Activate enableExternalSecretStores option

README.md

@@ -274,6 +274,85 @@ spec:
 ...
 ```
 
+## Enable External Secret Support
+
+If you need to store the sensitive output to an external secret store like Vault,
+you can specify the `--enable-external-secret-stores` flag to enable it:
+
+```yaml
+apiVersion: pkg.crossplane.io/v1alpha1
+kind: ControllerConfig
+metadata:
+  name: terraform-config
+  labels:
+    app: crossplane-provider-terraform
+spec:
+  image: crossplane/provider-terraform-controller:v0.3.0
+  args:
+    - -d
+    - --enable-external-secret-stores
+  metadata:
+    annotations:
+      vault.hashicorp.com/agent-inject: "true"
+      vault.hashicorp.com/agent-inject-token: "true"
+      vault.hashicorp.com/role: "crossplane"
+      vault.hashicorp.com/agent-run-as-user: "2000"
+```
+
+Prepare a `StoreConfig` for Vault:
+```yaml
+apiVersion: tf.crossplane.io/v1alpha1
+kind: StoreConfig
+metadata:
+  name: vault
+spec:
+  type: Vault
+  defaultScope: crossplane-system
+  vault:
+    server: http://vault.vault-system:8200
+    mountPath: secret/
+    version: v2
+    auth:
+      method: Token
+      token:
+        source: Filesystem
+        fs:
+          path: /vault/secrets/token
+```
+
+Specify it in `spec.publishConnectionDetailsTo`:
+```yaml
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: ...
+  labels:
+    feature: ess
+spec:
+  compositeTypeRef:
+    apiVersion: ...
+    kind: ...
+  resources:
+    - name: foo
+      base:
+        apiVersion: tf.crossplane.io/v1alpha1
+        kind: Workspace
+        metadata:
+          name: foo
+        spec:
+          forProvider:
+            ...
+          publishConnectionDetailsTo:
+            name: bar
+            configRef:
+              name: vault
+```
+
+At Vault side configuration is also needed to allow the write operation,
+see [example](https://crossplane.io/docs/v1.9/guides/vault-as-secret-store.html#prepare-vault) here for inspiration.
+
+A concrete provider terraform use case is also available [here](https://github.com/crossplane-contrib/provider-terraform/pull/101).
+
 ## Known limitations:
 
 * You must either use remote state or ensure the provider container's `/tf`

apis/v1alpha1/storeconfig_types.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+// A StoreConfigSpec defines the desired state of a ProviderConfig.
+type StoreConfigSpec struct {
+	xpv1.SecretStoreConfig `json:",inline"`
+}
+
+// A StoreConfigStatus represents the status of a StoreConfig.
+type StoreConfigStatus struct {
+	xpv1.ConditionedStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+
+// A StoreConfig configures how GCP controller should store connection details.
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="TYPE",type="string",JSONPath=".spec.type"
+// +kubebuilder:printcolumn:name="DEFAULT-SCOPE",type="string",JSONPath=".spec.defaultScope"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,store,gcp}
+// +kubebuilder:subresource:status
+type StoreConfig struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   StoreConfigSpec   `json:"spec"`
+	Status StoreConfigStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// StoreConfigList contains a list of StoreConfig
+type StoreConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []StoreConfig `json:"items"`
+}
+
+// Note(turkenh): To be generated with AngryJet
+
+// GetStoreConfig returns SecretStoreConfig
+func (in *StoreConfig) GetStoreConfig() xpv1.SecretStoreConfig {
+	return in.Spec.SecretStoreConfig
+}
+
+// GetCondition of this StoreConfig.
+func (in *StoreConfig) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return in.Status.GetCondition(ct)
+}
+
+// SetConditions of this StoreConfig.
+func (in *StoreConfig) SetConditions(c ...xpv1.Condition) {
+	in.Status.SetConditions(c...)
+}
+
+// StoreConfig type metadata.
