Skip to content

Commit 1be7dae

Browse files
thesuperzapperSkarlso
thesuperzapper
and
Skarlso
authored
feat: add CRD validation for resource name/key fields (external-secrets#4104)
* Add CRD validation for name/key fields Signed-off-by: Mathew Wicks <[email protected]> * add output of check-diff Signed-off-by: Gergely Brautigam <[email protected]> --------- Signed-off-by: Mathew Wicks <[email protected]> Signed-off-by: Gergely Brautigam <[email protected]> Co-authored-by: Gergely Brautigam <[email protected]>
1 parent 08566af commit 1be7dae

27 files changed

+8515
-2470
lines changed

‎apis/externalsecrets/v1alpha1/externalsecret_types.go

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,15 @@ import (
2222
// SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
2323
type SecretStoreRef struct {
2424
// Name of the SecretStore resource
25-
Name string `json:"name"`
25+
// +kubebuilder:validation:MinLength:=1
26+
// +kubebuilder:validation:MaxLength:=253
27+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
28+
Name string `json:"name,omitempty"`
2629

2730
// Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
2831
// Defaults to `SecretStore`
2932
// +optional
33+
// +kubebuilder:validation:Enum=SecretStore;ClusterSecretStore
3034
Kind string `json:"kind,omitempty"`
3135
}
3236

@@ -92,25 +96,37 @@ type TemplateFrom struct {
9296
}
9397

9498
type TemplateRef struct {
95-
Name string `json:"name"`
99+
// The name of the ConfigMap/Secret resource
100+
// +kubebuilder:validation:MinLength:=1
101+
// +kubebuilder:validation:MaxLength:=253
102+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
103+
Name string `json:"name"`
104+
105+
// A list of keys in the ConfigMap/Secret to use as templates for Secret data
96106
Items []TemplateRefItem `json:"items"`
97107
}
98108

99109
type TemplateRefItem struct {
110+
// A key in the ConfigMap/Secret
111+
// +kubebuilder:validation:MinLength:=1
112+
// +kubebuilder:validation:MaxLength:=253
113+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
100114
Key string `json:"key"`
101115
}
102116

103117
// ExternalSecretTarget defines the Kubernetes Secret to be created
104118
// There can be only one target per ExternalSecret.
105119
type ExternalSecretTarget struct {
106-
// Name defines the name of the Secret resource to be managed
107-
// This field is immutable
120+
// The name of the Secret resource to be managed.
108121
// Defaults to the .metadata.name of the ExternalSecret resource
109122
// +optional
123+
// +kubebuilder:validation:MinLength:=1
124+
// +kubebuilder:validation:MaxLength:=253
125+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
110126
Name string `json:"name,omitempty"`
111127

112-
// CreationPolicy defines rules on how to create the resulting Secret
113-
// Defaults to 'Owner'
128+
// CreationPolicy defines rules on how to create the resulting Secret.
129+
// Defaults to "Owner"
114130
// +optional
115131
// +kubebuilder:default="Owner"
116132
CreationPolicy ExternalSecretCreationPolicy `json:"creationPolicy,omitempty"`
@@ -126,6 +142,10 @@ type ExternalSecretTarget struct {
126142

127143
// ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.
128144
type ExternalSecretData struct {
145+
// The key in the Kubernetes Secret to store the value.
146+
// +kubebuilder:validation:MinLength:=1
147+
// +kubebuilder:validation:MaxLength:=253
148+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
129149
SecretKey string `json:"secretKey"`
130150

131151
RemoteRef ExternalSecretDataRemoteRef `json:"remoteRef"`
@@ -140,11 +160,12 @@ type ExternalSecretDataRemoteRef struct {
140160
// +optional
141161
Version string `json:"version,omitempty"`
142162

143-
// +optional
144163
// Used to select a specific property of the Provider value (if a map), if supported
145-
Property string `json:"property,omitempty"`
146164
// +optional
165+
Property string `json:"property,omitempty"`
166+
147167
// Used to define a conversion Strategy
168+
// +optional
148169
// +kubebuilder:default="Default"
149170
ConversionStrategy ExternalSecretConversionStrategy `json:"conversionStrategy,omitempty"`
150171
}

