diff --git a/Makefile b/Makefile index 62426199f..7bc0cf594 100644 --- a/Makefile +++ b/Makefile @@ -25,8 +25,8 @@ ifneq ($(shell echo '$(IMG_VERSION)' | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' && e $(error IMG_VERSION '$(IMG_VERSION)' is not valid semver (expected: Major.Minor.Patch)) endif -# EXTERNAL_SECRETS_VERSION defines the external-secrets release version to fetch helm charts. -EXTERNAL_SECRETS_VERSION ?= v2.5.0 +# EXTERNAL_SECRETS_VERSION defines the upstream Helm chart version (SemVer, no "v" prefix). +EXTERNAL_SECRETS_VERSION ?= 2.5.0 # CHANNELS define the bundle channels used in the bundle. # Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable") diff --git a/bindata/external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml b/bindata/external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml rename to bindata/external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml diff --git a/bindata/external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml b/bindata/external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml rename to bindata/external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml diff --git a/bindata/external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml b/bindata/external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml rename to bindata/external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml diff --git a/bindata/external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml b/bindata/external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml rename to bindata/external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml diff --git a/bindata/external-secrets/networkpolicy_allow-dns.yaml b/bindata/external-secrets/networkpolicies/allow-dns.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_allow-dns.yaml rename to bindata/external-secrets/networkpolicies/allow-dns.yml diff --git a/bindata/external-secrets/networkpolicy_deny-all.yaml b/bindata/external-secrets/networkpolicies/deny-all.yml similarity index 100% rename from bindata/external-secrets/networkpolicy_deny-all.yaml rename to bindata/external-secrets/networkpolicies/deny-all.yml diff --git a/bindata/external-secrets/certificate_bitwarden-tls-certs.yml b/bindata/external-secrets/operand/certificate_bitwarden-tls-certs.yml similarity index 100% rename from bindata/external-secrets/certificate_bitwarden-tls-certs.yml rename to bindata/external-secrets/operand/certificate_bitwarden-tls-certs.yml diff --git a/bindata/external-secrets/resources/certificate_external-secrets-webhook.yml b/bindata/external-secrets/operand/certificate_external-secrets-webhook.yml similarity index 100% rename from bindata/external-secrets/resources/certificate_external-secrets-webhook.yml rename to bindata/external-secrets/operand/certificate_external-secrets-webhook.yml diff --git a/bindata/external-secrets/resources/clusterrole_external-secrets-cert-controller.yml b/bindata/external-secrets/operand/clusterrole_external-secrets-cert-controller.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrole_external-secrets-cert-controller.yml rename to bindata/external-secrets/operand/clusterrole_external-secrets-cert-controller.yml diff --git a/bindata/external-secrets/resources/clusterrole_external-secrets-controller.yml b/bindata/external-secrets/operand/clusterrole_external-secrets-controller.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrole_external-secrets-controller.yml rename to bindata/external-secrets/operand/clusterrole_external-secrets-controller.yml diff --git a/bindata/external-secrets/resources/clusterrole_external-secrets-edit.yml b/bindata/external-secrets/operand/clusterrole_external-secrets-edit.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrole_external-secrets-edit.yml rename to bindata/external-secrets/operand/clusterrole_external-secrets-edit.yml diff --git a/bindata/external-secrets/resources/clusterrole_external-secrets-servicebindings.yml b/bindata/external-secrets/operand/clusterrole_external-secrets-servicebindings.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrole_external-secrets-servicebindings.yml rename to bindata/external-secrets/operand/clusterrole_external-secrets-servicebindings.yml diff --git a/bindata/external-secrets/resources/clusterrole_external-secrets-view.yml b/bindata/external-secrets/operand/clusterrole_external-secrets-view.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrole_external-secrets-view.yml rename to bindata/external-secrets/operand/clusterrole_external-secrets-view.yml diff --git a/bindata/external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml b/bindata/external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml rename to bindata/external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml diff --git a/bindata/external-secrets/resources/clusterrolebinding_external-secrets-controller.yml b/bindata/external-secrets/operand/clusterrolebinding_external-secrets-controller.yml similarity index 100% rename from bindata/external-secrets/resources/clusterrolebinding_external-secrets-controller.yml rename to bindata/external-secrets/operand/clusterrolebinding_external-secrets-controller.yml diff --git a/bindata/external-secrets/resources/deployment_bitwarden-sdk-server.yml b/bindata/external-secrets/operand/deployment_bitwarden-sdk-server.yml similarity index 100% rename from bindata/external-secrets/resources/deployment_bitwarden-sdk-server.yml rename to bindata/external-secrets/operand/deployment_bitwarden-sdk-server.yml diff --git a/bindata/external-secrets/resources/deployment_external-secrets-cert-controller.yml b/bindata/external-secrets/operand/deployment_external-secrets-cert-controller.yml similarity index 100% rename from bindata/external-secrets/resources/deployment_external-secrets-cert-controller.yml rename to bindata/external-secrets/operand/deployment_external-secrets-cert-controller.yml diff --git a/bindata/external-secrets/resources/deployment_external-secrets-webhook.yml b/bindata/external-secrets/operand/deployment_external-secrets-webhook.yml similarity index 100% rename from bindata/external-secrets/resources/deployment_external-secrets-webhook.yml rename to bindata/external-secrets/operand/deployment_external-secrets-webhook.yml diff --git a/bindata/external-secrets/resources/deployment_external-secrets.yml b/bindata/external-secrets/operand/deployment_external-secrets.yml similarity index 100% rename from bindata/external-secrets/resources/deployment_external-secrets.yml rename to bindata/external-secrets/operand/deployment_external-secrets.yml diff --git a/bindata/external-secrets/external-secrets-namespace.yaml b/bindata/external-secrets/operand/namespace_external-secrets.yml similarity index 100% rename from bindata/external-secrets/external-secrets-namespace.yaml rename to bindata/external-secrets/operand/namespace_external-secrets.yml diff --git a/bindata/external-secrets/resources/role_external-secrets-leaderelection.yml b/bindata/external-secrets/operand/role_external-secrets-leaderelection.yml similarity index 100% rename from bindata/external-secrets/resources/role_external-secrets-leaderelection.yml rename to bindata/external-secrets/operand/role_external-secrets-leaderelection.yml diff --git a/bindata/external-secrets/resources/rolebinding_external-secrets-leaderelection.yml b/bindata/external-secrets/operand/rolebinding_external-secrets-leaderelection.yml similarity index 100% rename from bindata/external-secrets/resources/rolebinding_external-secrets-leaderelection.yml rename to bindata/external-secrets/operand/rolebinding_external-secrets-leaderelection.yml diff --git a/bindata/external-secrets/resources/secret_external-secrets-webhook.yml b/bindata/external-secrets/operand/secret_external-secrets-webhook.yml similarity index 100% rename from bindata/external-secrets/resources/secret_external-secrets-webhook.yml rename to bindata/external-secrets/operand/secret_external-secrets-webhook.yml diff --git a/bindata/external-secrets/resources/service_bitwarden-sdk-server.yml b/bindata/external-secrets/operand/service_bitwarden-sdk-server.yml similarity index 100% rename from bindata/external-secrets/resources/service_bitwarden-sdk-server.yml rename to bindata/external-secrets/operand/service_bitwarden-sdk-server.yml diff --git a/bindata/external-secrets/resources/service_external-secrets-cert-controller-metrics.yml b/bindata/external-secrets/operand/service_external-secrets-cert-controller-metrics.yml similarity index 100% rename from bindata/external-secrets/resources/service_external-secrets-cert-controller-metrics.yml rename to bindata/external-secrets/operand/service_external-secrets-cert-controller-metrics.yml diff --git a/bindata/external-secrets/resources/service_external-secrets-metrics.yml b/bindata/external-secrets/operand/service_external-secrets-metrics.yml similarity index 100% rename from bindata/external-secrets/resources/service_external-secrets-metrics.yml rename to bindata/external-secrets/operand/service_external-secrets-metrics.yml diff --git a/bindata/external-secrets/resources/service_external-secrets-webhook.yml b/bindata/external-secrets/operand/service_external-secrets-webhook.yml similarity index 100% rename from bindata/external-secrets/resources/service_external-secrets-webhook.yml rename to bindata/external-secrets/operand/service_external-secrets-webhook.yml diff --git a/bindata/external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml b/bindata/external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml similarity index 100% rename from bindata/external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml rename to bindata/external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml diff --git a/bindata/external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml b/bindata/external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml similarity index 100% rename from bindata/external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml rename to bindata/external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml diff --git a/bindata/external-secrets/resources/serviceaccount_external-secrets-webhook.yml b/bindata/external-secrets/operand/serviceaccount_external-secrets-webhook.yml similarity index 100% rename from bindata/external-secrets/resources/serviceaccount_external-secrets-webhook.yml rename to bindata/external-secrets/operand/serviceaccount_external-secrets-webhook.yml diff --git a/bindata/external-secrets/resources/serviceaccount_external-secrets.yml b/bindata/external-secrets/operand/serviceaccount_external-secrets.yml similarity index 100% rename from bindata/external-secrets/resources/serviceaccount_external-secrets.yml rename to bindata/external-secrets/operand/serviceaccount_external-secrets.yml diff --git a/bindata/external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml b/bindata/external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml similarity index 100% rename from bindata/external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml rename to