diff --git a/go.mod b/go.mod index e161490c1..8605a2214 100644 --- a/go.mod +++ b/go.mod @@ -27,8 +27,8 @@ require ( kmodules.xyz/client-go v0.34.3 kmodules.xyz/custom-resources v0.34.0 kmodules.xyz/monitoring-agent-api v0.34.1 - kubedb.dev/apimachinery v0.66.0-rc.0 - kubedb.dev/db-client-go v0.21.0-rc.0 + kubedb.dev/apimachinery v0.67.0-rc.0 + kubedb.dev/db-client-go v0.22.0-rc.0 kubeops.dev/petset v0.1.1-0.20260709161836-19b3570c41ab sigs.k8s.io/controller-runtime v0.22.4 sigs.k8s.io/yaml v1.6.0 @@ -152,7 +152,7 @@ require ( go.opentelemetry.io/otel v1.43.0 // indirect go.opentelemetry.io/otel/metric v1.43.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect - go.virtual-secrets.dev/apimachinery v0.1.0 // indirect + go.virtual-secrets.dev/apimachinery v0.2.0 // indirect golang.org/x/crypto v0.52.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect diff --git a/go.sum b/go.sum index 8f5c34e54..7113de993 100644 --- a/go.sum +++ b/go.sum @@ -502,8 +502,8 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc= go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= -go.virtual-secrets.dev/apimachinery v0.1.0 h1:m5u/bc7l9ILSMANdJVpxR2SWf8KFv4llPEogMV2HYlg= -go.virtual-secrets.dev/apimachinery v0.1.0/go.mod h1:/o8QNIs2MoS1UwVoYY5hcWZJ07FM8iXQes85zgePQ3s= +go.virtual-secrets.dev/apimachinery v0.2.0 h1:+25tNWXvkIAMZSDuZjuIyPUAdwhMjAeu78BVOYvuHeE= +go.virtual-secrets.dev/apimachinery v0.2.0/go.mod h1:KSrWgHgwGAp+AhLj8e7vziC+2RB4fU0Y0W+nEx5wZRA= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= @@ -795,10 +795,10 @@ kmodules.xyz/resource-metadata v0.46.1 h1:mm4sWZvQMFJJiLdKlPGxD9Cj6f44SCdHB7Csbk kmodules.xyz/resource-metadata v0.46.1/go.mod h1:ejz7IVjhqmj6VH8CVfprocJK/IM++OeunrfUp51ZrIw= kmodules.xyz/resource-metrics v0.34.0 h1:cqscgTx3PONxHj6PIySK3sTlKKv8iKTGzRd+S6YSwXg= kmodules.xyz/resource-metrics v0.34.0/go.mod h1:R34IKtp5+NqcQz7AQJheBJK6Iem0LqrCbm/55Mn+ECQ= -kubedb.dev/apimachinery v0.66.0-rc.0 h1:JP1ryqzIe/YynZB9HzeYqMDKVEZ7Iec6AZwNx4vzPqI= -kubedb.dev/apimachinery v0.66.0-rc.0/go.mod h1:tVMz+Fw+pJ26Rd9mK+rzdEt2EAsMM4pHYfY7rFW1/bE= -kubedb.dev/db-client-go v0.21.0-rc.0 h1:OjOyCXt9fF8xUFWnMsv6tyRvY7sOkksgQjWbv8GrVNQ= -kubedb.dev/db-client-go v0.21.0-rc.0/go.mod h1:AWqoU3zuoBYlrKZweBLV+XIv4cNxu+nLohx+PGwrfWk= +kubedb.dev/apimachinery v0.67.0-rc.0 h1:+BerQvPs70WyWUh+FvJSU2r96xKDEMc9jSS4cMLrXcU= +kubedb.dev/apimachinery v0.67.0-rc.0/go.mod h1:JDH2CEo4d0f7hySMPrYoPrO70S7MeLDB220U9mebHN4= +kubedb.dev/db-client-go v0.22.0-rc.0 h1:NQmg3n5Rh53jR/LSOGuC30hHeYAHmpPrT9yjoDVDkVk= +kubedb.dev/db-client-go v0.22.0-rc.0/go.mod h1:LvBT/TgaQj0LszxyyIrZDKDBRvw6ZZjfMN9BZp0B1vg= kubeops.dev/csi-driver-cacerts v0.5.1-0.20260418091014-4f539f46235c h1:ZKmBV3fFfCWQ3jDeWBbUi2J4WjJ2ff88n+cTqJ8ZXT8= kubeops.dev/csi-driver-cacerts v0.5.1-0.20260418091014-4f539f46235c/go.mod h1:VNbwC3gTWfmdQCVxd8mkVx+n1+0F1lOA5X3usyZN1rk= kubeops.dev/operator-shard-manager v0.0.6-0.20260418091213-65daf7da824d h1:/nZYflp2w1x+wQmxDtHR0Sbzl39fcuaJ66oqgVXBBwQ= diff --git a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/openapi_generated.go b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/openapi_generated.go index d398c559a..91fcec64e 100644 --- a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/openapi_generated.go +++ b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/openapi_generated.go @@ -830,25 +830,26 @@ func schema_apimachinery_apis_config_v1alpha1_Vault(ref common.ReferenceCallback SchemaProps: spec.SchemaProps{ Type: []string{"object"}, Properties: map[string]spec.Schema{ - "url": { + "ref": { SchemaProps: spec.SchemaProps{ - Description: "Connection url to the secret manager", - Default: "", - Type: []string{"string"}, - Format: "", + Description: "Ref refers to the AppBinding (kmodules.xyz/custom-resources) that describes how to connect to the Vault/OpenBao server: connection URL and CA bundle. This is the same AppBinding a KubeVault VaultServer publishes for its consumers.\n\nIf that AppBinding's spec.parameters carries isolateTenants: true, Secret reads/writes are routed into the OpenBao/Vault namespace of the tenant that owns the Secret's Kubernetes namespace (derived from the ace.appscode.com/client-org label and ace.appscode.com/org-id annotation on that Kubernetes namespace), instead of the Vault root namespace. Virtual Secrets never creates or mounts engines in that namespace itself; it only reads/writes into namespaces KubeVault has already provisioned.", + Default: map[string]interface{}{}, + Ref: ref("kmodules.xyz/client-go/api/v1.ObjectReference"), }, }, "roleName": { SchemaProps: spec.SchemaProps{ - Description: "Name of the vault role to use for the operator", + Description: "RoleName is the Vault Kubernetes auth role Virtual Secrets logs in as, bound to the virtual-secrets-server service account. This is distinct from the AppBinding's own vaultRole parameter, which authenticates KubeVault's operator, not Virtual Secrets — it must be provisioned separately by a Vault admin.", Type: []string{"string"}, Format: "", }, }, }, - Required: []string{"url"}, + Required: []string{"ref"}, }, }, + Dependencies: []string{ + "kmodules.xyz/client-go/api/v1.ObjectReference"}, } } diff --git a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/secret_store_types.go b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/secret_store_types.go index 3b4e362e7..aef5faf7d 100644 --- a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/secret_store_types.go +++ b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/secret_store_types.go @@ -71,10 +71,25 @@ type SecretStoreList struct { } type Vault struct { - // Connection url to the secret manager - URL string `json:"url"` - - // Name of the vault role to use for the operator + // Ref refers to the AppBinding (kmodules.xyz/custom-resources) that + // describes how to connect to the Vault/OpenBao server: connection URL and CA + // bundle. This is the same AppBinding a KubeVault VaultServer publishes for + // its consumers. + // + // If that AppBinding's spec.parameters carries isolateTenants: true, Secret + // reads/writes are routed into the OpenBao/Vault namespace of the tenant that + // owns the Secret's Kubernetes namespace (derived from the + // ace.appscode.com/client-org label and ace.appscode.com/org-id annotation on + // that Kubernetes namespace), instead of the Vault root namespace. Virtual + // Secrets never creates or mounts engines in that namespace itself; it only + // reads/writes into namespaces KubeVault has already provisioned. + Ref kmapi.ObjectReference `json:"ref"` + + // RoleName