-
Notifications
You must be signed in to change notification settings - Fork 0
feat: platform SecretStack with AWS and Vault backends #28
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
2fe4c04
feat: platform SecretStack with AWS and Vault backends
patrickleet 07cc185
feat: prototype typed SecretStack composition gates
patrickleet 91b6072
fix: restore local SecretStack validation
patrickleet b48e646
chore: remove accidental Rust composition prototype
patrickleet ee25fd0
fix: validate and bootstrap SecretStack backends
patrickleet b2bebc4
fix: harden review workflow checkout
patrickleet ed11b8f
fix: compute SecretStack readiness
patrickleet d5ea605
fix: preserve disabled SecretStore setting
patrickleet 3d02069
refactor: remove duplicate SecretStack readiness
patrickleet File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,111 +1,119 @@ | ||
| # aws-secret-stack | ||
| # secret-stack | ||
|
|
||
| Installs external-secrets with AWS Pod Identity for Secrets Manager and SSM Parameter Store access. Optionally creates a SecretStore. | ||
| Installs [External Secrets Operator](https://external-secrets.io/) and wires a | ||
| SecretStore to either **AWS Secrets Manager** or **HashiCorp Vault**. | ||
|
|
||
| ## Overview | ||
| **API group:** `hops.ops.com.ai` (platform-neutral; no longer `aws.hops.ops.com.ai`). | ||
|
|
||
| Composes a `helm.m.crossplane.io/Release` for external-secrets with `aws.hops.ops.com.ai/PodIdentity`. | ||
| Automatically provisions IAM role and Pod Identity association for external-secrets' service account. | ||
| ## Backend selection | ||
|
|
||
| Additionally: | ||
| - Creates a **SecretStore** (namespaced by default) or **ClusterSecretStore** (opt-in) pointing to AWS Secrets Manager, so ExternalSecrets can pull secrets immediately | ||
| | `spec.backend` | What gets created | | ||
| |----------------|-------------------| | ||
| | `aws` (default) | ESO Helm + AWS PodIdentity + Secrets Manager SecretStore | | ||
| | `vault` | ESO Helm + Vault SecretStore; optional in-cluster Vault Helm (`vault.install`) | | ||
|
|
||
| ## Usage | ||
|
|
||
| Minimal — installs ESO, PodIdentity, and SecretStore: | ||
| ### AWS (production EKS) | ||
|
|
||
| ```yaml | ||
| apiVersion: aws.hops.ops.com.ai/v1alpha1 | ||
| apiVersion: hops.ops.com.ai/v1alpha1 | ||
| kind: SecretStack | ||
| metadata: | ||
| name: external-secrets | ||
| namespace: default | ||
| spec: | ||
| clusterName: my-cluster | ||
| backend: aws | ||
| aws: | ||
| region: us-east-1 | ||
| ``` | ||
|
|
||
| With custom values and role prefix: | ||
| ### Vault in-cluster (local / dory) | ||
|
|
||
| ```yaml | ||
| apiVersion: aws.hops.ops.com.ai/v1alpha1 | ||
| apiVersion: hops.ops.com.ai/v1alpha1 | ||
| kind: SecretStack | ||
| metadata: | ||
| name: external-secrets | ||
| namespace: default | ||
| spec: | ||
| clusterName: production-cluster | ||
| namespace: external-secrets | ||
| values: | ||
| serviceAccount: | ||
| create: true | ||
| aws: | ||
| region: us-west-2 | ||
| rolePrefix: prod- | ||
| tags: | ||
| environment: production | ||
| ``` | ||
|
|
||
| ClusterSecretStore (cluster-wide access): | ||
|
|
||
| ```yaml | ||
| apiVersion: aws.hops.ops.com.ai/v1alpha1 | ||
| kind: SecretStack | ||
| metadata: | ||
| name: external-secrets | ||
| namespace: default | ||
| spec: | ||
| clusterName: my-cluster | ||
| clusterName: dory | ||
| backend: vault | ||
| secretStore: | ||
| scope: Cluster | ||
| aws: | ||
| region: us-east-1 | ||
| name: vault | ||
| vault: | ||
| install: true | ||
| # server defaults to http://vault.vault.svc.cluster.local:8200 | ||
| auth: | ||
| method: kubernetes | ||
| role: external-secrets | ||
| ``` | ||
|
|
||
| ESO only — no SecretStore: | ||
| The default dev-mode Vault install bootstraps the Kubernetes auth method, | ||
| cluster connection, policy, and ESO role before the Vault pod becomes Ready. | ||
| If `vault.values` or `vault.overrideAllValues` disables dev mode for an HA or | ||
| production deployment, configure Vault authentication externally; Hops does not | ||
| assume or synthesize production administrator credentials. | ||
|
|
||
| ### External Vault (token auth) | ||
|
|
||
| ```yaml | ||
| apiVersion: aws.hops.ops.com.ai/v1alpha1 | ||
| apiVersion: hops.ops.com.ai/v1alpha1 | ||
| kind: SecretStack | ||
| metadata: | ||
| name: external-secrets | ||
| namespace: default | ||
| spec: | ||
| clusterName: my-cluster | ||
| secretStore: | ||
| enabled: false | ||
| aws: | ||
| region: us-east-1 | ||
| backend: vault | ||
| vault: | ||
| install: false | ||
| server: https://vault.example.com:8200 | ||
| auth: | ||
| method: token | ||
| tokenSecretRef: | ||
| name: vault-token | ||
| key: token | ||
| ``` | ||
|
|
||
| ## What Gets Created | ||
|
|
||
| | Resource | Condition | Description | | ||
| |----------|-----------|-------------| | ||
| | `helm.m.crossplane.io/Release` | Always | external-secrets Helm release (chart v2.2.0) | | ||
| | `aws.hops.ops.com.ai/PodIdentity` | Always | IAM role + Pod Identity with Secrets Manager, SSM, and KMS permissions | | ||
| | `kubernetes.m.crossplane.io/Object` (SecretStore) | `secretStore.enabled` (default true) | ClusterSecretStore or SecretStore wired to AWS Secrets Manager via PodIdentity JWT auth | | ||
| | `helm.m.crossplane.io/Release` (external-secrets) | Always | ESO chart | | ||
| | `helm.m.crossplane.io/Release` (vault) | `backend=vault` + `vault.install` | Official Vault chart (dev-friendly defaults) | | ||
| | `aws.hops.ops.com.ai/PodIdentity` | `backend=aws` | IAM role + Pod Identity for SM/SSM/KMS | | ||
| | `kubernetes.m.crossplane.io/Object` (SecretStore) | `secretStore.enabled` (default true) | Backend-specific SecretStore / ClusterSecretStore | | ||
|
|
||
| ## SecretStore Options | ||
|
|
||
| | Field | Default | Description | | ||
| |-------|---------|-------------| | ||
| | `secretStore.enabled` | `true` | Create a SecretStore resource | | ||
| | `secretStore.scope` | `Namespaced` | `Namespaced` for SecretStore, `Cluster` for ClusterSecretStore | | ||
| | `secretStore.scope` | `Namespaced` | `Namespaced` or `Cluster` | | ||
| | `secretStore.name` | `default` | Name of the SecretStore resource | | ||
|
|
||
| ## Status | ||
| ## Breaking change (from aws-secret-stack) | ||
|
|
||
| | Field | Description | | ||
| |-------|-------------| | ||
| | `ready` | Overall stack readiness | | ||
| - API group: `aws.hops.ops.com.ai` → `hops.ops.com.ai` | ||
| - Package: `aws-secret-stack` → `secret-stack` | ||
| - `spec.aws` is only required when `backend=aws` | ||
| - New `spec.backend` and `spec.vault` | ||
|
|
||
| ## Development | ||
|
|
||
| ```bash | ||
| make render # render all examples | ||
| make validate # validate rendered output | ||
| make test # run KCL unit tests | ||
| make e2e # run E2E tests (requires AWS credentials) | ||
| ``` | ||
|
|
||
| ### Local install (source) | ||
|
|
||
| ```bash | ||
| # Confirm with the user before targeting a cluster | ||
| hops config install --path xrs/stacks/aws/secret | ||
| kubectl apply -f local/secretstack.yaml | ||
| ``` |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.