From a799e1bffcb95cac02a8ea47e34aa58cf72ef1cb Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 13:57:04 -0500 Subject: [PATCH 01/37] Add new workflow to push k8 operator to prod --- helm-charts/secrets-operator/.helmignore | 23 +++ helm-charts/secrets-operator/Chart.yaml | 21 +++ .../secrets-operator/templates/_helpers.tpl | 62 +++++++ .../templates/deployment.yaml | 108 ++++++++++++ .../templates/infisicalsecret-crd.yaml | 156 ++++++++++++++++++ .../templates/leader-election-rbac.yaml | 59 +++++++ .../templates/manager-rbac.yaml | 71 ++++++++ .../templates/metrics-reader-rbac.yaml | 14 ++ .../templates/metrics-service.yaml | 17 ++ .../templates/proxy-rbac.yaml | 40 +++++ helm-charts/secrets-operator/values.yaml | 32 ++++ k8-operator/Makefile | 5 + 12 files changed, 608 insertions(+) create mode 100644 helm-charts/secrets-operator/.helmignore create mode 100644 helm-charts/secrets-operator/Chart.yaml create mode 100644 helm-charts/secrets-operator/templates/_helpers.tpl create mode 100644 helm-charts/secrets-operator/templates/deployment.yaml create mode 100644 helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml create mode 100644 helm-charts/secrets-operator/templates/leader-election-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/manager-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml create mode 100644 helm-charts/secrets-operator/templates/metrics-service.yaml create mode 100644 helm-charts/secrets-operator/templates/proxy-rbac.yaml create mode 100644 helm-charts/secrets-operator/values.yaml diff --git a/helm-charts/secrets-operator/.helmignore b/helm-charts/secrets-operator/.helmignore new file mode 100644 index 0000000000..0e8a0eb36f --- /dev/null +++ b/helm-charts/secrets-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml new file mode 100644 index 0000000000..26a402da3d --- /dev/null +++ b/helm-charts/secrets-operator/Chart.yaml @@ -0,0 +1,21 @@ +apiVersion: v2 +name: secrets-operator +description: A Helm chart for Infisical secrets +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "0.1.0" diff --git a/helm-charts/secrets-operator/templates/_helpers.tpl b/helm-charts/secrets-operator/templates/_helpers.tpl new file mode 100644 index 0000000000..44e464d939 --- /dev/null +++ b/helm-charts/secrets-operator/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "secrets-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "secrets-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "secrets-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "secrets-operator.labels" -}} +helm.sh/chart: {{ include "secrets-operator.chart" . }} +{{ include "secrets-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "secrets-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "secrets-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "secrets-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "secrets-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml new file mode 100644 index 0000000000..026728bfa8 --- /dev/null +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -0,0 +1,108 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager + labels: + app.kubernetes.io/component: manager + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.controllerManager.replicas }} + selector: + matchLabels: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 8 }} + annotations: + kubectl.kubernetes.io/default-container: manager + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + env: + - name: KUBERNETES_CLUSTER_DOMAIN + value: {{ .Values.kubernetesClusterDomain }} + image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag + | default .Chart.AppVersion }} + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent + 10 }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + env: + - name: KUBERNETES_CLUSTER_DOMAIN + value: {{ .Values.kubernetesClusterDomain }} + image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag + | default .Chart.AppVersion }} + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 + }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + securityContext: + runAsNonRoot: true + serviceAccountName: {{ include "secrets-operator.fullname" . }}-controller-manager + terminationGracePeriodSeconds: 10 \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml new file mode 100644 index 0000000000..8628a57d90 --- /dev/null +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -0,0 +1,156 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: infisicalsecrets.secrets.infisical.com + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + group: secrets.infisical.com + names: + kind: InfisicalSecret + listKind: InfisicalSecretList + plural: infisicalsecrets + singular: infisicalsecret + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: InfisicalSecret is the Schema for the infisicalsecrets API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: InfisicalSecretSpec defines the desired state of InfisicalSecret + properties: + environment: + description: The Infisical environment such as dev, prod, testing + type: string + infisicalToken: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + managedSecret: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + projectId: + description: The Infisical project id + type: string + required: + - environment + - projectId + type: object + status: + description: InfisicalSecretStatus defines the observed state of InfisicalSecret + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + \n type FooStatus struct{ // Represents the observations of a foo's + current state. // Known .status.conditions.type are: \"Available\", + \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge + // +listType=map // +listMapKey=type Conditions []metav1.Condition + `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" + protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating details + about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers of + specific condition types may define expected values and meanings + for this field, and whether the values are considered a guaranteed + API. The value should be a CamelCase string. This field may + not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/leader-election-rbac.yaml b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml new file mode 100644 index 0000000000..dc41acf148 --- /dev/null +++ b/helm-charts/secrets-operator/templates/leader-election-rbac.yaml @@ -0,0 +1,59 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "secrets-operator.fullname" . }}-leader-election-role + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-leader-election-rolebinding + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: '{{ include "secrets-operator.fullname" . }}-leader-election-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml new file mode 100644 index 0000000000..a560790f6f --- /dev/null +++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml @@ -0,0 +1,71 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-manager-role + labels: + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/finalizers + verbs: + - update +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-manager-rolebinding + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: '{{ include "secrets-operator.fullname" . }}-manager-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml new file mode 100644 index 0000000000..7d7ceba46e --- /dev/null +++ b/helm-charts/secrets-operator/templates/metrics-reader-rbac.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-metrics-reader + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- nonResourceURLs: + - /metrics + verbs: + - get \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml new file mode 100644 index 0000000000..ebf7ce5493 --- /dev/null +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + {{- include "secrets-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.metricsService.type }} + selector: + control-plane: controller-manager + {{- include "secrets-operator.selectorLabels" . | nindent 4 }} + ports: + {{- .Values.metricsService.ports | toYaml | nindent 2 -}} \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/proxy-rbac.yaml b/helm-charts/secrets-operator/templates/proxy-rbac.yaml new file mode 100644 index 0000000000..5f07e29081 --- /dev/null +++ b/helm-charts/secrets-operator/templates/proxy-rbac.yaml @@ -0,0 +1,40 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "secrets-operator.fullname" . }}-proxy-role + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "secrets-operator.fullname" . }}-proxy-rolebinding + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/part-of: k8-operator + {{- include "secrets-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: '{{ include "secrets-operator.fullname" . }}-proxy-role' +subjects: +- kind: ServiceAccount + name: '{{ include "secrets-operator.fullname" . }}-controller-manager' + namespace: '{{ .Release.Namespace }}' \ No newline at end of file diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml new file mode 100644 index 0000000000..32ae2f789c --- /dev/null +++ b/helm-charts/secrets-operator/values.yaml @@ -0,0 +1,32 @@ +controllerManager: + kubeRbacProxy: + image: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.13.1 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + manager: + image: + repository: infisical/kubernetes-operator + tag: latest + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + replicas: 1 +kubernetesClusterDomain: cluster.local +metricsService: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + type: ClusterIP diff --git a/k8-operator/Makefile b/k8-operator/Makefile index 9116f85220..541e26b608 100644 --- a/k8-operator/Makefile +++ b/k8-operator/Makefile @@ -36,6 +36,11 @@ all: build help: ## Display this help. @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) + +## Chart +helm-chart: + $(KUSTOMIZE) build config/default | helmify ../helm-charts/secrets-operator + ##@ Development .PHONY: manifests From 033275ed69ca010753fd0c68cc04c3a4ebd00376 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 16:14:05 -0500 Subject: [PATCH 02/37] update read me helm chart --- helm-charts/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/helm-charts/README.md b/helm-charts/README.md index 0974640287..468275e3fb 100644 --- a/helm-charts/README.md +++ b/helm-charts/README.md @@ -14,3 +14,4 @@ helm install infisical-helm-charts/ #### Available chart names - infisical +- secrets-operator From c12eeac9b337e11a17e0583861e670cd00231e82 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 16 Dec 2022 16:35:08 -0500 Subject: [PATCH 03/37] Add placeholder upcoming integrations to docs --- docs/integrations/cicd/circleci.mdx | 5 +++++ docs/integrations/cloud/flyio.mdx | 5 +++++ docs/integrations/cloud/render.mdx | 5 +++++ docs/integrations/overview.mdx | 4 +++- docs/mint.json | 10 +++++++++- 5 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 docs/integrations/cicd/circleci.mdx create mode 100644 docs/integrations/cloud/flyio.mdx create mode 100644 docs/integrations/cloud/render.mdx diff --git a/docs/integrations/cicd/circleci.mdx b/docs/integrations/cicd/circleci.mdx new file mode 100644 index 0000000000..7ded52d8aa --- /dev/null +++ b/docs/integrations/cicd/circleci.mdx @@ -0,0 +1,5 @@ +--- +title: "Circle CI" +--- + +Coming soon. diff --git a/docs/integrations/cloud/flyio.mdx b/docs/integrations/cloud/flyio.mdx new file mode 100644 index 0000000000..b53a524041 --- /dev/null +++ b/docs/integrations/cloud/flyio.mdx @@ -0,0 +1,5 @@ +--- +title: "Fly.io" +--- + +Coming soon. diff --git a/docs/integrations/cloud/render.mdx b/docs/integrations/cloud/render.mdx new file mode 100644 index 0000000000..895bf01d17 --- /dev/null +++ b/docs/integrations/cloud/render.mdx @@ -0,0 +1,5 @@ +--- +title: "Render" +--- + +Coming soon. diff --git a/docs/integrations/overview.mdx b/docs/integrations/overview.mdx index 9323f8917e..922221a99b 100644 --- a/docs/integrations/overview.mdx +++ b/docs/integrations/overview.mdx @@ -13,12 +13,14 @@ Missing an integration? Throw in a [request](https://github.com/Infisical/infisi | Kubernetes | Platform | Coming soon | | [Heroku](/integrations/cloud/heroku) | Cloud | Available | | [Vercel](/integrations/cloud/vercel) | Cloud | Coming soon | +| [Render](/integrations/cloud/render) | Cloud | Coming soon | +| [Fly.io](/integrations/cloud/flyio) | Cloud | Coming soon | | AWS | Cloud | Coming soon | | GCP | Cloud | Coming soon | | Azure | Cloud | Coming soon | | DigitalOcean | Cloud | Coming soon | | GitLab | CI/CD | Coming soon | -| CircleCI | CI/CD | Coming soon | +| [CircleCI](/integrations/cicd/circleci) | CI/CD | Coming soon | | TravisCI | CI/CD | Coming soon | | GitHub Actions | CI/CD | Coming soon | | Jenkins | CI/CD | Coming soon | diff --git a/docs/mint.json b/docs/mint.json index 547291fa5e..7343622dbc 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -131,7 +131,15 @@ "group": "Cloud", "pages": [ "integrations/cloud/heroku", - "integrations/cloud/vercel" + "integrations/cloud/vercel", + "integrations/cloud/render", + "integrations/cloud/flyio" + ] + }, + { + "group": "CI/CD", + "pages": [ + "integrations/cicd/circleci" ] }, { From b4c616edd6f51f71b79d860153720eee87fdf501 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 16:34:59 -0500 Subject: [PATCH 04/37] set image name for k8 --- .github/workflows/release_docker_k8_operator.yaml | 3 +++ k8-operator/Makefile | 8 +++++++- k8-operator/config/manager/kustomization.yaml | 6 ++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release_docker_k8_operator.yaml b/.github/workflows/release_docker_k8_operator.yaml index 01aa3b6250..cbed4ff856 100644 --- a/.github/workflows/release_docker_k8_operator.yaml +++ b/.github/workflows/release_docker_k8_operator.yaml @@ -30,6 +30,9 @@ jobs: - uses: actions/setup-go@v2 + - name: Generate YAML for Kubectl + run: make dist charts + - name: Upload CRD manifest uses: svenstaro/upload-release-action@v2 with: diff --git a/k8-operator/Makefile b/k8-operator/Makefile index 541e26b608..268a8d72fa 100644 --- a/k8-operator/Makefile +++ b/k8-operator/Makefile @@ -1,6 +1,6 @@ # Image URL to use all building/pushing image targets -IMG ?= controller:latest +IMG ?= infisical/kubernetes-operator:latest # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary. ENVTEST_K8S_VERSION = 1.25.0 @@ -41,6 +41,12 @@ help: ## Display this help. helm-chart: $(KUSTOMIZE) build config/default | helmify ../helm-charts/secrets-operator +## Yaml for Kubectl +dist: manifests kustomize + mkdir -p dist + cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} + $(KUSTOMIZE) build config/default > dist/install-secrets-operator.yaml + ##@ Development .PHONY: manifests diff --git a/k8-operator/config/manager/kustomization.yaml b/k8-operator/config/manager/kustomization.yaml index 5c5f0b84cb..96ea36924a 100644 --- a/k8-operator/config/manager/kustomization.yaml +++ b/k8-operator/config/manager/kustomization.yaml @@ -1,2 +1,8 @@ resources: - manager.yaml +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +images: +- name: controller + newName: infisical/kubernetes-operator + newTag: latest From 8183e6140314d77f3ced6a207eead36d752e6d7d Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 16:37:31 -0500 Subject: [PATCH 05/37] Update k8 read me --- k8-operator/README.md | 22 +++------------------- 1 file changed, 3 insertions(+), 19 deletions(-) diff --git a/k8-operator/README.md b/k8-operator/README.md index 6d953997eb..807476c0c0 100644 --- a/k8-operator/README.md +++ b/k8-operator/README.md @@ -1,8 +1,8 @@ # k8-operator -// TODO(user): Add simple overview of use/purpose +// TODO ## Description -// TODO(user): An in-depth paragraph about your project and overview of use +// TODO ## Getting Started You’ll need a Kubernetes cluster to run against. You can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing, or run against a remote cluster. @@ -42,7 +42,7 @@ make undeploy ``` ## Contributing -// TODO(user): Add detailed information on how you would like others to contribute to this project +// TODO ### How it works This project aims to follow the Kubernetes [Operator pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) @@ -76,19 +76,3 @@ make manifests More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html) -## License - -Copyright 2022. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. - From 6af59e47f5a7a13a04c1b48e8b13033f7575054c Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 16 Dec 2022 16:48:21 -0500 Subject: [PATCH 06/37] yaml for kubectl install secrets operator --- k8-operator/Makefile | 6 +- .../install-secrets-operator.yaml | 471 ++++++++++++++++++ 2 files changed, 474 insertions(+), 3 deletions(-) create mode 100644 k8-operator/kubectl-install/install-secrets-operator.yaml diff --git a/k8-operator/Makefile b/k8-operator/Makefile index 268a8d72fa..a8b0563769 100644 --- a/k8-operator/Makefile +++ b/k8-operator/Makefile @@ -42,10 +42,10 @@ helm-chart: $(KUSTOMIZE) build config/default | helmify ../helm-charts/secrets-operator ## Yaml for Kubectl -dist: manifests kustomize - mkdir -p dist +kubectl-install: manifests kustomize + mkdir -p kubectl-install cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} - $(KUSTOMIZE) build config/default > dist/install-secrets-operator.yaml + $(KUSTOMIZE) build config/default > kubectl-install/install-secrets-operator.yaml ##@ Development diff --git a/k8-operator/kubectl-install/install-secrets-operator.yaml b/k8-operator/kubectl-install/install-secrets-operator.yaml new file mode 100644 index 0000000000..03c747b261 --- /dev/null +++ b/k8-operator/kubectl-install/install-secrets-operator.yaml @@ -0,0 +1,471 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/component: manager + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: system + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: namespace + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + name: k8-operator-system +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: infisicalsecrets.secrets.infisical.com +spec: + group: secrets.infisical.com + names: + kind: InfisicalSecret + listKind: InfisicalSecretList + plural: infisicalsecrets + singular: infisicalsecret + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: InfisicalSecret is the Schema for the infisicalsecrets API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: InfisicalSecretSpec defines the desired state of InfisicalSecret + properties: + environment: + description: The Infisical environment such as dev, prod, testing + type: string + infisicalToken: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + managedSecret: + properties: + secretName: + description: The name of the Kubernetes Secret + type: string + secretNamespace: + description: The name space where the Kubernetes Secret is located + type: string + required: + - secretName + - secretNamespace + type: object + projectId: + description: The Infisical project id + type: string + required: + - environment + - projectId + type: object + status: + description: InfisicalSecretStatus defines the observed state of InfisicalSecret + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: controller-manager + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: serviceaccount + app.kubernetes.io/part-of: k8-operator + name: k8-operator-controller-manager + namespace: k8-operator-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: leader-election-role + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: role + app.kubernetes.io/part-of: k8-operator + name: k8-operator-leader-election-role + namespace: k8-operator-system +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: k8-operator-manager-role +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/finalizers + verbs: + - update +- apiGroups: + - secrets.infisical.com + resources: + - infisicalsecrets/status + verbs: + - get + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: metrics-reader + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: clusterrole + app.kubernetes.io/part-of: k8-operator + name: k8-operator-metrics-reader +rules: +- nonResourceURLs: + - /metrics + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: proxy-role + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: clusterrole + app.kubernetes.io/part-of: k8-operator + name: k8-operator-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: leader-election-rolebinding + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: rolebinding + app.kubernetes.io/part-of: k8-operator + name: k8-operator-leader-election-rolebinding + namespace: