esv1.SecretStoreProvider {
return &esv1.SecretStoreProvider{
Barbican: &esv1.BarbicanProvider{},
}
}There was a problem hiding this comment.
it was the refactor...
There was a problem hiding this comment.
I will test properly...
There was a problem hiding this comment.
Yeah, no worries. It's okay once this is fixed and the chart upgrade PR is in, this can be merged. :)
There was a problem hiding this comment.
make test is clean now.
I will setup my env to test it with OS, but later today.
There was a problem hiding this comment.
I have to update doc snippets with new Auth map
There was a problem hiding this comment.
$ go build -tags all_providers -o external-secrets main.go
$ go run -tags all_providers main.go
$ kubectl get SecretStore -A
NAMESPACE NAME AGE STATUS CAPABILITIES READY
default barbican 13m Valid ReadOnly True
$ kubectl get ExternalSecret
NAME STORETYPE STORE REFRESH INTERVAL STATUS READY
barbican-external-secret SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-02 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-03 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-03-1 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-03-2 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-03-3 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-03-4 SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-certificate SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-from SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-passphrase SecretStore barbican 1h0m0s SecretSynced True
barbican-external-secret-pub-ssh-key SecretStore barbican 1h0m0s SecretSynced True
$ kubectl get secrets
NAME TYPE DATA AGE
barbican-result-certificate Opaque 1 20s
barbican-result-pub-ssh-key Opaque 1 20s
barbican-result-secret-02 Opaque 1 23s
barbican-result-secret-03 Opaque 1 23s
barbican-result-secret-03-1 Opaque 1 22s
barbican-result-secret-03-2 Opaque 2 22s
barbican-result-secret-03-3 Opaque 1 21s
barbican-result-secret-03-4 Opaque 2 21s
barbican-result-secret-test Opaque 2 19s
barbican-result-test-from Opaque 4 19s
barbican-result-test-passphrase Opaque 3 20s
$ kubectl get secrets barbican-result-secret-03 -o yaml
apiVersion: v1
data:
test03: xxx
kind: Secret
name: barbican-result-secret-03
namespace: default
ownerReferences:
- apiVersion: external-secrets.io/v1
blockOwnerDeletion: true
controller: true
kind: ExternalSecret
name: barbican-external-secret-03
uid: cf2f9d38-496e-4ce7-9bfb-d38f61fc0cc7
resourceVersion: "2752509"
uid: 5b223c1b-0a09-442b-bf0d-f076cd62f1e2
type: Opaque
Signed-off-by: Rodrigo Kellermann <kellermann@gmail.com>
Signed-off-by: Rodrigo Kellermann <kellermann@gmail.com>
|
|
Skarlso
left a comment
There was a problem hiding this comment.
Thank you very much for this work and thanks for sticking with it!
Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Co-authored-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com> Signed-off-by: Alvin Wong <alvin.wong@forgerock.com>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: bump 1.1.1 by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@​Skarlso](https://github.com/Skarlso) in [#​5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@​rkferreira](https://github.com/rkferreira) in [#​5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@​DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#​5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@​Ilhan-Personal](https://github.com/Ilhan-Personal) in [#​5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@​iypetrov](https://github.com/iypetrov) in [#​5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@​tokiwong](https://github.com/tokiwong) in [#​5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@​Gabryel8818](https://github.com/Gabryel8818) in [#​5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@​mikesellitto](https://github.com/mikesellitto) in [#​5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@​Skarlso](https://github.com/Skarlso) in [#​5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@​Skarlso](https://github.com/Skarlso) in [#​5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@​lostick](https://github.com/lostick) in [#​5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@​evrardjp](https://github.com/evrardjp) in [#​5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@​evrardjp](https://github.com/evrardjp) in [#​5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@​cmoscofian](https://github.com/cmoscofian) in [#​5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@​headcr4sh](https://github.com/headcr4sh) in [#​5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@​DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#​5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@​tosih](https://github.com/tosih) in [#​5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@​Skarlso](https://github.com/Skarlso) in [#​5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@​jakobmoellerdev](https://github.com/jakobmoellerdev) in [#​5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@​jakobmoellerdev](https://github.com/jakobmoellerdev) in [#​5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5723](external-secrets/external-secrets#5723) #### New Contributors - [@​iypetrov](https://github.com/iypetrov) made their first contribution in [#​5685](external-secrets/external-secrets#5685) - [@​tokiwong](https://github.com/tokiwong) made their first contribution in [#​5708](external-secrets/external-secrets#5708) - [@​Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#​5652](external-secrets/external-secrets#5652) - [@​mikesellitto](https://github.com/mikesellitto) made their first contribution in [#​5475](external-secrets/external-secrets#5475) - [@​lostick](https://github.com/lostick) made their first contribution in [#​5736](external-secrets/external-secrets#5736) - [@​cmoscofian](https://github.com/cmoscofian) made their first contribution in [#​5622](external-secrets/external-secrets#5622) - [@​headcr4sh](https://github.com/headcr4sh) made their first contribution in [#​5745](external-secrets/external-secrets#5745) - [@​tosih](https://github.com/tosih) made their first contribution in [#​5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhcnQiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>



Problem Statement
Create Openstack Barbican provider to use with k8s in Openstack.
Related Issue
No issue.
Proposed Changes
Create read only Barbican provider
Format
Ok.
Checklist
git commit --signoffmake testmake reviewable