feat: configure secrets for initcontainers (#29)

cloudkite-io · Apr 19, 2024 · 69e3906 · 69e3906
1 parent 8d6e2de
commit 69e3906
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 1 deletion.
diff --git a/standard-app/Chart.yaml b/standard-app/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: standard-app
 description: A Helm chart library by Cloudkite
 type: application
-version: 0.4.1
+version: 0.4.2
 maintainters:
   - email: [email protected]
     name: cloudkite
diff --git a/standard-app/templates/configs/externalsecret.yaml b/standard-app/templates/configs/externalsecret.yaml
@@ -3,6 +3,43 @@
 # deployment secrets
 {{- range $appName, $appConfig := .Values.apps }}
 
+# deployment initcontainer secret
+{{- range $initContainerName, $initContainerConfig := $appConfig.initContainers -}}
+{{- if $initContainerConfig.secrets }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: {{ $initContainerName }}
+  labels:
+    app: {{ $appName }}
+    product: {{ $.Release.Name }}
+    {{- with $.Values.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: {{ $.Values.externalSecret.secretStoreName }}
+  target:
+    name: {{ $initContainerName }}
+    creationPolicy: Owner
+  data:
+  {{- range $secret := $initContainerConfig.secrets }}
+  - secretKey: {{ $secret.secretKey }}
+    remoteRef:
+    {{- if eq $.Values.externalSecret.type "gcp" }}
+      key: {{ $.Release.Name | upper }}_{{ $secret }}
+    {{- end }}
+    {{- if eq $.Values.externalSecret.type "vault" }}
+      key: {{ $.Values.externalSecret.secretPath }}/{{ $.Release.Name }}
+      property: {{ $secret.property | default $secret.secretKey }}
+    {{- end }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
+
 # deployment container secret
 {{- range $containerName, $containerConfig := $appConfig.containers -}}
 {{- if $containerConfig.secrets }}