bindata/external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml diff --git a/bindata/external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml b/bindata/external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml similarity index 100% rename from bindata/external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml rename to bindata/external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml diff --git a/hack/govulncheck.sh b/hack/govulncheck.sh index 926933f8d..84c64131a 100755 --- a/hack/govulncheck.sh +++ b/hack/govulncheck.sh @@ -20,20 +20,18 @@ set -o errexit # KNOWN_VULNS_UNTIL (UTC, YYYY-MM-DD): ignores are valid through this date inclusive. # After it expires, re-run the scan, drop fixed IDs, re-justify remaining ones, and # advance this date (typically ~2 weeks). -KNOWN_VULNS_UNTIL="2026-08-28" +KNOWN_VULNS_UNTIL="2026-09-21" # ## Below vulnerabilities are in the kubernetes package, which impacts the server and not the operator, which is the client. -# - https://pkg.go.dev/vuln/GO-2025-3521 - Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes -- -# - https://pkg.go.dev/vuln/GO-2025-3547 - Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes -- +# - https://pkg.go.dev/vuln/GO-2025-3521 - Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes +# - https://pkg.go.dev/vuln/GO-2025-3547 - Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes # ## Below vulnerabilities are in the go packages, which doesn't impact the operator code and requires the fix to be available downstream. -# - https://pkg.go.dev/vuln/GO-2026-4918 - HTTP/2 infinite loop via SETTINGS_MAX_FRAME_SIZE of 0 in net/http, golang.org/x/net -- -# - https://pkg.go.dev/vuln/GO-2026-5026 - x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels -- -# - https://pkg.go.dev/vuln/GO-2026-5970 - x/text/unicode/norm: infinite loop on invalid UTF-8 input. -- +# - https://pkg.go.dev/vuln/GO-2026-5026 - x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels # - https://pkg.go.dev/vuln/GO-2026-5972 - Enforce maximum recursion depth in encoding/asn1 # - https://pkg.go.dev/vuln/GO-2026-6090 - Limit handshake messages we are willing to accept post-handshake in crypto/tls # - https://pkg.go.dev/vuln/GO-2026-6218 - Avoid quadratic complexity in resolvePath in net/url -KNOWN_VULNS_PATTERN="GO-2025-3521|GO-2025-3547|GO-2026-4918|GO-2026-5026|GO-2026-5970|GO-2026-5972|GO-2026-6090|GO-2026-6218" +KNOWN_VULNS_PATTERN="GO-2025-3521|GO-2025-3547|GO-2026-5026|GO-2026-5972|GO-2026-6090|GO-2026-6218" GOVULNCHECK_BIN="${1:-}" OUTPUT_DIR="${2:-}" diff --git a/hack/update-external-secrets-manifests.sh b/hack/update-external-secrets-manifests.sh index 0f09f96ea..954633337 100755 --- a/hack/update-external-secrets-manifests.sh +++ b/hack/update-external-secrets-manifests.sh @@ -4,8 +4,9 @@ set -o nounset set -o pipefail set -o errexit -EXTERNAL_SECRETS_VERSION=${1:?"missing external-secrets version. Please specify a version from https://github.com/external-secrets/external-secrets/releases"} +EXTERNAL_SECRETS_VERSION=${1:?"missing external-secrets helm chart version. See https://charts.external-secrets.io or https://github.com/external-secrets/external-secrets/releases"} MANIFESTS_PATH=./_output/manifests +OPERAND_BINDATA=bindata/external-secrets/operand mkdir -p ${MANIFESTS_PATH} @@ -45,8 +46,16 @@ echo "---- Patching external-secrets manifests ----" # add custom label to all CRDs ./bin/yq e 'select(.kind == "CustomResourceDefinition").metadata.labels."app" = "external-secrets"' -i ${MANIFESTS_PATH}/manifests.yaml -# regenerate all bindata -rm -rf bindata/external-secrets/resources +# refresh helm-rendered operand bindata; preserve operator-owned manifests. +mkdir -p "${OPERAND_BINDATA}" +shopt -s extglob nullglob +( + cd "${OPERAND_BINDATA}" + for manifest in !(namespace_external-secrets.yml|certificate_bitwarden-tls-certs.yml); do + rm -- "${manifest}" + done +) +shopt -u extglob nullglob rm -f config/crd/bases/customresourcedefinition_* # split into individual manifest files @@ -59,11 +68,8 @@ rm -f config/crd/bases/customresourcedefinition_* rm ${MANIFESTS_PATH}/customresourcedefinition_fakes.generators.external-secrets.io.yml # Move resource manifests to appropriate location -mkdir -p bindata/external-secrets/resources - mv ${MANIFESTS_PATH}/customresourcedefinition_* config/crd/bases/ -mv ${MANIFESTS_PATH}/*.yml bindata/external-secrets/resources +mv ${MANIFESTS_PATH}/*.yml "${OPERAND_BINDATA}" # Clean up rm -r ${MANIFESTS_PATH} - diff --git a/harness-evals/constitution.md b/harness-evals/constitution.md index 6800ae637..82e6869ea 100644 --- a/harness-evals/constitution.md +++ b/harness-evals/constitution.md @@ -12,7 +12,7 @@ The operator deploys and manages upstream **external-secrets** and the optional **bitwarden-sdk-server** plugin via **embedded manifests in `bindata/external-secrets/`**. The operator **never** reimplements upstream secret-sync logic (provider authentication, ExternalSecret reconciliation, generator behavior, Bitwarden SDK protocol). Operator packages reconcile operator CRs and deploy/configure operand workloads only. -**Evidence:** `bindata/external-secrets/resources/` — operand YAML from upstream helm; `pkg/controller/external_secrets/` installs deployments/RBAC/webhooks but contains zero provider-specific secret-fetch logic. `README.md` states the operator uses upstream helm charts. +**Evidence:** `bindata/external-secrets/operand/` — operand YAML from upstream helm; `pkg/controller/external_secrets/` installs deployments/RBAC/webhooks but contains zero