Skip to content

Commit d5171ca

Browse files
warroyowarroyo
committed
adding opaque secret functionality to k8s secret resource
Signed-off-by: Will Arroyo <warroyo7199008@gmail.com>
1 parent 102b2ad commit d5171ca

File tree

14 files changed

+401
-73
lines changed

14 files changed

+401
-73
lines changed

‎docs/data-sources/kubernetes_secret.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ Read-Only:
116116
Read-Only:
117117

118118
- `docker_config_json` (List of Object) (see [below for nested schema](#nestedobjatt--spec--docker_config_json))
119+
- `opaque` (Map of String)
119120

120121
<a id="nestedobjatt--spec--docker_config_json"></a>
121122
### Nested Schema for `spec.docker_config_json`
@@ -217,6 +218,7 @@ Read-Only:
217218
Read-Only:
218219

219220
- `docker_config_json` (List of Object) (see [below for nested schema](#nestedobjatt--spec--docker_config_json))
221+
- `opaque` (Map of String)
220222

221223
<a id="nestedobjatt--spec--docker_config_json"></a>
222224
### Nested Schema for `spec.docker_config_json`

‎docs/resources/kubernetes_secret.md‎

Lines changed: 64 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ Only one scope per resource is allowed.
3636

3737
```terraform
3838
# Create Tanzu Mission Control kubernetes secret with attached set as default value.
39-
resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
39+
# Example for creating the dockerconfigjson secret
40+
resource "tanzu-mission-control_kubernetes_secret" "create_dockerconfigjson_secret" {
4041
name = "tf-secret" # Required
4142
namespace_name = "tf-secret-namespace-name" # Required
4243
@@ -63,6 +64,34 @@ resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
6364
}
6465
}
6566
}
67+
68+
# Example for creating the opaque secret
69+
resource "tanzu-mission-control_kubernetes_secret" "create_opaque_secret" {
70+
name = "tf-secret" # Required
71+
namespace_name = "tf-secret-namespace-name" # Required
72+
73+
scope {
74+
cluster {
75+
name = "testcluster" # Required
76+
provisioner_name = "attached" # Default: attached
77+
management_cluster_name = "attached" # Default: attached
78+
}
79+
}
80+
81+
export = false # Default: false
82+
83+
meta {
84+
description = "Create namespace through terraform"
85+
labels = { "key" : "value" }
86+
}
87+
88+
spec {
89+
opaque = {
90+
"key1" : "value1"
91+
"key2" : "value2"
92+
}
93+
}
94+
}
6695
```
6796

6897
<!-- schema generated by tfplugindocs -->
@@ -119,9 +148,10 @@ Required:
119148
<a id="nestedblock--spec"></a>
120149
### Nested Schema for `spec`
121150

122-
Required:
151+
Optional:
123152

124-
- `docker_config_json` (Block List, Min: 1) SecretType definition - SECRET_TYPE_DOCKERCONFIGJSON, Kubernetes secrets type. (see [below for nested schema](#nestedblock--spec--docker_config_json))
153+
- `docker_config_json` (Block List) SecretType definition - SECRET_TYPE_DOCKERCONFIGJSON, Kubernetes secrets type. (see [below for nested schema](#nestedblock--spec--docker_config_json))
154+
- `opaque` (Map of String, Sensitive) SecretType definition - SECRET_TYPE_OPAQUE, Kubernetes secrets type.
125155

126156
<a id="nestedblock--spec--docker_config_json"></a>
127157
### Nested Schema for `spec.docker_config_json`
@@ -155,7 +185,8 @@ Read-Only:
155185