‎apis/externalsecrets/v1alpha1/pushsecret_types.go

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,19 @@ const (
3030
type PushSecretStoreRef struct {
3131
// Optionally, sync to the SecretStore of the given name
3232
// +optional
33+
// +kubebuilder:validation:MinLength:=1
34+
// +kubebuilder:validation:MaxLength:=253
35+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
3336
Name string `json:"name,omitempty"`
37+
3438
// Optionally, sync to secret stores with label selector
3539
// +optional
3640
LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
41+
3742
// Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
38-
// Defaults to `SecretStore`
39-
// +kubebuilder:default="SecretStore"
4043
// +optional
44+
// +kubebuilder:default="SecretStore"
45+
// +kubebuilder:validation:Enum=SecretStore;ClusterSecretStore
4146
Kind string `json:"kind,omitempty"`
4247
}
4348

@@ -68,27 +73,37 @@ const (
6873
// PushSecretSpec configures the behavior of the PushSecret.
6974
type PushSecretSpec struct {
7075
// The Interval to which External Secrets will try to push a secret definition
71-
RefreshInterval *metav1.Duration `json:"refreshInterval,omitempty"`
76+
RefreshInterval *metav1.Duration `json:"refreshInterval,omitempty"`
77+
7278
SecretStoreRefs []PushSecretStoreRef `json:"secretStoreRefs"`
73-
// UpdatePolicy to handle Secrets in the provider. Possible Values: "Replace/IfNotExists". Defaults to "Replace".
79+
80+
// UpdatePolicy to handle Secrets in the provider.
7481
// +kubebuilder:default="Replace"
7582
// +optional
7683
UpdatePolicy PushSecretUpdatePolicy `json:"updatePolicy,omitempty"`
77-
// Deletion Policy to handle Secrets in the provider. Possible Values: "Delete/None". Defaults to "None".
84+
85+
// Deletion Policy to handle Secrets in the provider.
7886
// +kubebuilder:default="None"
7987
// +optional
8088
DeletionPolicy PushSecretDeletionPolicy `json:"deletionPolicy,omitempty"`
89+
8190
// The Secret Selector (k8s source) for the Push Secret
8291
Selector PushSecretSelector `json:"selector"`
92+
8393
// Secret Data that should be pushed to providers
8494
Data []PushSecretData `json:"data,omitempty"`
95+
8596
// Template defines a blueprint for the created Secret resource.
8697
// +optional
8798
Template *esv1beta1.ExternalSecretTemplate `json:"template,omitempty"`
8899
}
89100

90101
type PushSecretSecret struct {
91-
// Name of the Secret. The Secret must exist in the same namespace as the PushSecret manifest.
102+
// Name of the Secret.
103+
// The Secret must exist in the same namespace as the PushSecret manifest.
104+
// +kubebuilder:validation:MinLength:=1
105+
// +kubebuilder:validation:MaxLength:=253
106+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
92107
Name string `json:"name"`
93108
}
94109

‎apis/externalsecrets/v1alpha1/secretstore_kubernetes_types.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,11 @@ type KubernetesProvider struct {
5050
Auth KubernetesAuth `json:"auth"`
5151

5252
// Remote namespace to fetch the secrets from
53-
// +kubebuilder:default= default
5453
// +optional
54+
// +kubebuilder:default=default
55+
// +kubebuilder:validation:MinLength:=1
56+
// +kubebuilder:validation:MaxLength:=63
57+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
5558
RemoteNamespace string `json:"remoteNamespace,omitempty"`
5659
}
5760

‎apis/externalsecrets/v1alpha1/secretstore_vault_types.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,23 @@ type CAProvider struct {
3939
Type CAProviderType `json:"type"`
4040

4141
// The name of the object located at the provider type.
42+
// +kubebuilder:validation:MinLength:=1
43+
// +kubebuilder:validation:MaxLength:=253
44+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
4245
Name string `json:"name"`
4346

44-
// The key the value inside of the provider type to use, only used with "Secret" type
47+
// The key where the CA certificate can be found in the Secret or ConfigMap.
4548
// +kubebuilder:validation:Optional
49+
// +kubebuilder:validation:MinLength:=1
50+
// +kubebuilder:validation:MaxLength:=253
51+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
4652
Key string `json:"key,omitempty"`
4753

4854
// The namespace the Provider type is in.
4955
// +optional
56+
// +kubebuilder:validation:MinLength:=1
57+
// +kubebuilder:validation:MaxLength:=63
58+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
5059
Namespace *string `json:"namespace,omitempty"`
5160
}
5261

‎apis/externalsecrets/v1alpha1/secretstore_webhook_types.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,14 +75,23 @@ type WebhookCAProvider struct {
7575
Type WebhookCAProviderType `json:"type"`
7676