k8-operator-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8-operator-leader-election-role +subjects: +- kind: ServiceAccount + name: k8-operator-controller-manager + namespace: k8-operator-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: manager-rolebinding + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: clusterrolebinding + app.kubernetes.io/part-of: k8-operator + name: k8-operator-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: k8-operator-manager-role +subjects: +- kind: ServiceAccount + name: k8-operator-controller-manager + namespace: k8-operator-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: proxy-rolebinding + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: clusterrolebinding + app.kubernetes.io/part-of: k8-operator + name: k8-operator-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: k8-operator-proxy-role +subjects: +- kind: ServiceAccount + name: k8-operator-controller-manager + namespace: k8-operator-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: kube-rbac-proxy + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: controller-manager-metrics-service + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: service + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + name: k8-operator-controller-manager-metrics-service + namespace: k8-operator-system +spec: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + selector: + control-plane: controller-manager +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: manager + app.kubernetes.io/created-by: k8-operator + app.kubernetes.io/instance: controller-manager + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: deployment + app.kubernetes.io/part-of: k8-operator + control-plane: controller-manager + name: k8-operator-controller-manager + namespace: k8-operator-system +spec: + replicas: 1 + selector: + matchLabels: + control-plane: controller-manager + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + control-plane: controller-manager + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: infisical/kubernetes-operator:latest + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + securityContext: + runAsNonRoot: true + serviceAccountName: k8-operator-controller-manager + terminationGracePeriodSeconds: 10 From 4c29c88fde47f3cb6f6ac9175db833c648168d01 Mon Sep 17 00:00:00 2001 From: seunghyunOh Date: Tue, 13 Dec 2022 22:19:59 +0900 Subject: [PATCH 07/37] Adding automatic linter for checking commit --- backend/Dockerfile | 2 +- backend/package.json | 1 + frontend/Dockerfile | 2 +- frontend/Dockerfile.dev | 4 ++-- frontend/Dockerfile.prod | 2 +- frontend/package.json | 1 + package.json | 3 +-- 7 files changed, 8 insertions(+), 7 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index ccc76e66e5..fc93f2c332 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -4,7 +4,7 @@ WORKDIR /app COPY package.json package-lock.json ./ -RUN npm ci --only-production +RUN npm ci --only-production --ignore-scripts COPY . . diff --git a/backend/package.json b/backend/package.json index 32ca68b192..771bbc7e64 100644 --- a/backend/package.json +++ b/backend/package.json @@ -31,6 +31,7 @@ "version": "1.0.0", "main": "src/index.js", "scripts": { + "prepare": "cd .. && npm install", "start": "npm run build && node build/index.js", "dev": "nodemon", "build": "rimraf ./build && tsc && cp -R ./src/templates ./src/json ./build", diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 5deb468f74..520f0fb7fc 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -10,7 +10,7 @@ WORKDIR /app COPY package.json package-lock.json next.config.js ./ # Install dependencies -RUN npm ci --only-production +RUN npm ci --only-production --ignore-scripts # Rebuild the source code only when needed diff --git a/frontend/Dockerfile.dev b/frontend/Dockerfile.dev index 2bae23823f..cb462bbc4d 100644 --- a/frontend/Dockerfile.dev +++ b/frontend/Dockerfile.dev @@ -9,7 +9,7 @@ COPY package.json ./ COPY package-lock.json ./ # Install -RUN npm install +RUN npm install --ignore-scripts # Copy over next.js config COPY next.config.js ./next.config.js @@ -17,4 +17,4 @@ COPY next.config.js ./next.config.js # Copy all files COPY . . -CMD ["npm", "run", "dev"] \ No newline at end of file +CMD ["npm", "run", "dev"] diff --git a/frontend/Dockerfile.prod b/frontend/Dockerfile.prod index d95c00883f..71943e0f8c 100644 --- a/frontend/Dockerfile.prod +++ b/frontend/Dockerfile.prod @@ -9,7 +9,7 @@ COPY package.json ./ COPY package-lock.json ./ # Install -RUN npm install +RUN npm install --ignore-scripts # Copy over next.js config COPY next.config.js ./next.config.js diff --git a/frontend/package.json b/frontend/package.json index 7f7926c880..00952149d6 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,7 @@ { "private": true, "scripts": { + "prepare": "cd .. && npm install", "dev": "next dev", "build": "next build", "start": "next start", diff --git a/package.json b/package.json index b0d02f3a04..d5371d0e29 100644 --- a/package.json +++ b/package.json @@ -16,8 +16,7 @@ "lint-staged": { "**/*": "prettier --write --ignore-unknown", "*.{js,jsx,ts,tsx}": [ - "eslint --fix", - "prettier --write" + "eslint --fix" ] }, "devDependencies": { From 19daf1410a0f8953fd5890ed28d7bda91bab3b6f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 17 Dec 2022 13:27:36 -0500 Subject: [PATCH 08/37] allow host api in spec and update spec names --- .../workflows/release_docker_k8_operator.yaml | 14 +--- .../templates/infisicalsecret-crd.yaml | 14 ++-- .../api/v1alpha1/infisicalsecret_types.go | 8 ++- .../api/v1alpha1/zz_generated.deepcopy.go | 4 +- ...ecrets.infisical.com_infisicalsecrets.yaml | 14 ++-- k8-operator/config/default/kustomization.yaml | 4 +- k8-operator/config/samples/sample.yaml | 14 ++++ .../secrets_v1alpha1_infisicalsecret.yaml | 19 ------ .../controllers/infisicalsecret_controller.go | 8 ++- .../controllers/infisicalsecret_helper.go | 16 ++--- .../install-secrets-operator.yaml | 66 ++++++++++--------- k8-operator/packages/api/api.go | 10 ++- 12 files changed, 95 insertions(+), 96 deletions(-) create mode 100644 k8-operator/config/samples/sample.yaml delete mode 100644 k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml diff --git a/.github/workflows/release_docker_k8_operator.yaml b/.github/workflows/release_docker_k8_operator.yaml index cbed4ff856..788d414b6e 100644 --- a/.github/workflows/release_docker_k8_operator.yaml +++ b/.github/workflows/release_docker_k8_operator.yaml @@ -26,16 +26,4 @@ jobs: context: k8-operator push: true platforms: linux/amd64,linux/arm64 - tags: infisical/kubernetes-operator:latest - - - uses: actions/setup-go@v2 - - - name: Generate YAML for Kubectl - run: make dist charts - - - name: Upload CRD manifest - uses: svenstaro/upload-release-action@v2 - with: - repo_token: ${{ secrets.GITHUB_TOKEN }} - file: dist/install-secrets-operator.yaml - tag: ${{ github.ref }} \ No newline at end of file + tags: infisical/kubernetes-operator:latest \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 8628a57d90..c5b82fa14d 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -38,7 +38,11 @@ spec: environment: description: The Infisical environment such as dev, prod, testing type: string - infisicalToken: + hostAPI: + default: https://app.infisical.com/api + description: Infisical host to pull secrets from + type: string + managedSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -50,7 +54,10 @@ spec: - secretName - secretNamespace type: object - managedSecret: + projectId: + description: The Infisical project id + type: string + tokenSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -62,9 +69,6 @@ spec: - secretName - secretNamespace type: object - projectId: - description: The Infisical project id - type: string required: - environment - projectId diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index 74e3f97882..7940474f9c 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -16,8 +16,8 @@ type KubeSecretReference struct { // InfisicalSecretSpec defines the desired state of InfisicalSecret type InfisicalSecretSpec struct { - InfisicalToken KubeSecretReference `json:"infisicalToken,omitempty"` - ManagedSecret KubeSecretReference `json:"managedSecret,omitempty"` + TokenSecretReference KubeSecretReference `json:"tokenSecretReference,omitempty"` + ManagedSecretReference KubeSecretReference `json:"managedSecretReference,omitempty"` // The Infisical project id // +kubebuilder:validation:Required @@ -26,6 +26,10 @@ type InfisicalSecretSpec struct { // The Infisical environment such as dev, prod, testing // +kubebuilder:validation:Required Environment string `json:"environment"` + + // Infisical host to pull secrets from + // +kubebuilder:default="https://app.infisical.com/api" + HostAPI string `json:"hostAPI,omitempty"` } // InfisicalSecretStatus defines the observed state of InfisicalSecret diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index e6053ba748..af9eff318b 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -88,8 +88,8 @@ func (in *InfisicalSecretList) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *InfisicalSecretSpec) DeepCopyInto(out *InfisicalSecretSpec) { *out = *in - out.InfisicalToken = in.InfisicalToken - out.ManagedSecret = in.ManagedSecret + out.TokenSecretReference = in.TokenSecretReference + out.ManagedSecretReference = in.ManagedSecretReference } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfisicalSecretSpec. diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index ca00676b41..c885fbdde3 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -38,7 +38,11 @@ spec: environment: description: The Infisical environment such as dev, prod, testing type: string - infisicalToken: + hostAPI: + default: https://app.infisical.com/api + description: Infisical host to pull secrets from + type: string + managedSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -50,7 +54,10 @@ spec: - secretName - secretNamespace type: object - managedSecret: + projectId: + description: The Infisical project id + type: string + tokenSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -62,9 +69,6 @@ spec: - secretName - secretNamespace type: object - projectId: - description: The Infisical project id - type: string required: - environment - projectId diff --git a/k8-operator/config/default/kustomization.yaml b/k8-operator/config/default/kustomization.yaml index 4cab9014cc..1237b893d2 100644 --- a/k8-operator/config/default/kustomization.yaml +++ b/k8-operator/config/default/kustomization.yaml @@ -1,12 +1,12 @@ # Adds namespace to all resources. -namespace: k8-operator-system +namespace: infisical-operator-system # Value of this field is prepended to the # names of all resources, e.g. a deployment named # "wordpress" becomes "alices-wordpress". # Note that it should also match with the prefix (text before '-') of the namespace # field above. -namePrefix: k8-operator- +namePrefix: infisical-operator- # Labels to add to all resources and selectors. #commonLabels: diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml new file mode 100644 index 0000000000..1a185b15fc --- /dev/null +++ b/k8-operator/config/samples/sample.yaml @@ -0,0 +1,14 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample + # namespace: first-project +spec: + projectId: 62faf98ae0b05e8529b5da46 + environment: dev + tokenSecretReference: + secretName: service-token + secretNamespace: first-project + managedSecretReference: + secretName: managed-secret + secretNamespace: first-project diff --git a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml b/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml deleted file mode 100644 index 7ab08e9cd5..0000000000 --- a/k8-operator/config/samples/secrets_v1alpha1_infisicalsecret.