provider-specific secret-fetch logic. `README.md` states the operator uses upstream helm charts. ### II. Operand Workloads — Core, Conditional TLS Helper, Plugin @@ -56,7 +56,7 @@ Runtime feature toggles are defined on `ExternalSecretsManager.Spec.Features[]` Webhook TLS uses either cert-manager `Certificate` CRs (`certProvider.certManager.mode == Enabled`) **or** the in-tree `external-secrets-cert-controller` deployment — never both. cert-controller deployment is skipped when cert-manager path is active. -**Evidence:** `pkg/controller/external_secrets/deployments.go` — `certControllerDeploymentAssetName` condition `!isCertManagerConfigEnabled(esc)`; `pkg/controller/external_secrets/certificate.go`; `bindata/external-secrets/resources/certificate_external-secrets-webhook.yml` vs `bindata/external-secrets/resources/secret_external-secrets-webhook.yml`. +**Evidence:** `pkg/controller/external_secrets/deployments.go` — `certControllerDeploymentAssetName` condition `!isCertManagerConfigEnabled(esc)`; `pkg/controller/external_secrets/certificate.go`; `bindata/external-secrets/operand/certificate_external-secrets-webhook.yml` vs `bindata/external-secrets/operand/secret_external-secrets-webhook.yml`. ### VIII. Bindata / Manifest Regeneration — Never Hand-Edit, Always `make update` @@ -78,9 +78,9 @@ E2E (`make test-e2e`, build tag `e2e`) requires a live cluster. ### X. RBAC Least Privilege — Explicit Operator and Operand Manifests -Operator RBAC is in `config/rbac/`. Operand RBAC is embedded in `bindata/external-secrets/resources/` and applied by `pkg/controller/external_secrets/rbacs.go`. New permissions MUST be explicit ClusterRole rules in bindata or operator RBAC — not broad cluster-admin grants. +Operator RBAC is in `config/rbac/`. Operand RBAC is embedded in `bindata/external-secrets/operand/` and applied by `pkg/controller/external_secrets/rbacs.go`. New permissions MUST be explicit ClusterRole rules in bindata or operator RBAC — not broad cluster-admin grants. -**Evidence:** `config/rbac/role.yaml`; `bindata/external-secrets/resources/` — per-component RBAC YAML; `pkg/controller/external_secrets/rbacs.go`. +**Evidence:** `config/rbac/role.yaml`; `bindata/external-secrets/operand/` — per-component RBAC YAML; `pkg/controller/external_secrets/rbacs.go`. ### XI. OLM Bundle and Related Images @@ -131,7 +131,7 @@ Operator runs in `external-secrets-operator` namespace. Operand runs in `externa | **OperatorController_Agent** | `pkg/controller/external_secrets/` (incl. `pkg/controller/external_secrets/trusted_ca_bundle.go`), `pkg/controller/external_secrets_manager/`, `pkg/controller/crd_annotator/`, `pkg/operator/setup_manager.go` | Core operand reconciliation, wiring, user trusted CA | | **ManifestsBindata_Agent** | `bindata/`, `hack/update-external-secrets-manifests.sh`, operand CRDs | Operand manifest refresh, version pins | | **BitwardenPlugin_Agent** | `Plugins.BitwardenSecretManagerProvider`, bitwarden bindata assets | Bitwarden SDK plugin workload | -| **WebhookTLS_Agent** | `pkg/controller/external_secrets/certificate.go`, webhook deployments under `bindata/external-secrets/resources/` | Webhook TLS paths (cert-manager Certificate vs in-tree cert-controller) | +| **WebhookTLS_Agent** | `pkg/controller/external_secrets/certificate.go`, webhook deployments under `bindata/external-secrets/operand/` | Webhook TLS paths (cert-manager Certificate vs in-tree cert-controller) | | **RBACSecurity_Agent** | `config/rbac/`, `pkg/controller/external_secrets/rbacs.go`, `pkg/controller/external_secrets/networkpolicy.go` | RBAC and network policy | | **OLMRelease_Agent** | `bundle/`, `config/manifests/` | CSV, relatedImages | | **Testing_Agent** | `test/e2e/`, `test/apis/` | Test authoring | diff --git a/harness-evals/harness-docs/ESO_DEVELOPMENT.md b/harness-evals/harness-docs/ESO_DEVELOPMENT.md index 574666a35..9cb324fc4 100644 --- a/harness-evals/harness-docs/ESO_DEVELOPMENT.md +++ b/harness-evals/harness-docs/ESO_DEVELOPMENT.md @@ -66,11 +66,12 @@ The `hack/update-external-secrets-manifests.sh` script: - Renders templates (cert-manager enabled + disabled variants) - Strips Helm labels, relabels `managed-by` - Customizes core deployment (disables leader election, cluster-store/push-secret reconcilers) -- Splits into individual YAML files in `bindata/external-secrets/` +- Refreshes helm-rendered files under `bindata/external-secrets/operand/` (preserves `namespace_external-secrets.yml` and `certificate_bitwarden-tls-certs.yml`) +- Network policies live under `bindata/external-secrets/networkpolicies/` and are not touched by the script ### 2. Add a New Managed Resource Type -1. Add bindata YAML to `bindata/external-secrets/resources/` +1. Add bindata YAML to `bindata/external-secrets/operand/` 2. Run `make update-bindata` so `pkg/operator/assets/bindata.go` picks up the new asset 3. Add asset name constant in `pkg/controller/external_secrets/constants.go` 4. Add `Decode*ObjBytes` function in `pkg/controller/common/utils.go` diff --git a/harness-evals/harness-docs/architecture/components.md b/harness-evals/harness-docs/architecture/components.md index 37e933bdd..68cdaedb7 100644 --- a/harness-evals/harness-docs/architecture/components.md +++ b/harness-evals/harness-docs/architecture/components.md @@ -35,7 +35,9 @@ pkg/operator/ │ ├── setup_manager.go # Controller registration, default ESM creation │ └── assets/bindata.go # Generated — DO NOT EDIT pkg/version/ # Build-time ldflags (commit, version, date) -bindata/external-secrets/ # Source YAML manifests for