7777
// The name of the object located at the provider type.
78+
// +kubebuilder:validation:MinLength:=1
79+
// +kubebuilder:validation:MaxLength:=253
80+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
7881
Name string `json:"name"`
7982

80-
// The key the value inside of the provider type to use, only used with "Secret" type
83+
// The key where the CA certificate can be found in the Secret or ConfigMap.
8184
// +kubebuilder:validation:Optional
85+
// +kubebuilder:validation:MinLength:=1
86+
// +kubebuilder:validation:MaxLength:=253
87+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
8288
Key string `json:"key,omitempty"`
8389

8490
// The namespace the Provider type is in.
8591
// +optional
92+
// +kubebuilder:validation:MinLength:=1
93+
// +kubebuilder:validation:MaxLength:=63
94+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
8695
Namespace *string `json:"namespace,omitempty"`
8796
}
8897

‎apis/externalsecrets/v1beta1/clusterexternalsecret_types.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,12 @@ type ClusterExternalSecretSpec struct {
2424
// The spec for the ExternalSecrets to be created
2525
ExternalSecretSpec ExternalSecretSpec `json:"externalSecretSpec"`
2626

27-
// The name of the external secrets to be created defaults to the name of the ClusterExternalSecret
27+
// The name of the external secrets to be created.
28+
// Defaults to the name of the ClusterExternalSecret
2829
// +optional
30+
// +kubebuilder:validation:MinLength:=1
31+
// +kubebuilder:validation:MaxLength:=253
32+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
2933
ExternalSecretName string `json:"externalSecretName,omitempty"`
3034

3135
// The metadata of the external secrets to be created
@@ -43,6 +47,9 @@ type ClusterExternalSecretSpec struct {
4347

4448
// Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
4549
// +optional
50+
// +kubebuilder:validation:items:MinLength:=1
51+
// +kubebuilder:validation:items:MaxLength:=63
52+
// +kubebuilder:validation:items:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
4653
Namespaces []string `json:"namespaces,omitempty"`
4754

4855
// The time in which the controller should reconcile its objects and recheck namespaces for labels.

‎apis/externalsecrets/v1beta1/externalsecret_types.go

Lines changed: 43 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,15 @@ import (
2222
// SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
2323
type SecretStoreRef struct {
2424
// Name of the SecretStore resource
25-
Name string `json:"name"`
25+
// +kubebuilder:validation:MinLength:=1
26+
// +kubebuilder:validation:MaxLength:=253
27+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
28+
Name string `json:"name,omitempty"`
2629

2730
// Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
2831
// Defaults to `SecretStore`
2932
// +optional
33+
// +kubebuilder:validation:Enum=SecretStore;ClusterSecretStore
3034
Kind string `json:"kind,omitempty"`
3135
}
3236

@@ -92,12 +96,16 @@ type ExternalSecretTemplate struct {
9296
// template specified in .data and .templateFrom[].
9397
// +kubebuilder:default="v2"
9498
EngineVersion TemplateEngineVersion `json:"engineVersion,omitempty"`
99+
95100
// +optional
96101
Metadata ExternalSecretTemplateMetadata `json:"metadata,omitempty"`
102+
97103
// +kubebuilder:default="Replace"
98104
MergePolicy TemplateMergePolicy `json:"mergePolicy,omitempty"`
105+
99106
// +optional
100107
Data map[string]string `json:"data,omitempty"`
108+
101109
// +optional
102110
TemplateFrom []TemplateFrom `json:"templateFrom,omitempty"`
103111
}
@@ -121,10 +129,11 @@ const (
121129
type TemplateFrom struct {
122130
ConfigMap *TemplateRef `json:"configMap,omitempty"`
123131
Secret *TemplateRef `json:"secret,omitempty"`
124-
// +optional
132+
125133
// +optional
126134
// +kubebuilder:default="Data"
127135
Target TemplateTarget `json:"target,omitempty"`
136+
128137
// +optional
129138
Literal *string `json:"literal,omitempty"`
130139
}
@@ -147,35 +156,50 @@ const (
147156
)
148157

149158
type TemplateRef struct {
150-
Name string `json:"name"`
159+
// The name of the ConfigMap/Secret resource
160+
// +kubebuilder:validation:MinLength:=1
161+
// +kubebuilder:validation:MaxLength:=253
162+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
163+
Name string `json:"name"`
164+
165+
// A list of keys in the ConfigMap/Secret to use as templates for Secret data
151166
Items []TemplateRefItem `json:"items"`
152167
}
153168