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: secrets.infisical.com/v1alpha1 -kind: InfisicalSecret -metadata: - labels: - app.kubernetes.io/name: infisicalsecret - app.kubernetes.io/instance: infisicalsecret-sample - app.kubernetes.io/part-of: k8-operator - app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/created-by: k8-operator - name: infisicalsecret-sample -spec: - projectId: 62faf98ae0b05e8529b5da46 - environment: dev - infisicalToken: - secretName: service-token - secretNamespace: default - managedSecret: - secretName: managed-secret - secretNamespace: default diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 297e29bfbb..f6422e1779 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -36,6 +36,8 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ var infisicalSecretCR v1alpha1.InfisicalSecret err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR) + requeueTime := time.Minute * 5 + if err != nil { if errors.IsNotFound(err) { log.Info("Infisical Secret not found") @@ -43,7 +45,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ } else { log.Error(err, "Unable to fetch Infisical Secret from cluster. Will retry") return ctrl.Result{ - RequeueAfter: time.Minute, + RequeueAfter: requeueTime, }, nil } } @@ -58,13 +60,13 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ if err != nil { log.Error(err, "Unable to reconcile Infisical Secret and will try again") return ctrl.Result{ - RequeueAfter: time.Minute, + RequeueAfter: requeueTime, }, nil } // Sync again after the specified time return ctrl.Result{ - RequeueAfter: time.Minute, + RequeueAfter: requeueTime, }, nil } diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index fbcacadea3..be4e35dd5c 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -29,12 +29,12 @@ func (r *InfisicalSecretReconciler) GetKubeSecretByNamespacedName(ctx context.Co func (r *InfisicalSecretReconciler) GetInfisicalToken(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) { tokenSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{ - Namespace: infisicalSecret.Spec.InfisicalToken.SecretNamespace, - Name: infisicalSecret.Spec.InfisicalToken.SecretName, + Namespace: infisicalSecret.Spec.TokenSecretReference.SecretNamespace, + Name: infisicalSecret.Spec.TokenSecretReference.SecretName, }) if err != nil { - return "", fmt.Errorf("failed to read Infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecret.SecretName, infisicalSecret.Spec.ManagedSecret.SecretNamespace, err) + return "", fmt.Errorf("failed to read Infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.ManagedSecretReference.SecretName, infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, err) } infisicalServiceToken := tokenSecret.Data[INFISICAL_TOKEN_SECRET_KEY_NAME] @@ -54,8 +54,8 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context // create a new secret as specified by the managed secret spec of CRD newKubeSecretInstance := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ - Name: infisicalSecret.Spec.ManagedSecret.SecretName, - Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, + Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, }, Type: "Opaque", Data: plainProcessedSecrets, @@ -94,15 +94,15 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } managedKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{ - Name: infisicalSecret.Spec.ManagedSecret.SecretName, - Namespace: infisicalSecret.Spec.ManagedSecret.SecretNamespace, + Name: infisicalSecret.Spec.ManagedSecretReference.SecretName, + Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, }) if err != nil && !errors.IsNotFound(err) { return fmt.Errorf("something went wrong when fetching the managed Kubernetes secret [%w]", err) } - secretsFromApi, err := api.GetAllEnvironmentVariables(infisicalSecret.Spec.ProjectId, infisicalSecret.Spec.Environment, infisicalToken) + secretsFromApi, err := api.GetAllEnvironmentVariables(infisicalSecret.Spec.ProjectId, infisicalSecret.Spec.Environment, infisicalToken, infisicalSecret.Spec.HostAPI) if err != nil { return err diff --git a/k8-operator/kubectl-install/install-secrets-operator.yaml b/k8-operator/kubectl-install/install-secrets-operator.yaml index 03c747b261..6a3cb8e6d9 100644 --- a/k8-operator/kubectl-install/install-secrets-operator.yaml +++ b/k8-operator/kubectl-install/install-secrets-operator.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/name: namespace app.kubernetes.io/part-of: k8-operator control-plane: controller-manager - name: k8-operator-system + name: infisical-operator-system --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -46,7 +46,11 @@ spec: environment: description: The Infisical environment such as dev, prod, testing type: string - infisicalToken: + hostAPI: + default: https://app.infisical.com/api + description: Infisical host to pull secrets from + type: string + managedSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -58,7 +62,10 @@ spec: - secretName - secretNamespace type: object - managedSecret: + projectId: + description: The Infisical project id + type: string + tokenSecretReference: properties: secretName: description: The name of the Kubernetes Secret @@ -70,9 +77,6 @@ spec: - secretName - secretNamespace type: object - projectId: - description: The Infisical project id - type: string required: - environment - projectId @@ -142,8 +146,8 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: serviceaccount app.kubernetes.io/part-of: k8-operator - name: k8-operator-controller-manager - namespace: k8-operator-system + name: infisical-operator-controller-manager + namespace: infisical-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -155,8 +159,8 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: role app.kubernetes.io/part-of: k8-operator - name: k8-operator-leader-election-role - namespace: k8-operator-system + name: infisical-operator-leader-election-role + namespace: infisical-operator-system rules: - apiGroups: - "" @@ -194,7 +198,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: creationTimestamp: null - name: k8-operator-manager-role + name: infisical-operator-manager-role rules: - apiGroups: - "" @@ -253,7 +257,7 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: clusterrole app.kubernetes.io/part-of: k8-operator - name: k8-operator-metrics-reader + name: infisical-operator-metrics-reader rules: - nonResourceURLs: - /metrics @@ -270,7 +274,7 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: clusterrole app.kubernetes.io/part-of: k8-operator - name: k8-operator-proxy-role + name: infisical-operator-proxy-role rules: - apiGroups: - authentication.k8s.io @@ -295,16 +299,16 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: rolebinding app.kubernetes.io/part-of: k8-operator - name: k8-operator-leader-election-rolebinding - namespace: k8-operator-system + name: infisical-operator-leader-election-rolebinding + namespace: infisical-operator-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: k8-operator-leader-election-role + name: infisical-operator-leader-election-role subjects: - kind: ServiceAccount - name: k8-operator-controller-manager - namespace: k8-operator-system + name: infisical-operator-controller-manager + namespace: infisical-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -316,15 +320,15 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: clusterrolebinding app.kubernetes.io/part-of: k8-operator - name: k8-operator-manager-rolebinding + name: infisical-operator-manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: k8-operator-manager-role + name: infisical-operator-manager-role subjects: - kind: ServiceAccount - name: k8-operator-controller-manager - namespace: k8-operator-system + name: infisical-operator-controller-manager + namespace: infisical-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -336,15 +340,15 @@ metadata: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: clusterrolebinding app.kubernetes.io/part-of: k8-operator - name: k8-operator-proxy-rolebinding + name: infisical-operator-proxy-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: k8-operator-proxy-role + name: infisical-operator-proxy-role subjects: - kind: ServiceAccount - name: k8-operator-controller-manager - namespace: k8-operator-system + name: infisical-operator-controller-manager + namespace: infisical-operator-system --- apiVersion: v1 kind: Service @@ -357,8 +361,8 @@ metadata: app.kubernetes.io/name: service app.kubernetes.io/part-of: k8-operator control-plane: controller-manager - name: k8-operator-controller-manager-metrics-service - namespace: k8-operator-system + name: infisical-operator-controller-manager-metrics-service + namespace: infisical-operator-system spec: ports: - name: https @@ -379,8 +383,8 @@ metadata: app.kubernetes.io/name: deployment app.kubernetes.io/part-of: k8-operator control-plane: controller-manager - name: k8-operator-controller-manager - namespace: k8-operator-system + name: infisical-operator-controller-manager + namespace: infisical-operator-system spec: replicas: 1 selector: @@ -467,5 +471,5 @@ spec: - ALL securityContext: runAsNonRoot: true - serviceAccountName: k8-operator-controller-manager + serviceAccountName: infisical-operator-controller-manager terminationGracePeriodSeconds: 10 diff --git a/k8-operator/packages/api/api.go b/k8-operator/packages/api/api.go index ac2cc5b250..64f8add462 100644 --- a/k8-operator/packages/api/api.go +++ b/k8-operator/packages/api/api.go @@ -13,10 +13,8 @@ import ( "golang.org/x/crypto/nacl/box" ) -const INFISICAL_URL = "https://app.infisical.com/api" - -func GetAllEnvironmentVariables(projectId string, envName string, infisicalToken string) ([]models.SingleEnvironmentVariable, error) { - envsFromApi, err := GetSecretsFromAPIUsingInfisicalToken(infisicalToken, envName, projectId) +func GetAllEnvironmentVariables(projectId string, envName string, infisicalToken string, hostAPI string) ([]models.SingleEnvironmentVariable, error) { + envsFromApi, err := GetSecretsFromAPIUsingInfisicalToken(infisicalToken, envName, projectId, hostAPI) if err != nil { return nil, err } @@ -24,7 +22,7 @@ func GetAllEnvironmentVariables(projectId string, envName string, infisicalToken return SubstituteSecrets(envsFromApi), nil } -func GetSecretsFromAPIUsingInfisicalToken(infisicalToken string, envName string, projectId string) ([]models.SingleEnvironmentVariable, error) { +func GetSecretsFromAPIUsingInfisicalToken(infisicalToken string, envName string, projectId string, hostAPI string) ([]models.SingleEnvironmentVariable, error) { if infisicalToken == "" || projectId == "" || envName == "" { return nil, errors.New("infisical token, project id and or environment name cannot be empty") } @@ -44,7 +42,7 @@ func GetSecretsFromAPIUsingInfisicalToken(infisicalToken string, envName string, SetQueryParam("environment", envName). SetQueryParam("channel", "cli"). SetResult(&pullSecretsByInfisicalTokenResponse). - Get(fmt.Sprintf("%v/v1/secret/%v/service-token", INFISICAL_URL, projectId)) + Get(fmt.Sprintf("%v/v1/secret/%v/service-token", hostAPI, projectId)) if err != nil { return nil, err From e013a4ab931323f41e6908fca3d76da324c6132f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 17 Dec 2022 13:59:54 -0500 Subject: [PATCH 09/37] remove namespace from sample --- k8-operator/config/samples/sample.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 1a185b15fc..ad352d3e73 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -2,7 +2,6 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: name: infisicalsecret-sample - # namespace: first-project spec: projectId: 62faf98ae0b05e8529b5da46 environment: dev From cd59ca745d5cc2fbe911b2df94e1014d28e7d2f2 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 17 Dec 2022 23:48:12 -0500 Subject: [PATCH 10/37] Add kubernetes operator docs --- docs/integrations/overview.mdx | 4 +- docs/integrations/platforms/kubernetes.mdx | 160 +++++++++++++++++++++ docs/mint.json | 17 ++- 3 files changed, 170 insertions(+), 11 deletions(-) create mode 100644 docs/integrations/platforms/kubernetes.mdx diff --git a/docs/integrations/overview.mdx b/docs/integrations/overview.mdx index 922221a99b..577aa3bee5 100644 --- a/docs/integrations/overview.mdx +++ b/docs/integrations/overview.mdx @@ -1,5 +1,5 @@ --- -title: "Overview" +title: 'Overview' --- Integrations allow environment variables to be synced from Infisical into your local development workflow, CI/CD pipelines, and production infrastructure. @@ -10,7 +10,7 @@ Missing an integration? Throw in a [request](https://github.com/Infisical/infisi | -------------------------------------------------------- | --------- | ----------- | | [Docker](/integrations/platforms/docker) | Platform | Available | | [Docker-Compose](/integrations/platforms/docker-compose) | Platform | Available | -| Kubernetes | Platform | Coming soon | +| [Kubernetes](/integrations/platforms/kubernetes) | Platform | Available | | [Heroku](/integrations/cloud/heroku) | Cloud | Available | | [Vercel](/integrations/cloud/vercel) | Cloud | Coming soon | | [Render](/integrations/cloud/render) | Cloud | Coming soon | diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx new file mode 100644 index 0000000000..a43f03824e --- /dev/null +++ b/docs/integrations/platforms/kubernetes.mdx @@ -0,0 +1,160 @@ +--- +title: 'Kubernetes' +--- + +The Infisical Secrets Operator is a custom Kubernetes controller that helps keep secrets in a cluster up to date by synchronizing them. +It is installed in its own namespace within the cluster and follows strict RBAC policies. +The operator uses InfisicalSecret custom resources to identify which secrets to sync and where to store them. +It is responsible for continuously updating managed secrets, and in the future may also automatically reload deployments that use them as needed. + +## Install Operator + +The operator can be install via [Helm](helm.sh) or [kubectl](https://github.com/kubernetes/kubectl) + + + + Install Infisical Helm repository + ```bash + helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' + + helm repo update + ``` + + Install the Helm chart + ```bash + helm install --generate-name infisical-helm-charts/secrets-operator + ``` + + + + The operator will be installed in `infisical-operator-system` namespace + ``` + kubectl apply -f https://raw.githubusercontent.com/Infisical/infisical/main/k8-operator/kubectl-install/install-secrets-operator.yaml + ``` + + + +## Sync Infisical Secrets to your cluster + +To retrieve secrets from an Infisical project and store them in your Kubernetes cluster, you can use the InfisicalSecret custom resource. +This resource is available after installing the Infisical operator. In order to specify the Infisical Token location and the location where the retrieved secrets should be stored, you can use the `tokenSecretReference` and `managedSecretReference` fields within the InfisicalSecret resource. + + + The `tokenSecretReference` field in the InfisicalSecret resource is used to specify the location of the Infisical Token, which is required for authenticating and retrieving secrets from an Infisical project. + + To create a Kubernetes secret containing an [Infisical Token](../../getting-started/dashboard/token), you can run the following command. + ``` bash + kubectl create secret generic service-token --from-literal=infisicalToken= + ``` + +Once the secret is created, add the name and namespace of the secret under `tokenSecretReference` field in the InfisicalSecret custom resource. + +{' '} + + No matter what the name of the secret is or its namespace, it must contain a + key named `infisicalToken` with a valid Infisical Token as the value + + + + + +The `managedSecretReference` field in the InfisicalSecret resource is used to specify the location where secrets retrieved from an Infisical project should be stored. +You should specify the name and namespace of the Kubernetes secret that will hold these secrets. The operator will create the secret for you, you just need to provide its name and namespace. + +It is recommended that the managed secret be created in the same namespace as the deployment that will use it. + + + +```yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + # Name of of this InfisicalSecret resource + name: infisicalsecret-sample +spec: + # The host that should be used to pull secrets from. The default value is https://infisical.com/api. + hostAPI: https://infisical.com/api + + # The Infisical project from which to pull secrets from + projectId: 62faf98ae0b05e8529b5da46 + + # The environment (dev, prod, testing, etc.) of the above project from where secrets should be pulled from + environment: dev + + # The Kubernetes secret the stores the Infisical token + tokenSecretReference: + # Kubernetes secret name + secretName: service-token + # The secret namespace + secretNamespace: default + + # The Kubernetes secret that Infisical Operator will create and populate with secrets from the above project + managedSecretReference: + # The name of managed Kubernetes secret that should be created + secretName: managed-secret + # The namespace the managed secret should be installed in + secretNamespace: default +``` + +## Verify + +After creating an `InfisicalSecret` custom resource, you can reference the managed secret specified in the `managedSecretReference` field in your deployment just like any other Kubernetes secret. +To confirm that the operator has created the managed secret specified in managedSecretReference, you can list the secrets in the namespace you specified. + +```bash +# Verify managed secret is created +kubectl get secrets -n +``` + + + The Infisical secrets will be synced and stored into the managed secret every + 5 minutes. + + +## Troubleshoot + +If the operator is unable to fetch secrets from the API, it will not affect the managed Kubernetes secret. +It will continue attempting to reconnect to the API indefinitely. +The InfisicalSecret resource uses the `status.conditions` field to report its current state and any errors encountered. + +```yaml +$ kubectl get infisicalSecrets +NAME AGE +infisicalsecret-sample 12s + +$ kubectl describe infisicalSecret infisicalsecret-sample +... +Spec: +... +Status: + Conditions: + Last Transition Time: 2022-12-18T04:29:09Z + Message: Infisical controller has located the Infisical token in provided Kubernetes secret + Reason: OK + Status: True + Type: secrets.infisical.com/LoadedInfisicalToken + Last Transition Time: 2022-12-18T04:29:10Z + Message: Failed to update secret because: 400 Bad Request + Reason: Error + Status: False + Type: secrets.infisical.com/ReadyToSyncSecrets +Events: +``` + +## Uninstall Operator + +The managed secret created by the operator will not be deleted when the operator is uninstalled. + + + + Install Infisical Helm repository + ```bash + helm uninstall add + ``` + + + ``` + kubectl delete -f https://raw.githubusercontent.com/Infisical/infisical/main/k8-operator/kubectl-install/install-secrets-operator.yaml + ``` + + diff --git a/docs/mint.json b/docs/mint.json index 7343622dbc..8a6b954870 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -21,7 +21,9 @@ "to": "#F8B7BD" } }, - "topbarLinks": [{ "name": "Log In", "url": "https://app.infisical.com/login" }], + "topbarLinks": [ + { "name": "Log In", "url": "https://app.infisical.com/login" } + ], "topbarCtaButton": { "name": "Start for Free", "url": "https://app.infisical.com/signup" @@ -113,18 +115,17 @@ "pages": ["self-hosting/configuration/envars"] } ] - }, + }, { "group": "Integrations", - "pages": [ - "integrations/overview" - ] + "pages": ["integrations/overview"] }, { "group": "Platforms", "pages": [ "integrations/platforms/docker", - "integrations/platforms/docker-compose" + "integrations/platforms/docker-compose", + "integrations/platforms/kubernetes" ] }, { @@ -138,9 +139,7 @@ }, { "group": "CI/CD", - "pages": [ - "integrations/cicd/circleci" - ] + "pages": ["integrations/cicd/circleci"] }, { "group": "Frameworks", From 19b909cd1254399986ff43709959321fefa62b66 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 17 Dec 2022 23:57:06 -0500 Subject: [PATCH 11/37] modify verify step in docs --- docs/integrations/platforms/kubernetes.mdx | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index a43f03824e..51a9d7ec4f 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -50,6 +50,7 @@ This resource is available after installing the Infisical operator. In order to Once the secret is created, add the name and namespace of the secret under `tokenSecretReference` field in the InfisicalSecret custom resource. {' '} + No matter what the name of the secret is or its namespace, it must contain a key named `infisicalToken` with a valid Infisical Token as the value @@ -98,8 +99,8 @@ spec: ## Verify -After creating an `InfisicalSecret` custom resource, you can reference the managed secret specified in the `managedSecretReference` field in your deployment just like any other Kubernetes secret. -To confirm that the operator has created the managed secret specified in managedSecretReference, you can list the secrets in the namespace you specified. +To use the InfisicalSecret custom resource in your deployment, you can simply reference the managed secret specified in the `managedSecretReference` field as you would any other Kubernetes secret. +To verify that the operator has successfully created the managed secret, you can check the secrets in the namespace that was specified. ```bash # Verify managed secret is created From 33dddd440c19dfa60ace43becf95c5ee3a1e6c0e Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 17 Dec 2022 23:58:45 -0500 Subject: [PATCH 12/37] move coming soon integ to bottom --- docs/integrations/overview.mdx | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/integrations/overview.mdx b/docs/integrations/overview.mdx index 577aa3bee5..676fe79413 100644 --- a/docs/integrations/overview.mdx +++ b/docs/integrations/overview.mdx @@ -12,18 +12,6 @@ Missing an integration? Throw in a [request](https://github.com/Infisical/infisi | [Docker-Compose](/integrations/platforms/docker-compose) | Platform | Available | | [Kubernetes](/integrations/platforms/kubernetes) | Platform | Available | | [Heroku](/integrations/cloud/heroku) | Cloud | Available | -| [Vercel](/integrations/cloud/vercel) | Cloud | Coming soon | -| [Render](/integrations/cloud/render) | Cloud | Coming soon | -| [Fly.io](/integrations/cloud/flyio) | Cloud | Coming soon | -| AWS | Cloud | Coming soon | -| GCP | Cloud | Coming soon | -| Azure | Cloud | Coming soon | -| DigitalOcean | Cloud | Coming soon | -| GitLab | CI/CD | Coming soon | -| [CircleCI](/integrations/cicd/circleci) | CI/CD | Coming soon | -| TravisCI | CI/CD | Coming soon | -| GitHub Actions | CI/CD | Coming soon | -| Jenkins | CI/CD | Coming soon | | [React](/integrations/frameworks/react) | Framework | Available | | [Vue](/integrations/frameworks/vue) | Framework | Available | | [Express](/integrations/frameworks/express) | Framework | Available | @@ -38,3 +26,15 @@ Missing an integration? Throw in a [request](https://github.com/Infisical/infisi | [Flask](/integrations/frameworks/flask) | Framework | Available | | [Laravel](/integrations/frameworks/laravel) | Framework | Available | | [Ruby on Rails](/integrations/frameworks/rails) | Framework | Available | +| [Vercel](/integrations/cloud/vercel) | Cloud | Coming soon | +| [Render](/integrations/cloud/render) | Cloud | Coming soon | +| [Fly.io](/integrations/cloud/flyio) | Cloud | Coming soon | +| AWS | Cloud | Coming soon | +| GCP | Cloud | Coming soon | +| Azure | Cloud | Coming soon | +| DigitalOcean | Cloud | Coming soon | +| GitLab | CI/CD | Coming soon | +| [CircleCI](/integrations/cicd/circleci) | CI/CD | Coming soon | +| TravisCI | CI/CD | Coming soon | +| GitHub Actions | CI/CD | Coming soon | +| Jenkins | CI/CD | Coming soon | From de11c505630f4753c98e8ef169deced8955c8c6c Mon Sep 17 00:00:00 2001 From: seunghyunOh Date: Sun, 18 Dec 2022 15:35:54 +0900 Subject: [PATCH 13/37] Delete Prettier --- .prettierrc | 7 --- backend/.eslintrc | 5 +- backend/package-lock.json | 115 +------------------------------------- backend/package.json | 4 -- package-lock.json | 27 +-------- package.json | 4 +- 6 files changed, 8 insertions(+), 154 deletions(-) delete mode 100644 .prettierrc diff --git a/.prettierrc b/.prettierrc deleted file mode 100644 index fa81e63deb..0000000000 --- a/.prettierrc +++ /dev/null @@ -1,7 +0,0 @@ -{ - "semi": true, - "trailingComma": "none", - "singleQuote": true, - "printWidth": 80, - "useTabs": false -} diff --git a/backend/.eslintrc b/backend/.eslintrc index 7fe1989012..c1ca1a1eba 100644 --- a/backend/.eslintrc +++ b/backend/.eslintrc @@ -1,11 +1,10 @@ { "parser": "@typescript-eslint/parser", - "plugins": ["@typescript-eslint", "prettier"], + "plugins": ["@typescript-eslint"], "extends": [ "eslint:recommended", "plugin:@typescript-eslint/eslint-recommended", - "plugin:@typescript-eslint/recommended", - "prettier" + "plugin:@typescript-eslint/recommended" ], "rules": { "no-console": 2 diff --git a/backend/package-lock.json b/backend/package-lock.json index c13f138d4c..cce7390a5b 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -49,13 +49,10 @@ "@typescript-eslint/eslint-plugin": "^5.40.1", "@typescript-eslint/parser": "^5.40.1", "eslint": "^8.26.0", - "eslint-config-prettier": "^8.5.0", - "eslint-plugin-prettier": "^4.2.1", "install": "^0.13.0", "jest": "^29.3.1", "nodemon": "^2.0.19", "npm": "^8.19.3", - "prettier": "^2.7.1", "ts-node": "^10.9.1" } }, @@ -4266,39 +4263,6 @@ "url": "https://opencollective.com/eslint" } }, - "node_modules/eslint-config-prettier": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.5.0.tgz", - "integrity": "sha512-obmWKLUNCnhtQRKc+tmnYuQl0pFU1ibYJQ5BGhTVB08bHe9wC8qUeG7c08dj9XX+AuPj1YSGSQIHl1pnDHZR0Q==", - "dev": true, - "bin": { - "eslint-config-prettier": "bin/cli.js" - }, - "peerDependencies": { - "eslint": ">=7.0.0" - } - }, - "node_modules/eslint-plugin-prettier": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.2.1.tgz", - "integrity": "sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==", - "dev": true, - "dependencies": { - "prettier-linter-helpers": "^1.0.0" - }, - "engines": { - "node": ">=12.0.0" - }, - "peerDependencies": { - "eslint": ">=7.28.0", - "prettier": ">=2.0.0" - }, - "peerDependenciesMeta": { - "eslint-config-prettier": { - "optional": true - } - } - }, "node_modules/eslint-scope": { "version": "5.1.1", "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz", @@ -4616,12 +4580,6 @@ "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", "dev": true }, - "node_modules/fast-diff": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.2.0.tgz", - "integrity": "sha512-xJuoT5+L99XlZ8twedaRf6Ax2TgQVxvgZOYoPKqZufmJib0tL2tegPBOZb1pVNgIhlqDlA0eO0c3wBvQcmzx4w==", - "dev": true - }, "node_modules/fast-glob": { "version": "3.2.12", "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.12.tgz", @@ -9673,33 +9631,6 @@ "node": ">= 0.8.0" } }, - "node_modules/prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==", - "dev": true, - "bin": { - "prettier": "bin-prettier.js" - }, - "engines": { - "node": ">=10.13.0" - }, - "funding": { - "url": "https://github.com/prettier/prettier?sponsor=1" - } - }, - "node_modules/prettier-linter-helpers": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz", - "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==", - "dev": true, - "dependencies": { - "fast-diff": "^1.1.2" - }, - "engines": { - "node": ">=6.0.0" - } - }, "node_modules/pretty-format": { "version": "29.3.1", "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-29.3.1.tgz", @@ -13716,8 +13647,7 @@ "version": "5.3.2", "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz", "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==", - "dev": true, - "requires": {} + "dev": true }, "acorn-walk": { "version": "8.2.0", @@ -14504,22 +14434,6 @@ } } }, - "eslint-config-prettier": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.5.0.tgz", - "integrity": "sha512-obmWKLUNCnhtQRKc+tmnYuQl0pFU1ibYJQ5BGhTVB08bHe9wC8qUeG7c08dj9XX+AuPj1YSGSQIHl1pnDHZR0Q==", - "dev": true, - "requires": {} - }, - "eslint-plugin-prettier": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.2.1.tgz", - "integrity": "sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==", - "dev": true, - "requires": { - "prettier-linter-helpers": "^1.0.0" - } - }, "eslint-scope": { "version": "5.1.1", "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz", @@ -14718,8 +14632,7 @@ "express-rate-limit": { "version": "6.7.0", "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-6.7.0.tgz", - "integrity": "sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==", - "requires": {} + "integrity": "sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==" }, "express-validator": { "version": "6.14.2", @@ -14742,12 +14655,6 @@ "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", "dev": true }, - "fast-diff": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.2.0.tgz", - "integrity": "sha512-xJuoT5+L99XlZ8twedaRf6Ax2TgQVxvgZOYoPKqZufmJib0tL2tegPBOZb1pVNgIhlqDlA0eO0c3wBvQcmzx4w==", - "dev": true - }, "fast-glob": { "version": "3.2.12", "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.12.tgz", @@ -15561,8 +15468,7 @@ "version": "1.2.2", "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.2.tgz", "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==", - "dev": true, - "requires": {} + "dev": true }, "jest-regex-util": { "version": "29.2.0", @@ -18315,21 +18221,6 @@ "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==", "dev": true }, - "prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==", - "dev": true - }, - "prettier-linter-helpers": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz", - "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==", - "dev": true, - "requires": { - "fast-diff": "^1.1.2" - } - }, "pretty-format": { "version": "29.3.1", "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-29.3.1.tgz", diff --git a/backend/package.json b/backend/package.json index 771bbc7e64..5e1793bfe7 100644 --- a/backend/package.json +++ b/backend/package.json @@ -37,7 +37,6 @@ "build": "rimraf ./build && tsc && cp -R ./src/templates ./src/json ./build", "lint": "eslint . --ext .ts", "lint-and-fix": "eslint . --ext .ts --fix", - "prettier-format": "prettier --config .prettierrc 'src/**/*.ts' --write", "lint-staged": "lint-staged" }, "repository": { @@ -64,13 +63,10 @@ "@typescript-eslint/eslint-plugin": "^5.40.1", "@typescript-eslint/parser": "^5.40.1", "eslint": "^8.26.0", - "eslint-config-prettier": "^8.5.0", - "eslint-plugin-prettier": "^4.2.1", "install": "^0.13.0", "jest": "^29.3.1", "nodemon": "^2.0.19", "npm": "^8.19.3", - "prettier": "^2.7.1", "ts-node": "^10.9.1" } } diff --git a/package-lock.json b/package-lock.json index 3a41579024..5486dd05bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,8 +8,7 @@ "license": "ISC", "devDependencies": { "eslint": "^8.29.0", - "husky": "^8.0.2", - "prettier": "^2.8.1" + "husky": "^8.0.2" } }, "node_modules/@eslint/eslintrc": { @@ -899,21 +898,6 @@ "node": ">= 0.8.0" } }, - "node_modules/prettier": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.1.tgz", - "integrity": "sha512-lqGoSJBQNJidqCHE80vqZJHWHRFoNYsSpP9AjFhlhi9ODCJA541svILes/+/1GM3VaL/abZi7cpFzOpdR9UPKg==", - "dev": true, - "bin": { - "prettier": "bin-prettier.js" - }, - "engines": { - "node": ">=10.13.0" - }, - "funding": { - "url": "https://github.com/prettier/prettier?sponsor=1" - } - }, "node_modules/punycode": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz", @@ -1228,8 +1212,7 @@ "version": "5.3.2", "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz", "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==", - "dev": true, - "requires": {} + "dev": true }, "ajv": { "version": "6.12.6", @@ -1809,12 +1792,6 @@ "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==", "dev": true }, - "prettier": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.1.tgz", - "integrity": "sha512-lqGoSJBQNJidqCHE80vqZJHWHRFoNYsSpP9AjFhlhi9ODCJA541svILes/+/1GM3VaL/abZi7cpFzOpdR9UPKg==", - "dev": true - }, "punycode": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz", diff --git a/package.json b/package.json index d5371d0e29..4d042a13dd 100644 --- a/package.json +++ b/package.json @@ -14,14 +14,12 @@ "prepare": "husky install" }, "lint-staged": { - "**/*": "prettier --write --ignore-unknown", "*.{js,jsx,ts,tsx}": [ "eslint --fix" ] }, "devDependencies": { "eslint": "^8.29.0", - "husky": "^8.0.2", - "prettier": "^2.8.1" + "husky": "^8.0.2" } } From 6ed8f8af08d94ac1348ba162bd0aee1951abbdcd Mon Sep 17 00:00:00 2001 From: seunghyunOh Date: Sun, 18 Dec 2022 15:50:13 +0900 Subject: [PATCH 14/37] Fix login runtime error --- frontend/components/utilities/attemptLogin.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/components/utilities/attemptLogin.js b/frontend/components/utilities/attemptLogin.js index 228f58727b..188e038027 100644 --- a/frontend/components/utilities/attemptLogin.js +++ b/frontend/components/utilities/attemptLogin.js @@ -42,9 +42,9 @@ const attemptLogin = async ( async () => { const clientPublicKey = client.getPublicKey(); - const { serverPublicKey, salt } = await login1(email, clientPublicKey); - try { + const { serverPublicKey, salt } = await login1(email, clientPublicKey); + client.setSalt(salt); client.setServerPublicKey(serverPublicKey); const clientProof = client.getProof(); // called M1 From 02e5be20c28591c4a27fd9f301cf8473e081f962 Mon Sep 17 00:00:00 2001 From: mv-turtle <78047717+mv-turtle@users.noreply.github.com> Date: Sun, 18 Dec 2022 08:39:40 -0500 Subject: [PATCH 15/37] Update README.md --- README.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ba76997f1f..18ca9cde5f 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,9 @@ Slack community channel + + Infisical Twitter + Dashboard @@ -134,7 +137,9 @@ We're currently setting the foundation and building [integrations](https://infis 🔜 Vercel (https://github.com/Infisical/infisical/issues/60) - 🔜 GitLab CI/CD + + ✔️ Kubernetes + 🔜 Fly.io @@ -156,7 +161,7 @@ We're currently setting the foundation and building [integrations](https://infis 🔜 GCP - 🔜 Kubernetes + 🔜 GitLab CI/CD 🔜 CircleCI From 06c1827f382e84bbd0354b9200c56aa318fbe083 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sun, 18 Dec 2022 12:29:21 -0500 Subject: [PATCH 16/37] Remove prettier --- backend/package-lock.json | 23 ++++++----------------- frontend/package-lock.json | 22 ---------------------- frontend/package.json | 1 - package-lock.json | 3 ++- 4 files changed, 8 insertions(+), 41 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index cce7390a5b..b5da475f0d 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -2915,12 +2915,6 @@ "@types/node": "*" } }, - "node_modules/@types/prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ri0UmynRRvZiiUJdiz38MmIblKK+oH30MztdBVR95dv/Ubw6neWSb8u1XpRb72L4qsZOhz+L+z9JD40SJmfWow==", - "dev": true - }, "node_modules/@types/qs": { "version": "6.9.7", "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz", @@ -5838,7 +5832,6 @@ "@jest/transform": "^29.3.1", "@jest/types": "^29.3.1", "@types/babel__traverse": "^7.0.6", - "@types/prettier": "^2.1.5", "babel-preset-current-node-syntax": "^1.0.0", "chalk": "^4.0.0", "expect": "^29.3.1", @@ -13439,12 +13432,6 @@ "@types/node": "*" } }, - "@types/prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ri0UmynRRvZiiUJdiz38MmIblKK+oH30MztdBVR95dv/Ubw6neWSb8u1XpRb72L4qsZOhz+L+z9JD40SJmfWow==", - "dev": true - }, "@types/qs": { "version": "6.9.7", "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz", @@ -13647,7 +13634,8 @@ "version": "5.3.2", "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz", "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==", - "dev": true + "dev": true, + "requires": {} }, "acorn-walk": { "version": "8.2.0", @@ -14632,7 +14620,8 @@ "express-rate-limit": { "version": "6.7.0", "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-6.7.0.tgz", - "integrity": "sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==" + "integrity": "sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==", + "requires": {} }, "express-validator": { "version": "6.14.2", @@ -15468,7 +15457,8 @@ "version": "1.2.2", "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.2.tgz", "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==", - "dev": true + "dev": true, + "requires": {} }, "jest-regex-util": { "version": "29.2.0", @@ -15578,7 +15568,6 @@ "@jest/transform": "^29.3.1", "@jest/types": "^29.3.1", "@types/babel__traverse": "^7.0.6", - "@types/prettier": "^2.1.5", "babel-preset-current-node-syntax": "^1.0.0", "chalk": "^4.0.0", "expect": "^29.3.1", diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 5e3bb010b9..b65657f854 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -60,7 +60,6 @@ "eslint-import-resolver-typescript": "^3.5.2", "eslint-plugin-simple-import-sort": "^8.0.0", "postcss": "^8.4.14", - "prettier": "2.7.1", "tailwindcss": "^3.1.4", "typescript": "^4.9.3" } @@ -5999,21 +5998,6 @@ "node": ">= 0.8.0" } }, - "node_modules/prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==", - "dev": true, - "bin": { - "prettier": "bin-prettier.js" - }, - "engines": { - "node": ">=10.13.0" - }, - "funding": { - "url": "https://github.com/prettier/prettier?sponsor=1" - } - }, "node_modules/process-nextick-args": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz", @@ -11950,12 +11934,6 @@ "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==", "dev": true }, - "prettier": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz", - "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==", - "dev": true - }, "process-nextick-args": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz", diff --git a/frontend/package.json b/frontend/package.json index 00952149d6..12b2e9ec27 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -64,7 +64,6 @@ "eslint-import-resolver-typescript": "^3.5.2", "eslint-plugin-simple-import-sort": "^8.0.0", "postcss": "^8.4.14", - "prettier": "2.7.1", "tailwindcss": "^3.1.4", "typescript": "^4.9.3" } diff --git a/package-lock.json b/package-lock.json index 5486dd05bd..cf02a1760d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1212,7 +1212,8 @@ "version": "5.3.2", "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz", "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==", - "dev": true + "dev": true, + "requires": {} }, "ajv": { "version": "6.12.6", From 5474096ca9542af09c8fd67f246dcb26adfd1d4c Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sun, 18 Dec 2022 12:47:33 -0500 Subject: [PATCH 17/37] Move Stay Up-to-Date to bottom to give integrations more spot light --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 18ca9cde5f..b67c3b6418 100644 --- a/README.md +++ b/README.md @@ -95,12 +95,6 @@ Not sure where to get started? You can: We're currently in Public Alpha. -## 🚨 Stay Up-to-Date - -Infisical officially launched as v.1.0 on November 21st, 2022. However, a lot of new features are coming very quickly. Watch **releases** of this repository to be notified about future updates: - -![infisical-star-github](https://github.com/Infisical/infisical/blob/main/.github/images/star-infisical.gif?raw=true) - ## 🔌 Integrations We're currently setting the foundation and building [integrations](https://infisical.com/docs/integrations/overview) so secrets can be synced everywhere. Any help is welcome! :) @@ -307,6 +301,12 @@ This repo is entirely MIT licensed, with the exception of the `ee` directory whi Looking to report a security vulnerability? Please don't post about it in GitHub issue. Instead, refer to our [SECURITY.md](./SECURITY.md) file. +## 🚨 Stay Up-to-Date + +Infisical officially launched as v.1.0 on November 21st, 2022. However, a lot of new features are coming very quickly. Watch **releases** of this repository to be notified about future updates: + +![infisical-star-github](https://github.com/Infisical/infisical/blob/main/.github/images/star-infisical.gif?raw=true) + ## 🦸 Contributors [//]: contributor-faces From 20ea50bfafc8e41f8023cba9a6551a9e5e009c54 Mon Sep 17 00:00:00 2001 From: mv-turtle <78047717+mv-turtle@users.noreply.github.com> Date: Sun, 18 Dec 2022 13:32:08 -0500 Subject: [PATCH 18/37] Added intercom to docs --- docs/mint.