operand resources +bindata/external-secrets/ +├── operand/ # Helm-rendered + operator-preserved operand YAML +└── networkpolicies/ # Operator-owned NetworkPolicy YAML config/ # CRDs, RBAC, manager deployment, samples, console bundle/ # OLM bundle (CRDs, metadata, console quickstarts) hack/ # Build/update scripts @@ -158,8 +160,9 @@ Operand manifests are sourced from upstream Helm charts, processed by `hack/upda ```text upstream Helm chart → helm template (cert-manager enabled + disabled variants) → strip Helm labels → relabel managed-by → split into individual YAML files - → bindata/external-secrets/ → openshift/build-machinery-go add-bindata - → pkg/operator/assets/bindata.go (DO NOT EDIT) + → bindata/external-secrets/operand/ (preserves operator-owned namespace + bitwarden cert) + → bindata/external-secrets/networkpolicies/ (unchanged by update script) + → openshift/build-machinery-go add-bindata → pkg/operator/assets/bindata.go (DO NOT EDIT) ``` Customizations applied during rendering: leader election disabled, cluster-store and push-secret reconcilers disabled in core deployment. diff --git a/pkg/controller/external_secrets/constants.go b/pkg/controller/external_secrets/constants.go index b82fa01dc..8a38491a8 100644 --- a/pkg/controller/external_secrets/constants.go +++ b/pkg/controller/external_secrets/constants.go @@ -183,39 +183,39 @@ var ( // asset names are the files present in the root `bindata/` dir, which are then loaded to // and made available by the pkg/operator/assets package. const ( - externalsecretsNamespaceAssetName = "external-secrets/external-secrets-namespace.yaml" - bitwardenCertificateAssetName = "external-secrets/certificate_bitwarden-tls-certs.yml" - webhookCertificateAssetName = "external-secrets/resources/certificate_external-secrets-webhook.yml" - certControllerClusterRoleAssetName = "external-secrets/resources/clusterrole_external-secrets-cert-controller.yml" - controllerClusterRoleAssetName = "external-secrets/resources/clusterrole_external-secrets-controller.yml" - controllerClusterRoleEditAssetName = "external-secrets/resources/clusterrole_external-secrets-edit.yml" - controllerClusterRoleServiceBindingsAssetName = "external-secrets/resources/clusterrole_external-secrets-servicebindings.yml" - controllerClusterRoleViewAssetName = "external-secrets/resources/clusterrole_external-secrets-view.yml" - certControllerClusterRoleBindingAssetName = "external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml" - controllerClusterRoleBindingAssetName = "external-secrets/resources/clusterrolebinding_external-secrets-controller.yml" - bitwardenDeploymentAssetName = "external-secrets/resources/deployment_bitwarden-sdk-server.yml" - controllerDeploymentAssetName = "external-secrets/resources/deployment_external-secrets.yml" - certControllerDeploymentAssetName = "external-secrets/resources/deployment_external-secrets-cert-controller.yml" - webhookDeploymentAssetName = "external-secrets/resources/deployment_external-secrets-webhook.yml" - controllerRoleLeaderElectionAssetName = "external-secrets/resources/role_external-secrets-leaderelection.yml" - controllerRoleBindingLeaderElectionAssetName = "external-secrets/resources/rolebinding_external-secrets-leaderelection.yml" - webhookTLSSecretAssetName = "external-secrets/resources/secret_external-secrets-webhook.yml" - bitwardenServiceAssetName = "external-secrets/resources/service_bitwarden-sdk-server.yml" - webhookServiceAssetName = "external-secrets/resources/service_external-secrets-webhook.yml" - metricsServiceAssetName = "external-secrets/resources/service_external-secrets-metrics.yml" - certControllerMetricsServiceAssetName = "external-secrets/resources/service_external-secrets-cert-controller-metrics.yml" - controllerServiceAccountAssetName = "external-secrets/resources/serviceaccount_external-secrets.yml" - bitwardenServiceAccountAssetName = "external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml" - certControllerServiceAccountAssetName = "external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml" - webhookServiceAccountAssetName = "external-secrets/resources/serviceaccount_external-secrets-webhook.yml" - validatingWebhookExternalSecretCRDAssetName = "external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml" - validatingWebhookSecretStoreCRDAssetName = "external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml" - denyAllNetworkPolicyAssetName = "external-secrets/networkpolicy_deny-all.yaml" - allowMainControllerTrafficAssetName = "external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml" - allowWebhookTrafficAssetName = "external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml" - allowCertControllerTrafficAssetName = "external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml" - allowBitwardenServerTrafficAssetName = "external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml" - allowDNSTrafficAssetName = "external-secrets/networkpolicy_allow-dns.yaml" + externalsecretsNamespaceAssetName = "external-secrets/operand/namespace_external-secrets.yml" + bitwardenCertificateAssetName = "external-secrets/operand/certificate_bitwarden-tls-certs.yml" + webhookCertificateAssetName = "external-secrets/operand/certificate_external-secrets-webhook.yml" + certControllerClusterRoleAssetName = "external-secrets/operand/clusterrole_external-secrets-cert-controller.yml" + controllerClusterRoleAssetName = "external-secrets/operand/clusterrole_external-secrets-controller.yml" + controllerClusterRoleEditAssetName = "external-secrets/operand/clusterrole_external-secrets-edit.yml" + controllerClusterRoleServiceBindingsAssetName = "external-secrets/operand/clusterrole_external-secrets-servicebindings.yml" + controllerClusterRoleViewAssetName = "external-secrets/operand/clusterrole_external-secrets-view.yml" + certControllerClusterRoleBindingAssetName = "external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml" + controllerClusterRoleBindingAssetName = "external-secrets/operand/clusterrolebinding_external-secrets-controller.yml" + bitwardenDeploymentAssetName = "external-secrets/operand/deployment_bitwarden-sdk-server.yml" + controllerDeploymentAssetName = "external-secrets/operand/deployment_external-secrets.yml" + certControllerDeploymentAssetName = "external-secrets/operand/deployment_external-secrets-cert-controller.yml" + webhookDeploymentAssetName = "external-secrets/operand/deployment_external-secrets-webhook.yml" + controllerRoleLeaderElectionAssetName = "external-secrets/operand/role_external-secrets-leaderelection.yml" + controllerRoleBindingLeaderElectionAssetName = "external-secrets/operand/rolebinding_external-secrets-leaderelection.yml" + webhookTLSSecretAssetName = "external-secrets/operand/secret_external-secrets-webhook.yml" + bitwardenServiceAssetName = "external-secrets/operand/service_bitwarden-sdk-server.yml" + webhookServiceAssetName = "external-secrets/operand/service_external-secrets-webhook.yml" + metricsServiceAssetName = "external-secrets/operand/service_external-secrets-metrics.yml" + certControllerMetricsServiceAssetName = "external-secrets/operand/service_external-secrets-cert-controller-metrics.yml" + controllerServiceAccountAssetName = "external-secrets/operand/serviceaccount_external-secrets.yml" + bitwardenServiceAccountAssetName = "external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml" + certControllerServiceAccountAssetName = "external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml" + webhookServiceAccountAssetName = "external-secrets/operand/serviceaccount_external-secrets-webhook.yml" + validatingWebhookExternalSecretCRDAssetName = "external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml" + validatingWebhookSecretStoreCRDAssetName = "external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml" + denyAllNetworkPolicyAssetName = "external-secrets/networkpolicies/deny-all.yml" + allowMainControllerTrafficAssetName = "external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml" + allowWebhookTrafficAssetName = "external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml" + allowCertControllerTrafficAssetName = "external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml" + allowBitwardenServerTrafficAssetName = "external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml" + allowDNSTrafficAssetName = "external-secrets/networkpolicies/allow-dns.yml" ) var ( diff --git a/pkg/controller/external_secrets/service_test.go b/pkg/controller/external_secrets/service_test.go index 67f06b7c0..8abdf9e9f 100644 --- a/pkg/controller/external_secrets/service_test.go +++ b/pkg/controller/external_secrets/service_test.go @@ -25,7 +25,7 @@ func TestCreateOrApplyServices(t *testing.T) { preReq: func(r *Reconciler, m *fakes.FakeCtrlClient) { m.ExistsCalls(func(ctx context.Context, ns types.NamespacedName, obj client.Object) (bool, error) { if o, ok := obj.(*corev1.Service); ok { - svc := testService("external-secrets/resources/service_external-secrets-webhook.yml") + svc := testService("external-secrets/operand/service_external-secrets-webhook.yml") svc.DeepCopyInto(o) return true, nil } @@ -38,7 +38,7 @@ func TestCreateOrApplyServices(t *testing.T) { preReq: func(r *Reconciler, m *fakes.FakeCtrlClient) { m.ExistsCalls(func(ctx context.Context, ns types.NamespacedName, obj client.Object) (bool, error) { if o, ok := obj.(*corev1.Service); ok { - svc := testService("external-secrets/resources/service_bitwarden-sdk-server.yml") + svc := testService("external-secrets/operand/service_bitwarden-sdk-server.yml") svc.DeepCopyInto(o) return false, nil } @@ -79,7 +79,7 @@ func TestCreateOrApplyServices(t *testing.T) { preReq: func(r *Reconciler, m *fakes.FakeCtrlClient) { m.ExistsCalls(func(ctx context.Context, ns types.NamespacedName, obj client.Object) (bool, error) { if o, ok := obj.(*corev1.Service); ok { - svc := testService("external-secrets/resources/service_external-secrets-webhook.yml") + svc := testService("external-secrets/operand/service_external-secrets-webhook.yml") svc.SetLabels(nil) // Trigger update svc.DeepCopyInto(o) return true, nil diff --git a/pkg/controller/external_secrets/serviceaccounts_test.go b/pkg/controller/external_secrets/serviceaccounts_test.go index 7eece199b..73f9e4035 100644 --- a/pkg/controller/external_secrets/serviceaccounts_test.go +++ b/pkg/controller/external_secrets/serviceaccounts_test.go @@ -18,10 +18,10 @@ var errTest = fmt.Errorf("test client error") func staticServiceAccounts() map[string]string { return map[string]string{ - "external-secrets": "external-secrets/resources/serviceaccount_external-secrets.yml", - "external-secrets-cert-controller": "external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml", - "external-secrets-webhook": "external-secrets/resources/serviceaccount_external-secrets-webhook.yml", - "bitwarden-sdk-server": "external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml", + "external-secrets": "external-secrets/operand/serviceaccount_external-secrets.yml", + "external-secrets-cert-controller": "external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml", + "external-secrets-webhook": "external-secrets/operand/serviceaccount_external-secrets-webhook.yml", + "bitwarden-sdk-server": "external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml", } } @@ -62,7 +62,7 @@ func TestCreateOrApplyServiceAccounts(t *testing.T) { return false, nil }) m.CreateCalls(func(ctx context.Context, obj client.Object, opts ...client.CreateOption) error { - expectedSA := testServiceAccount("external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml") + expectedSA := testServiceAccount("external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml") if sa, ok := obj.