+var (
+	StoreConfigKind             = reflect.TypeOf(StoreConfig{}).Name()
+	StoreConfigGroupKind        = schema.GroupKind{Group: Group, Kind: StoreConfigKind}.String()
+	StoreConfigKindAPIVersion   = StoreConfigKind + "." + SchemeGroupVersion.String()
+	StoreConfigGroupVersionKind = SchemeGroupVersion.WithKind(StoreConfigKind)
+)
+
+func init() {
+	SchemeBuilder.Register(&StoreConfig{}, &StoreConfigList{})
+}

cmd/provider/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"time"
@@ -28,25 +29,33 @@ import (
 	"k8s.io/client-go/tools/leaderelection/resourcelock"
 
 	"gopkg.in/alecthomas/kingpin.v2"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
+	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
 	"github.com/crossplane/crossplane-runtime/pkg/logging"
 	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/resource"
 
 	"github.com/crossplane-contrib/provider-terraform/apis"
+	"github.com/crossplane-contrib/provider-terraform/apis/v1alpha1"
 	workspace "github.com/crossplane-contrib/provider-terraform/internal/controller"
+	"github.com/crossplane-contrib/provider-terraform/internal/controller/features"
 )
 
 func main() {
 	var (
-		app              = kingpin.New(filepath.Base(os.Args[0]), "Terraform support for Crossplane.").DefaultEnvars()
-		debug            = app.Flag("debug", "Run with debug logging.").Short('d').Bool()
-		syncInterval     = app.Flag("sync", "Sync interval controls how often all resources will be double checked for drift.").Short('s').Default("1h").Duration()
-		pollInterval     = app.Flag("poll", "Poll interval controls how often an individual resource should be checked for drift.").Default("1m").Duration()
-		timeout          = app.Flag("timeout", "Controls how long Terraform processes may run before they are killed.").Default("20m").Duration()
-		leaderElection   = app.Flag("leader-election", "Use leader election for the controller manager.").Short('l').Default("false").Envar("LEADER_ELECTION").Bool()
-		maxReconcileRate = app.Flag("max-reconcile-rate", "The maximum number of concurrent reconciliation operations.").Default("1").Int()
+		app                        = kingpin.New(filepath.Base(os.Args[0]), "Terraform support for Crossplane.").DefaultEnvars()
+		debug                      = app.Flag("debug", "Run with debug logging.").Short('d').Bool()
+		syncInterval               = app.Flag("sync", "Sync interval controls how often all resources will be double checked for drift.").Short('s').Default("1h").Duration()
+		pollInterval               = app.Flag("poll", "Poll interval controls how often an individual resource should be checked for drift.").Default("1m").Duration()
+		timeout                    = app.Flag("timeout", "Controls how long Terraform processes may run before they are killed.").Default("20m").Duration()
+		leaderElection             = app.Flag("leader-election", "Use leader election for the controller manager.").Short('l').Default("false").Envar("LEADER_ELECTION").Bool()
+		maxReconcileRate           = app.Flag("max-reconcile-rate", "The maximum number of concurrent reconciliation operations.").Default("1").Int()
+		namespace                  = app.Flag("namespace", "Namespace used to set as default scope in default secret store config.").Default("crossplane-system").Envar("POD_NAMESPACE").String()
+		enableExternalSecretStores = app.Flag("enable-external-secret-stores", "Enable support for ExternalSecretStores.").Default("false").Envar("ENABLE_EXTERNAL_SECRET_STORES").Bool()
 	)
 	kingpin.MustParse(app.Parse(os.Args[1:]))
 
@@ -92,6 +101,25 @@ func main() {
 		Features:                &feature.Flags{},
 	}
 
+	if *enableExternalSecretStores {
+		o.Features.Enable(features.EnableAlphaExternalSecretStores)
+		log.Info("Alpha feature enabled", "flag", features.EnableAlphaExternalSecretStores)
+
+		// Ensure default store config exists.
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "default",
+			},
+			Spec: v1alpha1.StoreConfigSpec{
+				// NOTE(turkenh): We only set required spec and expect optional
+				// ones to properly be initialized with CRD level default values.
+				SecretStoreConfig: xpv1.SecretStoreConfig{
+					DefaultScope: *namespace,
+				},
+			},
+		})), "cannot create default store config")
+	}
+
 	kingpin.FatalIfError(workspace.Setup(mgr, o, *timeout), "Cannot setup Workspace controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }