secrets

Documentation

Overview

pkg/resources/secrets/secret.go

Index

• func CopyToNamespaces(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, ...) error
• func Create(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, ...) error
• func Delete(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, ...) error
• func DeleteIfOwned(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, ...) error
• func Update(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, ...) error
• type ResolvedSecretSpec
  • func Resolve(src orktypes.SecretTemplateSource, ownerName string) ResolvedSecretSpec
• type SecretTemplateSource

Functions

func CopyToNamespaces

func CopyToNamespaces(
	ctx context.Context,
	kube kubeclient.KubeClient,
	owner domain.Object,
	spec ResolvedSecretSpec,
	toNamespaces []string,
) error

CopyToNamespaces copies a Secret to multiple target namespaces. Each copy is owned by the CR — garbage collected when the CR is deleted. Idempotent — skips namespaces where the Secret already exists. This is the power pattern: one declaration copies to N namespaces automatically.

Example Katalog declaration:

onCreate:
  secrets:
    - name: db-credentials
      fromSecret: master-db-creds
      fromNamespace: platform
      toNamespaces:
        - "{{ .metadata.namespace }}"
        - monitoring
        - staging

func Create

func Create(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, spec ResolvedSecretSpec) error

Create creates a Secret in the target namespace if it does not already exist. When FromSecret is set, copies data from the source Secret automatically. Idempotent — skips creation if the Secret already exists. Owner reference is set so the Secret is garbage collected when the CR is deleted.

func Delete

func Delete(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, spec ResolvedSecretSpec) error

Delete deletes the Secret if it exists.

func DeleteIfOwned

func DeleteIfOwned(ctx context.Context, kube kubeclient.KubeClient,
	owner domain.Object, name, namespace string) error

DeleteIfOwned deletes the Secret if it exists and is owned by the CR.

func Update

func Update(ctx context.Context, kube kubeclient.KubeClient, owner domain.Object, spec ResolvedSecretSpec) error

Update reconciles an existing Secret to match the resolved spec. When FromSecret is set, re-syncs data from the source Secret on every reconcile. If the Secret does not exist, creates it.

Types

type ResolvedSecretSpec

type ResolvedSecretSpec struct {
	// Name — Secret name. Required.
	Name string

	// Namespace — target namespace. Required.
	Namespace string

	// StringData — static key-value entries.
	// Values are plain strings — template expressions are not supported here.
	StringData map[string]string

	// Data
	Data map[string][]byte

	// Type — Kubernetes Secret type.
	// Default: "Opaque"
	Type string

	// FromSecret — name of a source Secret to copy from.
	// When set, copies all keys from the source into the target.
	// Individual Data entries merge on top — override specific keys if needed.
	FromSecret string

	// FromNamespace — namespace where FromSecret lives.
	// Default: same namespace as the CR.
	FromNamespace string

	// Labels — applied to Secret metadata.
	Labels map[string]string

	// Annotations — applied to Secret metadata.
	Annotations map[string]string

	// Sleep injects an artificial delay into the reconcile of this resource.
	// Useful for autoscale testing, latency simulation, and chaos engineering.
	// Accepts extended duration units (s, m, h, d, w, mo, y).
	Sleep string
}

ResolvedSecretSpec is the fully resolved Secret specification.

func Resolve

func Resolve(src orktypes.SecretTemplateSource, ownerName string) ResolvedSecretSpec

Resolve builds a ResolvedSecretSpec from a SecretTemplateSource. Template expressions must already be evaluated by template.Resolver before calling.

type SecretTemplateSource

type SecretTemplateSource struct {
	// Version — OrkestraRegistry implementation version. Omit for latest.
	Version string

	// Name — Secret name in the target namespace.
	// Default: "{{ .metadata.name }}-secret"
	Name string

	// Namespace — primary target namespace.
	// Default: "{{ .metadata.namespace }}"
	// When ToNamespaces is set, this field is ignored.
	Namespace string

	// ToNamespaces — create one copy of this Secret in each listed namespace.
	// Each element supports template expressions.
	// e.g. ["{{ .metadata.namespace }}", "monitoring", "staging"]
	// When set, Namespace is ignored — ToNamespaces controls all target namespaces.
	ToNamespaces []string

	// FromSecret — name of an existing Secret to copy data from.
	// When set, Orkestra reads this Secret at reconcile time and copies its data.
	// This means the copy stays in sync — if the source changes, the copy updates.
	// Omit to use static Data entries instead.
	FromSecret string

	// FromNamespace — namespace where FromSecret lives.
	// Default: same namespace as the CR.
	FromNamespace string

	// Data — static key-value Secret entries (string values).
	// Kubernetes encodes them to base64 automatically.
	// When FromSecret is also set, these entries override matching keys from the source.
	Data map[string]string

	// Type — Kubernetes Secret type.
	// Default: Opaque.
	// e.g. "kubernetes.io/tls", "kubernetes.io/dockerconfigjson"
	Type string

	// Labels — applied to all created Secret copies.
	Labels []orktypes.ResourceLabel

	// Reconcile: true — also sync on every reconcile (drift correction).
	// When true, if the source Secret changes, all copies are updated automatically.
	Reconcile bool

	// Sleep injects an artificial delay into the reconcile of this resource.
	// Useful for autoscale testing, latency simulation, and chaos engineering.
	// Accepts extended duration units (s, m, h, d, w, mo, y).
	Sleep string
}

SecretTemplateSource declares one Secret to be managed by Orkestra.

Three usage patterns:

1. Static data — declare values directly in the Katalog:

onCreate:
  secrets:
    - name: "{{ .metadata.name }}-config"
      data:
        API_KEY: my-api-key
        DB_URL: postgres://...

2. Copy from existing Secret — Orkestra reads the source and copies it:

onCreate:
  secrets:
    - name: db-credentials
      fromSecret: master-db-creds
      fromNamespace: platform

3. Copy to multiple namespaces — Orkestra creates one copy per namespace:

onCreate:
  secrets:
    - name: db-credentials
      fromSecret: master-db-creds
      fromNamespace: platform
      toNamespaces:
        - "{{ .metadata.namespace }}"
        - monitoring
        - staging

All copies are owned by the CR — deleted automatically when the CR is deleted.