156186
```terraform
157187
# Create Tanzu Mission Control kubernetes secret with attached set as default value.
158-
resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
188+
# Example for creating the dockerconfigjson secret
189+
resource "tanzu-mission-control_kubernetes_secret" "create_dockerconfigjson_secret" {
159190
name = "tf-secret" # Required
160191
namespace_name = "tf-secret-namespace-name" # Required
161192
@@ -180,6 +211,32 @@ resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
180211
}
181212
}
182213
}
214+
215+
# Example for creating the opaque secret
216+
resource "tanzu-mission-control_kubernetes_secret" "create_opaque_secret" {
217+
name = "tf-secret" # Required
218+
namespace_name = "tf-secret-namespace-name" # Required
219+
220+
scope {
221+
cluster_group {
222+
name = "default" # Required
223+
}
224+
}
225+
226+
export = false # Default: false
227+
228+
meta {
229+
description = "Create namespace through terraform"
230+
labels = { "key" : "value" }
231+
}
232+
233+
spec {
234+
opaque = {
235+
"key1" : "value1"
236+
"key2" : "value2"
237+
}
238+
}
239+
}
183240
```
184241

185242
<!-- schema generated by tfplugindocs -->
@@ -236,9 +293,10 @@ Required:
236293
<a id="nestedblock--spec"></a>
237294
### Nested Schema for `spec`
238295

239-
Required:
296+
Optional:
240297

241-
- `docker_config_json` (Block List, Min: 1) SecretType definition - SECRET_TYPE_DOCKERCONFIGJSON, Kubernetes secrets type. (see [below for nested schema](#nestedblock--spec--docker_config_json))
298+
- `docker_config_json` (Block List) SecretType definition - SECRET_TYPE_DOCKERCONFIGJSON, Kubernetes secrets type. (see [below for nested schema](#nestedblock--spec--docker_config_json))
299+
- `opaque` (Map of String, Sensitive) SecretType definition - SECRET_TYPE_OPAQUE, Kubernetes secrets type.
242300

243301
<a id="nestedblock--spec--docker_config_json"></a>
244302
### Nested Schema for `spec.docker_config_json`

‎examples/resources/kubernetes_secret/cg_resource.tf‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Create Tanzu Mission Control kubernetes secret with attached set as default value.
2-
resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
2+
# Example for creating the dockerconfigjson secret
3+
resource "tanzu-mission-control_kubernetes_secret" "create_dockerconfigjson_secret" {
34
name = "tf-secret" # Required
45
namespace_name = "tf-secret-namespace-name" # Required
56

@@ -23,4 +24,30 @@ resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
2324
image_registry_url = "testimageregistryurl" # Required
2425
}
2526
}
26-
}
27+
}
28+
29+
# Example for creating the opaque secret
30+
resource "tanzu-mission-control_kubernetes_secret" "create_opaque_secret" {
31+
name = "tf-secret" # Required
32+
namespace_name = "tf-secret-namespace-name" # Required
33+
34+
scope {
35+
cluster_group {
36+
name = "default" # Required
37+
}
38+
}
39+
40+
export = false # Default: false
41+
42+
meta {
43+
description = "Create namespace through terraform"
44+
labels = { "key" : "value" }
45+
}
46+
47+
spec {
48+
opaque = {
49+
"key1" : "value1"
50+
"key2" : "value2"
51+
}
52+
}
53+
}

‎examples/resources/kubernetes_secret/resource.tf‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Create Tanzu Mission Control kubernetes secret with attached set as default value.
2-
resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
2+
# Example for creating the dockerconfigjson secret
3+
resource "tanzu-mission-control_kubernetes_secret" "create_dockerconfigjson_secret" {
34
name = "tf-secret" # Required
45
namespace_name = "tf-secret-namespace-name" # Required
56

@@ -25,4 +26,32 @@ resource "tanzu-mission-control_kubernetes_secret" "create_secret" {
2526
image_registry_url = "testimageregistryurl" # Required
2627
}
2728
}
28-
}
29+
}
30+
31+
# Example for creating the opaque secret
32+
resource "tanzu-mission-control_kubernetes_secret" "create_opaque_secret" {
33+
name = "tf-secret" # Required
34+
namespace_name = "tf-secret-namespace-name" # Required
35+
36+
scope {
37+
cluster {
38+
name = "testcluster" # Required
39+
provisioner_name = "attached" # Default: attached
40+
management_cluster_name = "attached" # Default: attached
41+
}
42+
}
43+
44+
export = false # Default: false
45+
46+
meta {
47+
description = "Create namespace through terraform"
48+
labels = { "key" : "value" }
49+
}
50+
51+
spec {
52+
opaque = {
53+
"key1" : "value1"
54+
"key2" : "value2"
55+
}
56+
}
57+
}

