crossplane-contrib / crossplane-contrib/function-environment-configs

Feature Request: Load keys from `Secret` or `ConfigMap` resources

Open
#78 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
28
Forks
25
Avg merge
5d 19h
Merged PRs (30d)
2

Description

### What problem are you facing?

We manage our `EnvironmentConfig` resources using FluxCD which means they are committed to a git repository. Our use case for Crossplane involves creating compositions managing resources which require sensitive inputs. An easy example is that our compositions use the [Kubernetes provider](https://github.com/crossplane-contrib/provider-kubernetes) to create `Secret` resources in other clusters.

### How could this Function help solve your problem?

There is not a general purpose way that I am aware of to provider secret values to Crossplane composition functions. The `credentials` field of the composition pipeline exists but the receiving function needs to be written to accept this. By allowing this function to read values from regular Kubernetes secrets it opens the door to use a different piece of k8s tooling to retrieve values for a Crossplane environment. The particular chain that I am interested in is:

Cloud secret store (AWS SM, GCP SM, Vault, etc.) -> External Secrets Operator -> K8s `Secret` -> function-environment-configs -> function-go-templating -> My composed resources

I have not fully thought through what the syntax might look like, but this pseudo-code represents the functionality I have in mind:

```yaml
apiVersion: apiextensions.crossplane.io/v1beta1
kind: EnvironmentConfig
metadata:
name: environment
data:
environment: dev
myPassword:
secretRef:
name: foo
namespace: bar
key: baz
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.