Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Retain the secret's key from KV backend When using transformation API to decode secret values. #676

Open
gauravkr19 opened this issue Apr 5, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@gauravkr19
Copy link

gauravkr19 commented Apr 5, 2024

Is your feature request related to a problem? Please describe.
When using transformation API with VSS or SecretTransformation, we are not able to retain the secret's key from KV backend of Vault.
Transformation API forces to use template name as the Secret's Key instead of using the key from Vault.

Describe the solution you'd like
I should be able to range though the KV pairs from Vault and perform any manipulations in the templates. In the example below, the template name can be made optional to retrieve KV pairs from Vault.

    transformation:
      excludeRaw: true
      templates:
          text: |-
            {{- range $key, $value := .Secrets }}
            {{- printf "%s=%s\n" $key ( $value | b64dec ) -}}
            {{- end }}

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
With the existing transformation API, I am forced to provide a templates.key in VSS yaml and it discards the Key from Vault KV backend. In the example below, I have to explicitly pass the Keys - constants.pwd & somexml.xml

transformation:
      excludes:
      - .*
      excludeRaw: true
      templates:
        constants.pwd:
          text: |-
            {{- $value := get .Secrets "constants.pwd" }}
            {{- printf "%s" ( $value | b64dec ) -}}
        somexml.xml:
          text: |-
            {{- $value := get .Secrets "somexml.xml" }}
            {{- printf "%s" ( $value | b64dec ) -}}

Current Experience
Our TIBCO application has 300+ microservices with 300+ Secrets. Providing and maintaining 300+ VSS with unique transformation template will be tedious.
With the proposed feature, we can use a standard transformation template across all the VSS yamls.

Expectations
With the proposed solution, we should be able to convert Vault KV secrets into K8s Secrets as indicated below:
Secrets in Vault KV-v2 backend (encoded values)

vault kv get -format=json ngil/tibcobwce/performance/test-uploaddocuments | jq -r '.data.data'
{
  "constants.pwd": "c29tZVBhc3N3b3JkCg==",
  "somexml.xml": "VGhlIHZhbHVlIGlzIGI2NCBlbmNvZGluZyBvZiBYTUwK"
}

to

oc get secrets test-uploaddocuments -o json | jq -r '.data'
{
  "constants.pwd": "c29tZVBhc3N3b3JkCg==",
  "somexml.xml": "VGhlIHZhbHVlIGlzIGI2NCBlbmNvZGluZyBvZiBYTUwK"  
}
@gauravkr19 gauravkr19 added the enhancement New feature or request label Apr 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant