diff --git a/charts/gcp-iam-externalsecrets/Chart.yaml b/charts/gcp-iam-externalsecrets/Chart.yaml index 5b4fcaf..226126d 100644 --- a/charts/gcp-iam-externalsecrets/Chart.yaml +++ b/charts/gcp-iam-externalsecrets/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: gcp-iam-externalsecrets -version: 0.2.21 +version: 0.3.0 description: A Helm chart to create a service account in your desired project, and grant it a specific role. maintainers: - name: Grove Infra team \ No newline at end of file diff --git a/charts/gcp-iam-externalsecrets/example-values2.yaml b/charts/gcp-iam-externalsecrets/example-values2.yaml new file mode 100644 index 0000000..4224461 --- /dev/null +++ b/charts/gcp-iam-externalsecrets/example-values2.yaml @@ -0,0 +1,48 @@ +## WARNING: This example is using gcp-iam-externalsecrets-0.3.0 version +## which uses a different way to fetch secrets. User should use version 0.2.X +## if it's still using JSON-based secrets from Secret Manager. +iamPolicy: + # -- Name of the GCP Service Account to create. + # The service account will be created under the same project as the cluster in order to allow Workload Identity to work + gke: + # -- GCP Project of the cluster in which to create the External Secrets K8s resources + clusterProjectID: project0 + + # -- Location of the cluster in which to create the External Secrets K8s resources + clusterLocation: europe-west3 + + # -- Name of the cluster in which to create the External Secrets K8s resources + clusterName: cluster-name + + # -- K8s SA which will be used to get the secrets + serviceAccount: service-account-name + + secretRoles: + - secret: secret1 + project: project1 + secretKey: my-key1 + role: roles/secretmanager.secretAccessor + - secret: secret2 + project: project2 + secretKey: my-key2 + role: roles/secretmanager.secretAccessor + - secret: secret3 + project: project2 + secretKey: my-key3 + role: roles/secretmanager.secretAccessor + + projectRoles: + - project: project2 + role: roles/secretmanager.admin + - project: project3 + role: roles/secretmanager.viwer + +externalSecretStore: + # -- Wether to create both SecretStore + create: true + +externalSecrets: + # -- Wether to create ExternalSecret s K8s Resources foreach secretIDs + create: true + +# disableConfigConnectorCRDs: true diff --git a/charts/gcp-iam-externalsecrets/templates/external-secrets.yaml b/charts/gcp-iam-externalsecrets/templates/external-secrets.yaml index 0bd10a1..aadd8b3 100644 --- a/charts/gcp-iam-externalsecrets/templates/external-secrets.yaml +++ b/charts/gcp-iam-externalsecrets/templates/external-secrets.yaml @@ -12,11 +12,10 @@ spec: target: name: {{ $v.secret }} creationPolicy: Owner - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: {{ $v.secret }} + data: + - secretKey: {{ $v.secretKey }} + remoteRef: + key: {{ $v.secret }} --- {{- end }} {{- end }}