154169
type TemplateRefItem struct {
170+
// A key in the ConfigMap/Secret
171+
// +kubebuilder:validation:MinLength:=1
172+
// +kubebuilder:validation:MaxLength:=253
173+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
155174
Key string `json:"key"`
175+
156176
// +kubebuilder:default="Values"
157177
TemplateAs TemplateScope `json:"templateAs,omitempty"`
158178
}
159179

160180
// ExternalSecretTarget defines the Kubernetes Secret to be created
161181
// There can be only one target per ExternalSecret.
162182
type ExternalSecretTarget struct {
163-
// Name defines the name of the Secret resource to be managed
164-
// This field is immutable
183+
// The name of the Secret resource to be managed.
165184
// Defaults to the .metadata.name of the ExternalSecret resource
166185
// +optional
186+
// +kubebuilder:validation:MinLength:=1
187+
// +kubebuilder:validation:MaxLength:=253
188+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
167189
Name string `json:"name,omitempty"`
168190

169-
// CreationPolicy defines rules on how to create the resulting Secret
170-
// Defaults to 'Owner'
191+
// CreationPolicy defines rules on how to create the resulting Secret.
192+
// Defaults to "Owner"
171193
// +optional
172194
// +kubebuilder:default="Owner"
173195
CreationPolicy ExternalSecretCreationPolicy `json:"creationPolicy,omitempty"`
174-
// DeletionPolicy defines rules on how to delete the resulting Secret
175-
// Defaults to 'Retain'
196+
197+
// DeletionPolicy defines rules on how to delete the resulting Secret.
198+
// Defaults to "Retain"
176199
// +optional
177200
// +kubebuilder:default="Retain"
178201
DeletionPolicy ExternalSecretDeletionPolicy `json:"deletionPolicy,omitempty"`
202+
179203
// Template defines a blueprint for the created Secret resource.
180204
// +optional
181205
Template *ExternalSecretTemplate `json:"template,omitempty"`
@@ -187,16 +211,18 @@ type ExternalSecretTarget struct {
187211

188212
// ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.
189213
type ExternalSecretData struct {
190-
// SecretKey defines the key in which the controller stores
191-
// the value. This is the key in the Kind=Secret
214+
// The key in the Kubernetes Secret to store the value.
215+
// +kubebuilder:validation:MinLength:=1
216+
// +kubebuilder:validation:MaxLength:=253
217+
// +kubebuilder:validation:Pattern:=^[-._a-zA-Z0-9]+$
192218
SecretKey string `json:"secretKey"`
193219

194220
// RemoteRef points to the remote secret and defines
195221
// which secret (version/property/..) to fetch.
196222
RemoteRef ExternalSecretDataRemoteRef `json:"remoteRef"`
197223

198224
// SourceRef allows you to override the source
199-
// from which the value will pulled from.
225+
// from which the value will be pulled.
200226
SourceRef *StoreSourceRef `json:"sourceRef,omitempty"`
201227
}
202228

@@ -338,6 +364,7 @@ type FindName struct {
338364
type ExternalSecretSpec struct {
339365
// +optional
340366
SecretStoreRef SecretStoreRef `json:"secretStoreRef,omitempty"`
367+
341368
// +kubebuilder:default={creationPolicy:Owner,deletionPolicy:Retain}
342369
// +optional
343370
Target ExternalSecretTarget `json:"target,omitempty"`
@@ -395,7 +422,11 @@ type GeneratorRef struct {
395422
APIVersion string `json:"apiVersion,omitempty"`
396423
// Specify the Kind of the resource, e.g. Password, ACRAccessToken, ClusterGenerator etc.
397424
Kind string `json:"kind"`
425+
398426
// Specify the name of the generator resource
427+
// +kubebuilder:validation:MinLength:=1
428+
// +kubebuilder:validation:MaxLength:=253
429+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
399430
Name string `json:"name"`
400431
}
401432

‎apis/externalsecrets/v1beta1/secretstore_kubernetes_types.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,11 @@ type KubernetesProvider struct {
4949
AuthRef *esmeta.SecretKeySelector `json:"authRef,omitempty"`
5050

5151
// Remote namespace to fetch the secrets from
52-
// +kubebuilder:default= default
5352
// +optional
53+
// +kubebuilder:default=default
54+
// +kubebuilder:validation:MinLength:=1
55+
// +kubebuilder:validation:MaxLength:=63
56+
// +kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
5457
RemoteNamespace string `json:"remoteNamespace,omitempty"`
5558
}
5659

0 commit comments

Comments
 (0)