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/mint.json b/docs/mint.json index 8a6b954870..19a499fe86 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -178,5 +178,8 @@ ] } ], - "backgroundImage": "/images/background.png" + "backgroundImage": "/images/background.png", + "integrations": { + "intercom": "hsg644ru" + } } From 91052df5f9f91fd5bbb12e856795ff0702e86be6 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sun, 18 Dec 2022 18:57:50 -0500 Subject: [PATCH 19/37] Fix Typescript issues for frontend integrations --- docker-compose.yml | 2 +- frontend/components/basic/Listbox.tsx | 6 +- frontend/components/basic/buttons/Button.tsx | 2 +- .../integrations/CloudIntegration.tsx | 16 +-- .../integrations/CloudIntegrationSection.tsx | 3 + .../FrameworkIntegrationSection.tsx | 5 +- .../components/integrations/Integration.tsx | 110 ++++++++++-------- .../integrations/IntegrationSection.tsx | 19 ++- frontend/components/utilities/config/index.ts | 6 +- frontend/pages/api/bot/setBotActiveStatus.ts | 2 +- ...ateIntegration.js => updateIntegration.ts} | 11 +- frontend/pages/integrations/[id].js | 29 ++--- frontend/pages/netlify.js | 24 ++-- frontend/pages/vercel.js | 24 ++-- frontend/public/data/frequentConstants.ts | 21 ++-- 15 files changed, 156 insertions(+), 124 deletions(-) rename frontend/pages/api/integrations/{updateIntegration.js => updateIntegration.ts} (87%) diff --git a/docker-compose.yml b/docker-compose.yml index bd9022cef8..206e7afa3f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,7 +9,7 @@ services: - 80:80 - 443:443 volumes: - - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro + - ./nginx/default.dev.conf:/etc/nginx/conf.d/default.conf:ro depends_on: - frontend - backend diff --git a/frontend/components/basic/Listbox.tsx b/frontend/components/basic/Listbox.tsx index aa8c41f85d..2ff0179dd6 100644 --- a/frontend/components/basic/Listbox.tsx +++ b/frontend/components/basic/Listbox.tsx @@ -10,10 +10,10 @@ import { Listbox, Transition } from "@headlessui/react"; interface ListBoxProps { selected: string; - onChange: () => void; + onChange: (arg: string) => void; data: string[]; - text: string; - buttonAction: () => void; + text?: string; + buttonAction?: () => void; isFull?: boolean; } diff --git a/frontend/components/basic/buttons/Button.tsx b/frontend/components/basic/buttons/Button.tsx index 9f8d481b4f..562a82a36f 100644 --- a/frontend/components/basic/buttons/Button.tsx +++ b/frontend/components/basic/buttons/Button.tsx @@ -9,7 +9,7 @@ import { const classNames = require("classnames"); type ButtonProps = { - text: string; + text?: string; onButtonPressed: () => void; loading?: boolean; color?: string; diff --git a/frontend/components/integrations/CloudIntegration.tsx b/frontend/components/integrations/CloudIntegration.tsx index f64268dbac..75a8019a5e 100644 --- a/frontend/components/integrations/CloudIntegration.tsx +++ b/frontend/components/integrations/CloudIntegration.tsx @@ -1,30 +1,32 @@ import React from "react"; import Image from "next/image"; import { useRouter } from "next/router"; -import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { faCheck, faX, } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + import deleteIntegrationAuth from "../../pages/api/integrations/DeleteIntegrationAuth"; interface CloudIntegrationOption { - isAvailable: Boolean; + isAvailable: boolean; name: string; type: string; clientId: string; docsLink: string; + slug: string; } interface IntegrationAuth { - id: string; + _id: string; integration: string; } interface Props { cloudIntegrationOption: CloudIntegrationOption; - setSelectedIntegrationOption: () => void; - integrationOptionPress: () => void; + setSelectedIntegrationOption: (cloudIntegration: CloudIntegrationOption) => void; + integrationOptionPress: (cloudIntegrationOption: CloudIntegrationOption) => void; integrationAuths: IntegrationAuth[]; } @@ -45,9 +47,7 @@ const CloudIntegration = ({ onClick={() => { if (!cloudIntegrationOption.isAvailable) return; setSelectedIntegrationOption(cloudIntegrationOption); - integrationOptionPress({ - integrationOption: cloudIntegrationOption - }); + integrationOptionPress(cloudIntegrationOption); }} key={cloudIntegrationOption.name} > diff --git a/frontend/components/integrations/CloudIntegrationSection.tsx b/frontend/components/integrations/CloudIntegrationSection.tsx index 87ff74df14..58fb92cb2a 100644 --- a/frontend/components/integrations/CloudIntegrationSection.tsx +++ b/frontend/components/integrations/CloudIntegrationSection.tsx @@ -1,11 +1,14 @@ import React from "react"; + import CloudIntegration from "./CloudIntegration"; interface CloudIntegrationOption { + isAvailable: boolean; name: string; type: string; clientId: string; docsLink: string; + slug: string; } interface Props { diff --git a/frontend/components/integrations/FrameworkIntegrationSection.tsx b/frontend/components/integrations/FrameworkIntegrationSection.tsx index c83599dc1d..8535c595b0 100644 --- a/frontend/components/integrations/FrameworkIntegrationSection.tsx +++ b/frontend/components/integrations/FrameworkIntegrationSection.tsx @@ -1,14 +1,17 @@ import React from "react"; + import FrameworkIntegration from "./FrameworkIntegration"; interface Framework { name: string; image: string; link: string; + slug: string; + docsLink: string; } interface Props { - framework: Framework + frameworks: [Framework] } const FrameworkIntegrationSection = ({ frameworks }: Props) => { diff --git a/frontend/components/integrations/Integration.tsx b/frontend/components/integrations/Integration.tsx index a42fa5bcf8..de0747409c 100644 --- a/frontend/components/integrations/Integration.tsx +++ b/frontend/components/integrations/Integration.tsx @@ -6,23 +6,30 @@ import { faX, } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; -import { - envMapping, - reverseEnvMapping, - reverseContextNetlifyMapping -} from "../../public/data/frequentConstants"; -import updateIntegration from "../../pages/api/integrations/updateIntegration" -import deleteIntegration from "../../pages/api/integrations/DeleteIntegration" -import getIntegrationApps from "../../pages/api/integrations/GetIntegrationApps"; + import Button from "~/components/basic/buttons/Button"; import ListBox from "~/components/basic/Listbox"; +import deleteIntegration from "../../pages/api/integrations/DeleteIntegration" +import getIntegrationApps from "../../pages/api/integrations/GetIntegrationApps"; +import updateIntegration from "../../pages/api/integrations/updateIntegration" +import { + envMapping, + reverseContextNetlifyMapping, + reverseEnvMapping} from "../../public/data/frequentConstants"; + interface Integration { + _id: string; app?: string; environment: string; integration: string; integrationAuth: string; - isActive: Boolean; + isActive: boolean; +} + +interface IntegrationApp { + name: string; + siteId: string; } const Integration = ({ @@ -35,39 +42,44 @@ const Integration = ({ ); const [fileState, setFileState] = useState([]); const router = useRouter(); - const [apps, setApps] = useState([]); // integration app objects - const [integrationApp, setIntegrationApp] = useState(null); // integration app name - const [integrationTarget, setIntegrationTarget] = useState(null); // vercel-specific integration param - const [integrationContext, setIntegrationContext] = useState(null); // netlify-specific integration param + const [apps, setApps] = useState([]); // integration app objects + const [integrationApp, setIntegrationApp] = useState(""); // integration app name + const [integrationTarget, setIntegrationTarget] = useState(""); // vercel-specific integration param + const [integrationContext, setIntegrationContext] = useState(""); // netlify-specific integration param - useEffect(async () => { - interface App { - name: string; - siteId?: string; - } + useEffect(() => { - const tempApps = await getIntegrationApps({ - integrationAuthId: integration.integrationAuth, - }); - - setApps(tempApps); - setIntegrationApp( - integration.app ? integration.app : tempApps[0].name - ); - - switch (integration.integration) { - case "vercel": - setIntegrationTarget("Development"); - break; - case "netlify": - setIntegrationContext("All"); - break; - default: - break; + const loadIntegration = async () => { + interface App { + name: string; + siteId?: string; + } + + const tempApps: [IntegrationApp] = await getIntegrationApps({ + integrationAuthId: integration.integrationAuth, + }); + + setApps(tempApps); + setIntegrationApp( + integration.app ? integration.app : tempApps[0].name + ); + + switch (integration.integration) { + case "vercel": + setIntegrationTarget("Development"); + break; + case "netlify": + setIntegrationContext("All"); + break; + default: + break; + } } + + loadIntegration(); }, []); - const renderIntegrationSpecificParams = (integration) => { + const renderIntegrationSpecificParams = (integration: Integration) => { try { switch (integration.integration) { case "vercel": @@ -77,11 +89,11 @@ const Integration = ({ ENVIRONMENT @@ -94,13 +106,13 @@ const Integration = ({ CONTEXT @@ -126,9 +138,11 @@ const Integration = ({ "Staging", "Testing", "Production", - ] : null} + ] : []} selected={integrationEnvironment} - onChange={setIntegrationEnvironment} + onChange={(environment) => { + setIntegrationEnvironment(environment); + }} isFull={true} /> @@ -152,9 +166,11 @@ const Integration = ({ APP app.name)} + data={!integration.isActive ? apps.map((app) => app.name) : []} selected={integrationApp} - onChange={setIntegrationApp} + onChange={(app) => { + setIntegrationApp(app); + }} /> {renderIntegrationSpecificParams(integration)} @@ -172,7 +188,9 @@ const Integration = ({