-
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix ClusterSecretStore; add creds to deployment; fix image tag - see PR
#1 for more * change TLDR to Usage because there's not much read :P * add secret and escape existing {{}} in cluster-secret-stores * add some env vars and readiness probes to our deployment * base64 encode the credentials * allow for setting the secrets keys in an existing secret for credentials * fix existingSecret conditional * bump helm chart verison * install ESO dependency for ci testing * fix trailing spaces for linter * adding @cloudymax's fix for the bitwarden secret keys instead of item IDs * Add example secret Co-authored-by: @cloudymax <[email protected]> * add @cloudymax's example to the README Co-authored-by: @cloudymax <[email protected]> * move example into an examples directory and link it in the readme * Update example-secret.yaml * Update README.md * fix example secret comments * change helm connection test endpoint to `/status` * make renovateBot notice the appVersion as a docker tag to keep up to date * switch to config.js for renovatebot * adding more linter style updates * image tag was wrong 🙃: Added the missing `v` in the version tag * clean up Dockerfile and docker ci, and start using an actual bot account for bitwarden * we're now passing in github token for helm version (to pull latest `helm` release) * change test connection script to just be a mounted configMap and not use busybox (we use `curlimages/curl` now) --------- Co-authored-by: @cloudymax <[email protected]> Co-authored-by: Max! <[email protected]>
- Loading branch information
3 people
committed
Aug 8, 2023
1 parent
a7c42d0
commit a227e95
Showing
16 changed files
with
243 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| module.exports = { | ||
| branchPrefix: 'test-renovate/', | ||
| username: 'renovate-release', | ||
| gitAuthor: 'Renovate Bot <[email protected]>', | ||
| platform: 'github', | ||
| includeForks: true, | ||
| dryRun: 'full', | ||
| repositories: ['jessebot/bitwarden-eso-provider'], | ||
| extends: ['config:base'], | ||
| allowPostUpgradeCommandTemplating: true, | ||
| allowedPostUpgradeCommands: ['^.*'], | ||
| regexManagers: [ | ||
| { | ||
| fileMatch: ['(^|/)Chart\\.yaml$'], | ||
| matchStrings: [ | ||
| '#\\s?renovate: image=(?<depName>.*?)\\s?appVersion:\\s?\\"?(?<currentValue>[\\w+\\.\\-]*)', | ||
| ], | ||
| datasourceTemplate: 'docker', | ||
| }, | ||
| ], | ||
| packageRules: [ | ||
| { | ||
| matchManagers: ['helm-requirements', 'helm-values', 'regex'], | ||
| postUpgradeTasks: { | ||
| commands: [ | ||
| `version=$(grep '^version:' {{{parentDir}}}/Chart.yaml | awk '{print $2}') | ||
| major=$(echo $version | cut -d. -f1) | ||
| minor=$(echo $version | cut -d. -f2) | ||
| patch=$(echo $version | cut -d. -f3) | ||
| minor=$(expr $minor + 1) | ||
| echo "Replacing $version with $major.$minor.$patch" | ||
| sed -i "s/^version:.*/version: $\{major\}.$\{minor\}.$\{patch\}/g" {{{parentDir}}}/Chart.yaml | ||
| cat {{{parentDir}}}/Chart.yaml | ||
| `, | ||
| ], | ||
| }, | ||
| fileFilters: ['**/Chart.yaml'], | ||
| executionMode: 'branch', | ||
| }, | ||
| ], | ||
| }; |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,6 +20,8 @@ jobs: | |
|
|
||
| - name: Install Helm | ||
| uses: azure/[email protected] | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Set up chart-testing | ||
| uses: helm/[email protected] | ||
|
|
@@ -44,4 +46,4 @@ jobs: | |
| - name: Run chart-testing (install) | ||
| id: install | ||
| if: steps.list-changed.outputs.changed == 'true' | ||
| run: ct install --target-branch ${{ github.event.repository.default_branch }} | ||
| run: ct install --target-branch ${{ github.event.repository.default_branch }} --helm-extra-set-args="--set=bitwarden_eso_provider.create_cluster_secret_store=false --set=bitwarden_eso_provider.auth.password=${BOT_PASSWORD} --set=bitwarden_eso_provider.auth.clientID=${BOT_CLIENT_ID} --set=bitwarden_eso_provider.auth.clientSecret=${BOT_CLIENT_SECRET}" | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,4 +14,4 @@ jobs: | |
| uses: renovatebot/[email protected] | ||
| with: | ||
| token: ${{ secrets.RENOVATE_TOKEN }} | ||
| configurationFile: .github/renovate.json | ||
| configurationFile: .github/config.js | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,50 @@ | ||
| # Bitwarden External Secrets Operator Provider | ||
| We followed the [example](https://external-secrets.io/v0.9.2/examples/bitwarden/) over at the ESO docs to create a simple helm chart to deploy the Bitwarden ESO provider without having to spend a bunch of time on it. This project is neither affiliated with the External Secrets Operator, nor the official Bitwarden project. Report bugs here :) | ||
| We, mostly @cloudymax, followed the [example](https://external-secrets.io/v0.9.2/examples/bitwarden/) over at the ESO docs to create a simple helm chart to deploy the Bitwarden ESO provider without having to spend a bunch of time on it. This allows you to use the [`ExternalSecrets` Custom Resource](https://external-secrets.io/latest/introduction/overview/#externalsecret) with Bitwarden. | ||
