使用 External Secrets Operator 管理 Kubernetes 的 Secret

type Provider interface{  //通过NewClient构造一个SecretsManagerProvider  NewClient(ctx context.Context, store GenericStore, kube client.Client, namespace string) (SecretsClient, error)
  //ValidateStore方法检查提供的Secret存储是否有效  ValidateStore(store GenericStore) error}

type SecretsClient interface{  GetSecret(ctx context.Context, ref ExternalSecretDataRemoteRef) ([]byte, error)
  Validate() (ValidationResult, error)
  GetSecretMap(ctx context.Context, ref ExternalSecretDataRemoteRef) (map[string][]byte, error)
  GetAllSecrets(ctx context.Context, ref ExternalSecretFind) (map[string][]byte, error)
   Close(ctx context.Context) error}

apiVersion: external-secrets.io/v1beta1kind: SecretStoremetadata:  name: secretstore-samplespec:  provider:    aws:    service: SecretsManager    region: us-east-1    auth:      secretRef:        accessKeyIDSecretRef:          name: awssm-secret          key: access-key        secretAccessKeySecretRef:          name: awssm-secret          key: secret-access-key

apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:  name: examplespec:  refreshInterval: 1h  secretStoreRef:    name: secretstore-sample    kind: SecretStore  target:    name: secret-to-be-created    creationPolicy: Owner  data:  - secretKey: secret-key-to-be-managed    remoteRef:      key: provider-key      version: provider-key-version      property: provider-key-property  dataFrom:  - extract:      key: remote-key-in-the-provider

const express = require('express');const router = express.Router(); const keys = []; /* GET keys listing as a JSON array */router.get('/', (req, res, next) => {   res.send(keys);}); /* GET a single key as a JSON object. */router.get('/:key', (req, res) => {   const key = keys.find(k => k.key === req.params.key);   res.send(key);}) module.exports = router;

express:  description: Configuration to sync secrets using Express provider  properties:    host:      type: string  required:    - host  type: object

package v1beta1 type ExpressProvider struct {   Host string `json:"host"`}

package express import (   "context"   "encoding/json"   "fmt"   esv1beta1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1beta1"   "io/ioutil"   "log"   "net/http"   "net/url"   "sigs.k8s.io/controller-runtime/pkg/client"   "time") const (   errNilStore              = "nil store found"   errMissingStoreSpec      = "store is missing spec"   errMissingProvider       = "storeSpec is missing provider"   errInvalidProvider       = "invalid provider spec. Missing express field in store %s"   errInvalidExpressHostURL = "invalid express host URL") // this struct will hold the keys that the service returnstype keyValue struct {   Key   string `json:"key"`   Value string `json:"value"`} type Provider struct {   config  *esv1beta1.ExpressProvider   hostUrl string}
// NewClient this is where we initialize the SecretClient and return it for the controller to usefunc (p *Provider) NewClient(ctx context.Context, store esv1beta1.GenericStore, kube client.Client, namespace string) (esv1beta1.SecretsClient, error) {   config := store.GetSpec().Provider.Express    return &Provider{       config:  config,       hostUrl: config.Host,   }, nil} func (p *Provider) GetAllSecrets(ctx context.Context, ref esv1beta1.ExternalSecretFind) (map[string][]byte, error) {   return nil, fmt.Errorf("GetAllSecrets not implemented")} // GetSecret reads the secret from the Express server and returns it. The controller uses the value here to// create the Kubernetes secretfunc (p *Provider) GetSecret(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) ([]byte, error) {   expressClient := http.Client{       Timeout: time.Second * 5,   }    req, err := http.NewRequest(http.MethodGet, p.hostUrl+"/keys/"+ref.Key, nil)   if err != nil {       log.Fatal(err)   }      fmt.Printf("Sending request to: %s\n", p.hostUrl+"/keys/"+ref.Key)    res, getErr := expressClient.Do(req)   if getErr != nil {       return nil, fmt.Errorf("error getting the secret %s", ref.Key)   }    if res.Body != nil {       defer res.Body.Close()   }    body, readErr := ioutil.ReadAll(res.Body)   if readErr != nil {       return nil, fmt.Errorf("error reading secret %s", ref.Key)   }   fmt.Printf("body: %s\n", body)    secret := keyValue{}   jsonErr := json.Unmarshal(body, &secret)   if jsonErr != nil {       return nil, fmt.Errorf("bad key format: %s", ref.Key)   }   return []byte(secret.Value), nil} // ValidateStore validates the store configuration to prevent unexpected errorsfunc (p *Provider) ValidateStore(store esv1beta1.GenericStore) error {   if store == nil {       return fmt.Errorf(errNilStore)   }
    spec := store.GetSpec()   if spec == nil {       return fmt.Errorf(errMissingStoreSpec)   }    if spec.Provider == nil {       return fmt.Errorf(errMissingProvider)   }    provider := spec.Provider.Express   if provider == nil {       return fmt.Errorf(errInvalidProvider, store.GetObjectMeta().String())   }    hostUrl, err := url.Parse(provider.Host)   if err != nil {       return fmt.Errorf(errInvalidExpressHostURL)   }    if hostUrl.Host == "" {       return fmt.Errorf(errInvalidExpressHostURL)   }    return nil}
// registers the provider object to process on each reconciliation loopfunc init() {   esv1beta1.Register(&Provider{}, &esv1beta1.SecretStoreProvider{       Express: &esv1beta1.ExpressProvider{},   })}

package register import (   …   _ "github.com/external-secrets/external-secrets/pkg/provider/express"   …)

make crds.install

make run

apiVersion: external-secrets.io/v1beta1kind: SecretStoremetadata: name: secretstore-expressspec: provider:   express:     host: http://express-secrets-service---apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata: name: express-external-secretspec: refreshInterval: 1h  secretStoreRef:   kind: SecretStore   name: secretstore-express  target:   name: my-express-secret   creationPolicy: Owner  data:   - secretKey: secretKey # Key given to the secret to be created on the cluster     remoteRef:       key: my-secret-key

kubectl apply -f secret.yaml 

kubectl get secret my-express-secret -o yam

apiVersion: v1data:  secretKey: dGhpcy1pcy1hLXNlY3JldA==immutable: falsekind: Secret