cyberark/secrets-provider-for-k8s

#!/bin/bash
set -euo pipefail

# Test cases can modify following variables from outside. Either by selecting
# default valid input, by leaving it unmodified. Or setting a single key which
# represent a key without a value. Or by setting it with invalid key or value.
# Another option is to set it to $KEY_VALUE_NOT_EXIST which means to omit
# related key-value from yaml file
SECRETS_DESTINATION_KEY_VALUE=${SECRETS_DESTINATION_KEY_VALUE:-"SECRETS_DESTINATION k8s_secrets"}
CONTAINER_MODE_KEY_VALUE=${CONTAINER_MODE_KEY_VALUE:-"CONTAINER_MODE init"}
K8S_SECRETS_KEY_VALUE=${K8S_SECRETS_KEY_VALUE:-"K8S_SECRETS test-k8s-secret,test-k8s-secret-fetch-all,test-k8s-secret-fetch-all-base64"}
CONJUR_AUTHN_LOGIN=${CONJUR_AUTHN_LOGIN:-"host/conjur/authn-k8s/${AUTHENTICATOR_ID}/apps/${APP_NAMESPACE_NAME}/*/*"}

cat << EOL
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test-env
  name: test-env
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-env
  template:
    metadata:
      labels:
        app: test-env
    spec:
      serviceAccountName: ${APP_NAMESPACE_NAME}-sa
      containers:
      - image: '${PULL_DOCKER_REGISTRY_PATH}/${APP_NAMESPACE_NAME}/debian:latest'
        name: test-app
        command: ["sleep"]
        args: ["infinity"]
        env:
          - name: TEST_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: secret
          - name: SSH_KEY
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: ssh_key
          - name: JSON_OBJECT_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: json_object_secret
          - name: VARIABLE_WITH_SPACES_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: var_with_spaces
          - name: VARIABLE_WITH_PLUSES_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: var_with_pluses
          - name: VARIABLE_WITH_UMLAUT_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: var_with_umlaut
          - name: VARIABLE_WITH_BASE64_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: var_with_base64
          - name: NON_CONJUR_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret
                key: non-conjur-key
          - name: FETCH_ALL_TEST_SECRET
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret-fetch-all
                key: secrets.test_secret
          - name: FETCH_ALL_BASE64
            valueFrom:
              secretKeyRef:
                name: test-k8s-secret-fetch-all-base64
                key: secrets.encoded
      initContainers:
      - image: '${PULL_DOCKER_REGISTRY_PATH}/${APP_NAMESPACE_NAME}/secrets-provider:latest'
        imagePullPolicy: Always
        name: cyberark-secrets-provider-for-k8s
        env:
          - name: MY_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name

          - name: MY_POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace

          - name: CONJUR_APPLIANCE_URL
            value: ${CONJUR_APPLIANCE_URL}

          - name: CONJUR_AUTHN_URL
            value: ${CONJUR_AUTHN_URL}

          - name: CONJUR_ACCOUNT
            value: ${CONJUR_ACCOUNT}

          - name: CONJUR_SSL_CERTIFICATE
            valueFrom:
              configMapKeyRef:
                name: conjur-master-ca-env
                key: ssl-certificate

          - name: LOG_LEVEL
            value: "debug"

          - name: CONJUR_AUTHN_LOGIN
            value: ${CONJUR_AUTHN_LOGIN}

`yaml_print_key_name_value "          " ${K8S_SECRETS_KEY_VALUE}`
`yaml_print_key_name_value "          " ${CONTAINER_MODE_KEY_VALUE}`
`yaml_print_key_name_value "          " ${SECRETS_DESTINATION_KEY_VALUE}`

      imagePullSecrets:
        - name: dockerpullsecret
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: conjur-master-ca-env
  label:
    app: test-env
data:
  ssl-certificate: |
$(echo "${CONJUR_SSL_CERTIFICATE}" | while read line; do printf "%20s%s\n" "" "$line"; done)
EOL