secretgenerator

README

Secrets generator controller

Uploading secrets in plain text to git repositories is a common security issue in public repositories. Kustomize doesn't have a proper way of generating secrets on-demand, this controller adds the capability of generating random secrets in Openshift that can be used by other apps.

Basic usage

Create a Kubernetes secret with the secret-generator.opendatahub.io/name annotation, for example:

apiVersion: v1
kind: Secret
metadata:
  name: example
  annotations:
    secret-generator.opendatahub.io/name: "password"
    secret-generator.opendatahub.io/type: "random"
    secret-generator.opendatahub.io/complexity: "16"
type: Opaque

The controller will generate a new secret, with the same name and appending the suffix -generated, including the generated random value in the .data field:

apiVersion: v1
kind: Secret
metadata:
  name: example-generated
data:
  password: jgKGv6grDaLEMo6r
type: Opaque

Secret types

Generate different secret types based on the secret-generator.opendatahub.io/type annotation:

• random: Generate a random string of the length specified in the complexity annotation. For example, jgKGv6grDaLEMo6r (complexity 16).
• oauth: Generate an OAuth cookie secret. For example dURVM2VrQVI5cnZmK0ZkZXFsNDQrdz09 (complexity 16).

Documentation

Overview

Package secretgenerator contains generator logic of secret resources used in Open Data Hub operator

Index

• Constants
• type Secret
  • func NewSecret(name, secretType string, complexity int) (*Secret, error)
  • func NewSecretFrom(annotations map[string]string) (*Secret, error)
• type SecretGeneratorReconciler
  • func (r *SecretGeneratorReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)
  • func (r *SecretGeneratorReconciler) SetupWithManager(mgr ctrl.Manager) error

Constants

const (
	SECRET_NAME_ANNOTATION         = "secret-generator.opendatahub.io/name"               //nolint
	SECRET_TYPE_ANNOTATION         = "secret-generator.opendatahub.io/type"               //nolint
	SECRET_LENGTH_ANNOTATION       = "secret-generator.opendatahub.io/complexity"         //nolint
	SECRET_OAUTH_CLIENT_ANNOTATION = "secret-generator.opendatahub.io/oauth-client-route" //nolint
	SECRET_DEFAULT_COMPLEXITY      = 16                                                   //nolint

)

Types

type Secret

type Secret struct {
	Name             string
	Type             string
	Complexity       int
	Value            string
	OAuthClientRoute string
}

func NewSecret

func NewSecret(name, secretType string, complexity int) (*Secret, error)

func NewSecretFrom

func NewSecretFrom(annotations map[string]string) (*Secret, error)

type SecretGeneratorReconciler

type SecretGeneratorReconciler struct {
	Client client.Client
	Scheme *runtime.Scheme
}

SecretGeneratorReconciler holds the controller configuration.

func (*SecretGeneratorReconciler) Reconcile

func (r *SecretGeneratorReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)

Reconcile will generate new secret with random data for the annotated secret based on the specified type and complexity. This will avoid possible race conditions when a deployment mounts the secret before it is reconciled.

func (*SecretGeneratorReconciler) SetupWithManager

func (r *SecretGeneratorReconciler) SetupWithManager(mgr ctrl.Manager) error

SetupWithManager sets up the controller with the Manager.