| This project is neither affiliated with the External Secrets Operator, nor the official Bitwarden project. Report bugs here :) | ||
|
|
||
| ### TLDR | ||
| ## Usage | ||
| For helm, see the [README](./charts/bitwarden-eso-provider/README.md) for full details of the allowed values in `values.yaml`, but this is the gist: | ||
|
|
||
| ```bash | ||
| helm repo add bitwarden-eso-provider https://jessebot.github.io/bitwarden-eso-provider | ||
| helm install my-release bitwarden-eso-provider | ||
| ``` | ||
|
|
||
| # Example Secret | ||
| By default we will create two [`ClusterSecretStore`s](https://external-secrets.io/latest/introduction/overview/#clustersecretstore) for you that can then be accessed when you create a secret like [this](./examples/example-secret.yaml), but also printed below here: | ||
|
|
||
| ```yaml | ||
| --- | ||
| apiVersion: external-secrets.io/v1beta1 | ||
| kind: ExternalSecret | ||
| metadata: | ||
| # this is the name of the ExternalSecret object | ||
| name: cool-secret-4-dogs | ||
| namespace: coolapp4dogs | ||
| spec: | ||
| target: | ||
| # This is the name of the secret in bitwarden | ||
| name: cool-secret | ||
| deletionPolicy: Delete | ||
| template: | ||
| type: Opaque | ||
| data: | ||
| # The kubernetes secret name | ||
| password: |- | ||
| {{ .password }} | ||
| data: | ||
| # the value to pass to the kubernetes secret. | ||
| - secretKey: password | ||
| sourceRef: | ||
| storeRef: | ||
| # Use the `bitwarden-login` store to get `username` and | ||
| # `password` values from a bitwarden secret that does not | ||
| # contain custom fields, Otherwise use `bitwarden-fields' | ||
| name: bitwarden-login | ||
| kind: ClusterSecretStore | ||
| remoteRef: | ||
| # This is the `name` of your bitwarden secret. | ||
| key: <your-secret-name> | ||
| # This is the property of the bitwarden secret that we want | ||
| property: <some-secret-property> | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,11 +7,11 @@ metadata: | |
| spec: | ||
| provider: | ||
| webhook: | ||
| url: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/object/item/{{ .remoteRef.key }}" | ||
| url: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/object/items" | ||
| headers: | ||
| Content-Type: application/json | ||
| result: | ||
| jsonPath: "$.data.login.{{ .remoteRef.property }}" | ||
| jsonPath: "$.data.data[?(@.name=={{`{{ .remoteRef.key }}`}})].login.{{`{{ .remoteRef.property }}`}}" | ||
| --- | ||
| apiVersion: external-secrets.io/v1beta1 | ||
| kind: ClusterSecretStore | ||
|
|
@@ -20,7 +20,7 @@ metadata: | |
| spec: | ||
| provider: | ||
| webhook: | ||
| url: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/object/item/{{ .remoteRef.key }}" | ||
| url: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/object/item/" | ||
| result: | ||
| jsonPath: "$.data.fields[[email protected]==\"{{ .remoteRef.property }}\"].value" | ||
| jsonPath: "$.data.data[?(@.name==\"{{`{{ .remoteRef.key }}`}}\"].fields[[email protected]==\"{{`{{ .remoteRef.property }}`}}\"].value" | ||
| {{- end }} | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| {{- if not .Values.bitwarden_eso_provider.auth.existingSecret }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: {{ .Release.Name }} | ||
| type: Opaque | ||
| data: | ||
| BW_HOST: {{ .Values.bitwarden_eso_provider.auth.host | b64enc | quote }} | ||
| BW_PASSWORD: {{ .Values.bitwarden_eso_provider.auth.password | b64enc | quote}} | ||
| BW_CLIENTID: {{ .Values.bitwarden_eso_provider.auth.clientID | b64enc | quote}} | ||
| BW_CLIENTSECRET: {{ .Values.bitwarden_eso_provider.auth.clientSecret | b64enc | quote}} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7 changes: 7 additions & 0 deletions
7
charts/bitwarden-eso-provider/templates/tests/test-configmap.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: test-connection | ||
| data: | ||
| curl_script.sh: | | ||
| curl http://{{ include "bitwarden-eso-provider.fullname" . }}:{{ .Values.service.port }}/status |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| apiVersion: external-secrets.io/v1beta1 | ||
| kind: ExternalSecret | ||
| metadata: | ||
| # this is the name of the ExternalSecret object | ||
| name: cool-secret-4-dogs | ||
| namespace: coolapp4dogs | ||
| spec: | ||
| target: | ||
| # This is the name of the secret in bitwarden | ||
| name: cool-secret | ||
| deletionPolicy: Delete | ||
| template: | ||
| type: Opaque | ||
| data: | ||
| # The kubernetes secret name | ||
| password: |- | ||
| {{ .password }} | ||
| data: | ||
| # the value to pass to the kubernetes secret. | ||
| - secretKey: password | ||
| sourceRef: | ||
| storeRef: | ||
| # Use the `bitwarden-login` store to get `username` and | ||
| # `password` values from a bitwarden secret that does not | ||
| # contain custom fields, Otherwise use `bitwarden-fields' | ||
| name: bitwarden-login | ||
| kind: ClusterSecretStore | ||
| remoteRef: | ||
| # This is the `name` of your bitwarden secret. | ||
| key: <your-secret-name> | ||
| # This is the property of the bitwarden secret that we want | ||
| property: <some-secret-property> |