PassSecret.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: passsecrets.secrets.premiscale.com
spec:
  group: secrets.premiscale.com
  scope: Namespaced
  names:
    kind: PassSecret
    listKind: PassSecretList
    plural: passsecrets
    singular: passsecret
  versions:
    {{- if has "v1alpha1" .Values.global.versions }}
    - name: v1alpha1
      deprecated: false
      served: true
      storage: true
      additionalPrinterColumns:
        - name: Secret Name
          type: string
          jsonPath: .spec.managedSecret.metadata.name
        - name: Secret Namespace
          type: string
          jsonPath: .spec.managedSecret.metadata.namespace
        - name: Secret Type
          type: string
          jsonPath: .spec.managedSecret.type
        - name: Age
          type: date
          jsonPath: .metadata.creationTimestamp
      schema:
        openAPIV3Schema:
          x-kubernetes-embedded-resource: true
          description: PassSecret is the schema for the PassOperator API.
          type: object
          properties:
            apiVersion:
              description: |+
                APIVersion defines the versioned schema of this representation of an object.
                Servers should convert recognized schemas to the latest internal value, and
                may reject unrecognized values. More info:

                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              type: string
            kind:
              description: |+
                Kind is a string value representing the REST resource this object represents.
                Servers may infer this from the endpoint the client submits requests to.
                Cannot be updated. In CamelCase. More info:

                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              type: string
            metadata:
              type: object
            spec:
              description: PassSecretSpec defines the desired state of a PassSecret.
              type: object
              properties:
                encryptedData:
                  description: |+
                    Data to be contained in the secret. Can be as few as zero key-value pairs, since the K8s API accepts Secrets with no data.
                  type: object
                  minProperties: 0
                  # I tried to get patternProperties to work (1/20/24), but my control plane insisted it was a forbidden field.
                  # https://github.com/kubernetes/kubernetes/issues/59485#issuecomment-366600460
                  # Using the work-around I've found in Bitnami's SealedSecrets CRD for now ~
                  # https://github.com/bitnami-labs/sealed-secrets/blob/2ea6649b1e1cb13af055392bbe9b7699e13681d3/helm/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml#L54
                  additionalProperties:
                    type: string
                managedSecret:
                  description: Configure the managed Kubernetes secret object's fields.
                  type: object
                  properties:
                    apiVersion:
                      description: |+
                        APIVersion defines the versioned schema of this representation of an object.
                        Servers should convert recognized schemas to the latest internal value, and
                        may reject unrecognized values. More info:

                        https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                      type: string
                    kind:
                      description: |+
                        Kind is a string value representing the REST resource this object represents.
                        Servers may infer this from the endpoint the client submits requests to.
                        Cannot be updated. In CamelCase. More info:

                        https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                      type: string
                    metadata:
                      type: object
                      properties:
                        name:
                          description: |+
                            Name of the managed v1/Secrets object.
                          type: string
                        namespace:
                          description: |+
                            Namespace of the managed v1/Secrets object.
                          type: string
                        labels:
                          description: |+
                            Labels to apply to the managed v1/Secrets object.
                          type: object
                          additionalProperties:
                            type: string
                        annotations:
                          description: |+
                            Annotations to apply to the managed v1/Secrets object.
                          type: object
                          additionalProperties:
                            type: string
                      required:
                        - name
                        - namespace
                    type:
                      description: Kubernetes Secret type to create.
                      type: string
                      default: Opaque
                      enum:
                        - Opaque
                        - kubernetes.io/service-account-token
                        - kubernetes.io/dockercfg
                        - kubernetes.io/dockerconfigjson
                        - kubernetes.io/basic-auth
                        - kubernetes.io/ssh-auth
                        - kubernetes.io/tls
                        - bootstrap.kubernetes.io/token
                    immutable:
                      description: |+
                        Optionally configure whether the destination secret should be immutable.
                        This will raise warnings in the operator's log output as the managed
                        secret will have to be deleted prior to the operator being able to
                        update it. This is also a bit of an anti-pattern.
                      type: boolean
                      default: false
                  required:
                    - metadata
                    - type
              required:
                - encryptedData
                - managedSecret
            status:
              description: Current state of the PassSecret on the Kubernetes cluster.
              type: object
              ## TODO: add custom status.
    {{- end }}