‎internal/models/kubernetessecret/cluster/secret_spec.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ func (m *VmwareTanzuManageV1alpha1ClusterNamespaceSecretSpec) UnmarshalBinary(b
4949
//
5050
// - SECRET_TYPE_UNSPECIFIED: SECRET_TYPE_UNSPECIFIED, Unspecified secret type (default).
5151
// - SECRET_TYPE_DOCKERCONFIGJSON: SECRET_TYPE_DOCKERCONFIGJSON, Kubernetes secrets type : kubernetes.io/dockerconfigjson.
52+
// - SECRET_TYPE_OPAQUE: SECRET_TYPE_OPAQUE, Kubernetes opaque secret type : https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets
5253
//
5354
// swagger:model vmware.tanzu.manage.v1alpha1.cluster.namespace.secret.SecretType
5455
type VmwareTanzuManageV1alpha1ClusterNamespaceSecretType string
@@ -61,14 +62,17 @@ const (
6162

6263
// VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEDOCKERCONFIGJSON captures enum value "SECRET_TYPE_DOCKERCONFIGJSON".
6364
VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEDOCKERCONFIGJSON VmwareTanzuManageV1alpha1ClusterNamespaceSecretType = "SECRET_TYPE_DOCKERCONFIGJSON"
65+
// VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEOPAQUE captures enum value "SECRET_TYPE_OPAQUE".
66+
//nolint:gosec
67+
VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEOPAQUE VmwareTanzuManageV1alpha1ClusterNamespaceSecretType = "SECRET_TYPE_OPAQUE"
6468
)
6569

6670
// for schema.
6771
var vmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeEnum []interface{}
6872

6973
func init() {
7074
var res []VmwareTanzuManageV1alpha1ClusterNamespaceSecretType
71-
if err := json.Unmarshal([]byte(`["SECRET_TYPE_UNSPECIFIED","SECRET_TYPE_DOCKERCONFIGJSON"]`), &res); err != nil {
75+
if err := json.Unmarshal([]byte(`["SECRET_TYPE_UNSPECIFIED","SECRET_TYPE_DOCKERCONFIGJSON","SECRET_TYPE_OPAQUE"]`), &res); err != nil {
7276
panic(err)
7377
}
7478

‎internal/resources/kubernetessecret/constants.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ const (
1515
SecretExportPhaseKey = "secret_export_phase"
1616
statusKey = "status"
1717
Ready = "Ready"
18+
DockerSecretType = "docker"
19+
OpaqueSecretType = "opaque"
1820

1921
ResourceName = "tanzu-mission-control_kubernetes_secret"
2022
)

‎internal/resources/kubernetessecret/data_source_secret.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,16 @@ func dataSourceSecretRead(ctx context.Context, d *schema.ResourceData, m interfa
8080

8181
var password string
8282

83-
if _, ok := d.GetOk(spec.SpecKey); ok {
83+
var opaqueData map[string]interface{}
84+
85+
if _, ok := d.GetOk(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.PasswordKey)); ok {
8486
password, _ = (d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.PasswordKey))).(string)
8587
}
8688

89+
if opData, ok := d.GetOk(helper.GetFirstElementOf(spec.SpecKey, spec.OpaqueKey)); ok && opData != nil {
90+
opaqueData = opData.(map[string]interface{})
91+
}
92+
8793
if d.Get(ExportKey).(bool) {
8894
if secretDataFromServer.secretExportErr != nil || secretDataFromServer.secretExportRespNil {
8995
switch {
@@ -121,13 +127,13 @@ func dataSourceSecretRead(ctx context.Context, d *schema.ResourceData, m interfa
121127