is the Vault Kubernetes auth role Virtual Secrets logs in as, + // bound to the virtual-secrets-server service account. This is distinct + // from the AppBinding's own vaultRole parameter, which authenticates + // KubeVault's operator, not Virtual Secrets — it must be provisioned + // separately by a Vault admin. // +optional RoleName string `json:"roleName,omitempty"` } diff --git a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/zz_generated.deepcopy.go b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/zz_generated.deepcopy.go index 3e1795cbd..c696f419b 100644 --- a/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/zz_generated.deepcopy.go @@ -295,6 +295,7 @@ func (in *SecretStoreSpec) DeepCopy() *SecretStoreSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Vault) DeepCopyInto(out *Vault) { *out = *in + out.Ref = in.Ref return } diff --git a/vendor/go.virtual-secrets.dev/apimachinery/crds/config.virtual-secrets.dev_secretstores.yaml b/vendor/go.virtual-secrets.dev/apimachinery/crds/config.virtual-secrets.dev_secretstores.yaml index cdabbbd94..4c2619612 100644 --- a/vendor/go.virtual-secrets.dev/apimachinery/crds/config.virtual-secrets.dev_secretstores.yaml +++ b/vendor/go.virtual-secrets.dev/apimachinery/crds/config.virtual-secrets.dev_secretstores.yaml @@ -99,12 +99,19 @@ spec: type: object vault: properties: + ref: + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object roleName: type: string - url: - type: string required: - - url + - ref type: object type: object type: object diff --git a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/neo4j_helpers.go b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/neo4j_helpers.go index 54667ca62..ad00a0dcf 100644 --- a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/neo4j_helpers.go +++ b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/neo4j_helpers.go @@ -356,9 +356,6 @@ func (r neo4jStatsService) Path() string { func (r neo4jStatsService) Scheme() string { scheme := "http" - if r.Spec.TLS != nil && r.Spec.TLS.HTTP.Mode != TLSModeDisabled { - scheme = "https" - } return scheme } diff --git a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/openapi_generated.go b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/openapi_generated.go index d7a2ef072..55869026b 100644 --- a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/openapi_generated.go +++ b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/openapi_generated.go @@ -45027,8 +45027,15 @@ func schema_apimachinery_apis_kubedb_v1alpha2_RabbitmqApp(ref common.ReferenceCa Ref: ref("kubedb.dev/apimachinery/apis/kubedb/v1alpha2.RabbitMQ"), }, }, + "name": { + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, }, - Required: []string{"RabbitMQ"}, + Required: []string{"RabbitMQ", "name"}, }, }, Dependencies: []string{ diff --git a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/rabbitmq_helpers.go b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/rabbitmq_helpers.go index 492731bf6..20a19df73 100644 --- a/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/rabbitmq_helpers.go +++ b/vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/rabbitmq_helpers.go @@ -26,6 +26,7 @@ import ( catalog "kubedb.dev/apimachinery/apis/catalog/v1alpha1" "kubedb.dev/apimachinery/apis/kubedb" "kubedb.dev/apimachinery/crds" + apiutils "kubedb.dev/apimachinery/pkg/utils" promapi "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1" "gomodules.xyz/pointer" @@ -52,9 +53,13 @@ func (r *RabbitMQ) CustomResourceDefinition() *apiextensions.CustomResourceDefin type RabbitmqApp struct { *RabbitMQ + name string } func (r RabbitmqApp) Name() string { + if r.name != "" { + return r.name + } return r.RabbitMQ.Name } @@ -63,7 +68,14 @@ func (r RabbitmqApp) Type() appcat.AppType { } func (r *RabbitMQ) AppBindingMeta() appcat.AppBindingMeta { - return &RabbitmqApp{r} + return &RabbitmqApp{RabbitMQ: r} +} + +func (r *RabbitMQ) ManagementAppBindingMeta() appcat.AppBindingMeta { + return &RabbitmqApp{ + RabbitMQ: r, + name: meta_util.NameWithSuffix(r.AppBindingMeta().Name(), "management"), + } } func (r *RabbitMQ) GetConnectionScheme() string { @@ -74,6 +86,30 @@ func (r *RabbitMQ) GetConnectionScheme() string { return scheme } +func (r *RabbitMQ) GetAMQPEndpoint() (string, int32) { + if r.Spec.EnableSSL && !r.Spec.DisableSecurity { + return "amqps", kubedb.RabbitMQAMQPSPort + } + return "amqp", kubedb.RabbitMQAMQPPort +} + +func (r *RabbitMQ) GetManagementEndpoint() (string, int32) { + if r.Spec.EnableSSL && !r.Spec.DisableSecurity { + return "https", kubedb.RabbitMQManagementUIPortWithSSL + } + return "http", kubedb.RabbitMQManagementUIPort +} + +func (r *RabbitMQ) GetAMQPConnectionURL(username, password string) string { + scheme, port := r.GetAMQPEndpoint() + return fmt.Sprintf("%s://%s:%s@%s.%s.svc.%s:%d/", scheme, username, password, r.ServiceName(), r.Namespace, apiutils.FindDomain(), port) +} + +func (r *RabbitMQ) GetManagementConnectionURL() string { + scheme, port := r.GetManagementEndpoint() + return fmt.Sprintf("%s://%s.%s.svc.%s:%d", scheme, r.DashboardServiceName(), r.Namespace, apiutils.FindDomain(), port) +} + func (r *RabbitMQ) GetAuthSecretName() string { if r.Spec.AuthSecret != nil && r.Spec.AuthSecret.Name != "" { return r.Spec.AuthSecret.Name diff --git a/vendor/modules.txt b/vendor/modules.txt index 84ff043e6..3d393a74c 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1941,7 +1941,7 @@ go.opentelemetry.io/otel/trace go.opentelemetry.io/otel/trace/embedded go.opentelemetry.io/otel/trace/internal/telemetry go.opentelemetry.io/otel/trace/noop -# go.virtual-secrets.dev/apimachinery v0.1.0 +# go.virtual-secrets.dev/apimachinery v0.2.0 ## explicit; go 1.25.0 go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1 go.virtual-secrets.dev/apimachinery/apis/virtual/v1alpha1 @@ -2698,7 +2698,7 @@ kmodules.xyz/resource-metrics/kubedb.com/v1 kmodules.xyz/resource-metrics/kubedb.com/v1alpha2 kmodules.xyz/resource-metrics/kubevault.com/v1alpha2 kmodules.xyz/resource-metrics/ops.kubedb.com/v1alpha1 -# kubedb.dev/apimachinery v0.66.0-rc.0 +# kubedb.dev/apimachinery v0.67.0-rc.0 ## explicit; go 1.25.0 kubedb.dev/apimachinery/apis kubedb.dev/apimachinery/apis/archiver/v1alpha1 @@ -2749,7 +2749,7 @@ kubedb.dev/apimachinery/pkg/factory kubedb.dev/apimachinery/pkg/secret kubedb.dev/apimachinery/pkg/utils kubedb.dev/apimachinery/pkg/utils/raft -# kubedb.dev/db-client-go v0.21.0-rc.0 +# kubedb.dev/db-client-go v0.22.0-rc.0 ## explicit; go 1.25.5 kubedb.dev/db-client-go/elasticsearch kubedb.dev/db-client-go/redis