secretgenerator

README

Secrets generator controller

Uploading secrets in plain text to git repositories is a common security issue in public repositories. Kustomize doesn't have a proper way of generating secrets on-demand, this controller adds the capability of generating random secrets in Openshift that can be used by other apps.

Basic usage

Create a Kubernetes secret with the secret-generator.opendatahub.io/name annotation, for example:

apiVersion: v1
kind: Secret
metadata:
  name: example
  annotations:
    secret-generator.opendatahub.io/name: "password"
    secret-generator.opendatahub.io/type: "random"
    secret-generator.opendatahub.io/complexity: "16"
type: Opaque

The controller will generate a new secret, with the same name and appending the suffix -generated, including the generated random value in the .data field:

apiVersion: v1
kind: Secret
metadata:
  name: example-generated
data:
  password: jgKGv6grDaLEMo6r
type: Opaque

Secret types

Generate different secret types based on the secret-generator.opendatahub.io/type annotation:

• random: Generate a random string of the length specified in the complexity annotation. For example, jgKGv6grDaLEMo6r (complexity 16).
• oauth: Generate an OAuth cookie secret. For example dURVM2VrQVI5cnZmK0ZkZXFsNDQrdz09 (complexity 16).

Documentation

Index

• Constants
• type Secret
• type SecretGeneratorReconciler
  • func (r *SecretGeneratorReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)
  • func (r *SecretGeneratorReconciler) SetupWithManager(mgr ctrl.Manager) error

Constants

const (
	SECRET_NAME_ANNOTATION         = "secret-generator.opendatahub.io/name"
	SECRET_TYPE_ANNOTATION         = "secret-generator.opendatahub.io/type"
	SECRET_LENGTH_ANNOTATION       = "secret-generator.opendatahub.io/complexity"
	SECRET_OAUTH_CLIENT_ANNOTATION = "secret-generator.opendatahub.io/oauth-client-route"
	SECRET_DEFAULT_COMPLEXITY      = 16
)

Types

type Secret

type Secret struct {
	Name             string
	Type             string
	Complexity       int
	Value            string
	OAuthClientRoute string
}

type SecretGeneratorReconciler

type SecretGeneratorReconciler struct {
	Client client.Client
	Scheme *runtime.Scheme
}

ReconcileSecretGenerator holds the controller configuration

func (*SecretGeneratorReconciler) Reconcile

func (r *SecretGeneratorReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)

Reconcile will generate new secret with random data for the annotated secret based on the specified type and complexity. This will avoid possible race conditions when a deployment mounts the secret before it is reconciled

func (*SecretGeneratorReconciler) SetupWithManager

func (r *SecretGeneratorReconciler) SetupWithManager(mgr ctrl.Manager) error