122128
switch scopedFullnameData.Scope {
123129
case commonscope.ClusterScope:
124-
flattenedSpec = spec.FlattenSpecForClusterScope(secretDataFromServer.atomicSpec, password)
130+
flattenedSpec = spec.FlattenSpecForClusterScope(secretDataFromServer.atomicSpec, password, opaqueData)
125131
flattenedStatus = status.FlattenStatusForClusterScope(secretDataFromServer.clusterScopeStatus)
126132
case commonscope.ClusterGroupScope:
127133
clusterGroupScopeSpec := &secretclustergroupmodel.VmwareTanzuManageV1alpha1ClustergroupNamespaceSecretSpec{
128134
AtomicSpec: secretDataFromServer.atomicSpec,
129135
}
130-
flattenedSpec = spec.FlattenSpecForClusterGroupScope(clusterGroupScopeSpec, password)
136+
flattenedSpec = spec.FlattenSpecForClusterGroupScope(clusterGroupScopeSpec, password, opaqueData)
131137
flattenedStatus = status.FlattenStatusForClusterGroupScope(secretDataFromServer.clusterGroupScopeStatus)
132138
}
133139

‎internal/resources/kubernetessecret/resource_secret.go‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ func ResourceSecret() *schema.Resource {
4141
Schema: getResourceSchema(),
4242
CustomizeDiff: customdiff.All(
4343
schema.CustomizeDiffFunc(commonscope.ValidateScope(scope.ScopesAllowed[:])),
44+
spec.ValidateInput,
4445
),
4546
}
4647
}
@@ -279,7 +280,10 @@ func resourceSecretInPlaceUpdate(ctx context.Context, d *schema.ResourceData, m
279280
return diag.Errorf("updating %v is not possible", spec.ImageRegistryURLKey)
280281
}
281282

282-
if updateCheckForMeta(d, secretDataFromServer.meta) || updateCheckForSpec(d, secretDataFromServer.atomicSpec, scopedFullnameData.Scope) {
283+
updateRequiredForSepc := updateCheckForSpec(d, secretDataFromServer.atomicSpec, scopedFullnameData.Scope)
284+
updateRequiredForMeta := updateCheckForMeta(d, secretDataFromServer.meta)
285+
286+
if updateRequiredForSepc || updateRequiredForMeta {
283287
switch scopedFullnameData.Scope {
284288
case commonscope.ClusterScope:
285289
if scopedFullnameData.FullnameCluster != nil {
@@ -330,14 +334,21 @@ func resourceSecretInPlaceUpdate(ctx context.Context, d *schema.ResourceData, m
330334

331335
func updateCheckForSpec(d *schema.ResourceData, atomicSpec *clustersecretmodel.VmwareTanzuManageV1alpha1ClusterNamespaceSecretSpec, scope commonscope.Scope) bool {
332336
if !(spec.HasSpecChanged(d)) {
333-
username := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.UsernameKey))
334-
password := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.PasswordKey))
335-
url := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.ImageRegistryURLKey))
337+
if atomicSpec.SecretType == clustersecretmodel.NewVmwareTanzuManageV1alpha1ClusterNamespaceSecretType(clustersecretmodel.VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEDOCKERCONFIGJSON) {
338+
username := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.UsernameKey))
339+
password := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.PasswordKey))
340+
url := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.DockerConfigjsonKey, spec.ImageRegistryURLKey))
341+
342+
secretSpecData, _ := spec.GetEncodedSpecData(url.(string), username.(string), password.(string))
336343

337-
secretSpecData, _ := spec.GetEncodedSpecData(url.(string), username.(string), password.(string))
344+
atomicSpec.Data = map[string]strfmt.Base64{
345+
spec.DockerconfigKey: secretSpecData,
346+
}
347+
}
338348

339-
atomicSpec.Data = map[string]strfmt.Base64{
340-
spec.DockerconfigKey: secretSpecData,
349+
if atomicSpec.SecretType == clustersecretmodel.NewVmwareTanzuManageV1alpha1ClusterNamespaceSecretType(clustersecretmodel.VmwareTanzuManageV1alpha1ClusterNamespaceSecretTypeSECRETTYPEOPAQUE) {
350+
kv := d.Get(helper.GetFirstElementOf(spec.SpecKey, spec.OpaqueKey))
351+
atomicSpec.Data = spec.GetEncodedOpaqueData(kv.(map[string]string))
341352
}
342353

343354
return false

0 commit comments

Comments
 (0)