(*corev1.ServiceAccount); ok { if sa.Name == expectedSA.Name { return nil diff --git a/pkg/operator/assets/bindata.go b/pkg/operator/assets/bindata.go index c992bbba3..171b63e2f 100644 --- a/pkg/operator/assets/bindata.go +++ b/pkg/operator/assets/bindata.go @@ -1,38 +1,38 @@ // Code generated for package assets by go-bindata DO NOT EDIT. (@generated) // sources: -// bindata/external-secrets/certificate_bitwarden-tls-certs.yml -// bindata/external-secrets/external-secrets-namespace.yaml -// bindata/external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml -// bindata/external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml -// bindata/external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml -// bindata/external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml -// bindata/external-secrets/networkpolicy_allow-dns.yaml -// bindata/external-secrets/networkpolicy_deny-all.yaml -// bindata/external-secrets/resources/certificate_external-secrets-webhook.yml -// bindata/external-secrets/resources/clusterrole_external-secrets-cert-controller.yml -// bindata/external-secrets/resources/clusterrole_external-secrets-controller.yml -// bindata/external-secrets/resources/clusterrole_external-secrets-edit.yml -// bindata/external-secrets/resources/clusterrole_external-secrets-servicebindings.yml -// bindata/external-secrets/resources/clusterrole_external-secrets-view.yml -// bindata/external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml -// bindata/external-secrets/resources/clusterrolebinding_external-secrets-controller.yml -// bindata/external-secrets/resources/deployment_bitwarden-sdk-server.yml -// bindata/external-secrets/resources/deployment_external-secrets-cert-controller.yml -// bindata/external-secrets/resources/deployment_external-secrets-webhook.yml -// bindata/external-secrets/resources/deployment_external-secrets.yml -// bindata/external-secrets/resources/role_external-secrets-leaderelection.yml -// bindata/external-secrets/resources/rolebinding_external-secrets-leaderelection.yml -// bindata/external-secrets/resources/secret_external-secrets-webhook.yml -// bindata/external-secrets/resources/service_bitwarden-sdk-server.yml -// bindata/external-secrets/resources/service_external-secrets-cert-controller-metrics.yml -// bindata/external-secrets/resources/service_external-secrets-metrics.yml -// bindata/external-secrets/resources/service_external-secrets-webhook.yml -// bindata/external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml -// bindata/external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml -// bindata/external-secrets/resources/serviceaccount_external-secrets-webhook.yml -// bindata/external-secrets/resources/serviceaccount_external-secrets.yml -// bindata/external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml -// bindata/external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml +// bindata/external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml +// bindata/external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml +// bindata/external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml +// bindata/external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml +// bindata/external-secrets/networkpolicies/allow-dns.yml +// bindata/external-secrets/networkpolicies/deny-all.yml +// bindata/external-secrets/operand/certificate_bitwarden-tls-certs.yml +// bindata/external-secrets/operand/certificate_external-secrets-webhook.yml +// bindata/external-secrets/operand/clusterrole_external-secrets-cert-controller.yml +// bindata/external-secrets/operand/clusterrole_external-secrets-controller.yml +// bindata/external-secrets/operand/clusterrole_external-secrets-edit.yml +// bindata/external-secrets/operand/clusterrole_external-secrets-servicebindings.yml +// bindata/external-secrets/operand/clusterrole_external-secrets-view.yml +// bindata/external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml +// bindata/external-secrets/operand/clusterrolebinding_external-secrets-controller.yml +// bindata/external-secrets/operand/deployment_bitwarden-sdk-server.yml +// bindata/external-secrets/operand/deployment_external-secrets-cert-controller.yml +// bindata/external-secrets/operand/deployment_external-secrets-webhook.yml +// bindata/external-secrets/operand/deployment_external-secrets.yml +// bindata/external-secrets/operand/namespace_external-secrets.yml +// bindata/external-secrets/operand/role_external-secrets-leaderelection.yml +// bindata/external-secrets/operand/rolebinding_external-secrets-leaderelection.yml +// bindata/external-secrets/operand/secret_external-secrets-webhook.yml +// bindata/external-secrets/operand/service_bitwarden-sdk-server.yml +// bindata/external-secrets/operand/service_external-secrets-cert-controller-metrics.yml +// bindata/external-secrets/operand/service_external-secrets-metrics.yml +// bindata/external-secrets/operand/service_external-secrets-webhook.yml +// bindata/external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml +// bindata/external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml +// bindata/external-secrets/operand/serviceaccount_external-secrets-webhook.yml +// bindata/external-secrets/operand/serviceaccount_external-secrets.yml +// bindata/external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml +// bindata/external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml package assets import ( @@ -86,180 +86,111 @@ func (fi bindataFileInfo) Sys() interface{} { return nil } -var _externalSecretsCertificate_bitwardenTlsCertsYml = []byte(`apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: bitwarden-tls-certs - namespace: external-secrets - labels: - app.kubernetes.io/name: bitwarden-tls-certs - app.kubernetes.io/instance: external-secrets - app.kubernetes.io/version: "v0.19.0" - app.kubernetes.io/managed-by: external-secrets-operator -spec: - secretName: bitwarden-tls-certs - dnsNames: - - bitwarden-sdk-server.external-secrets.svc.cluster.local - - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local - - localhost - ipAddresses: - - 127.0.0.1 - - ::1 - privateKey: - algorithm: RSA - encoding: PKCS8 - size: 2048 - issuerRef: - group: cert-manager.io - kind: Issuer - name: my-issuer - duration: "8760h"`) - -func externalSecretsCertificate_bitwardenTlsCertsYmlBytes() ([]byte, error) { - return _externalSecretsCertificate_bitwardenTlsCertsYml, nil -} - -func externalSecretsCertificate_bitwardenTlsCertsYml() (*asset, error) { - bytes, err := externalSecretsCertificate_bitwardenTlsCertsYmlBytes() - if err != nil { - return nil, err - } - - info := bindataFileInfo{name: "external-secrets/certificate_bitwarden-tls-certs.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} - a := &asset{bytes: bytes, info: info} - return a, nil -} - -var _externalSecretsExternalSecretsNamespaceYaml = []byte(`apiVersion: v1 -kind: Namespace -metadata: - name: external-secrets -`) - -func externalSecretsExternalSecretsNamespaceYamlBytes() ([]byte, error) { - return _externalSecretsExternalSecretsNamespaceYaml, nil -} - -func externalSecretsExternalSecretsNamespaceYaml() (*asset, error) { - bytes, err := externalSecretsExternalSecretsNamespaceYamlBytes() - if err != nil { - return nil, err - } - - info := bindataFileInfo{name: "external-secrets/external-secrets-namespace.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} - a := &asset{bytes: bytes, info: info} - return a, nil -} - -var _externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: eso-sys-allow-api-server-egress-for-webhook + name: eso-sys-allow-api-server-egress-for-bitwarden-server namespace: external-secrets labels: - app.kubernetes.io/name: external-secrets-webhook + app.kubernetes.io/name: bitwarden-sdk-server app.kubernetes.io/instance: external-secrets app.kubernetes.io/version: "v1.2.0" app.kubernetes.io/managed-by: external-secrets-operator - external-secrets.io/component: webhook spec: podSelector: matchLabels: - app.kubernetes.io/name: external-secrets-webhook + app.kubernetes.io/name: bitwarden-sdk-server policyTypes: - - Egress - Ingress - egress: + - Egress + ingress: + # Allow External Secrets Controller to communicate with Bitwarden SDK Server - ports: - protocol: TCP - port: 6443 - ingress: + port: 9998 + # Allow access to Kubernetes API server and bitwarden sdk external server + egress: - ports: - protocol: TCP - port: 10250 - # Allow Prometheus/monitoring to scrape metrics - - from: - - namespaceSelector: - matchLabels: - name: openshift-user-workload-monitoring - ports: + port: 6443 - protocol: TCP - port: 8080`) + port: 443`) -func externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYaml, nil +func externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYml, nil } -func externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYamlBytes() +func externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: eso-sys-allow-api-server-egress-for-bitwarden-server + name: eso-sys-allow-api-server-egress-for-cert-controller namespace: external-secrets labels: - app.kubernetes.io/name: bitwarden-sdk-server + app.kubernetes.io/name: external-secrets-cert-controller app.kubernetes.io/instance: external-secrets app.kubernetes.io/version: "v1.2.0" app.kubernetes.io/managed-by: external-secrets-operator spec: podSelector: matchLabels: - app.kubernetes.io/name: bitwarden-sdk-server + app.kubernetes.io/name: external-secrets-cert-controller policyTypes: - - Ingress - Egress - ingress: - # Allow External Secrets Controller to communicate with Bitwarden SDK Server - - ports: - - protocol: TCP - port: 9998 - # Allow access to Kubernetes API server and bitwarden sdk external server + - Ingress egress: - ports: - protocol: TCP port: 6443 + ingress: + # Allow Prometheus/monitoring to scrape metrics + - from: + - namespaceSelector: + matchLabels: + name: openshift-user-workload-monitoring + ports: - protocol: TCP - port: 443`) + port: 8080`) -func externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYaml, nil +func externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYml, nil } -func externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYamlBytes() +func externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: eso-sys-allow-api-server-egress-for-cert-controller + name: eso-sys-allow-api-server-egress-for-main-controller namespace: external-secrets labels: - app.kubernetes.io/name: external-secrets-cert-controller + app.kubernetes.io/name: external-secrets app.kubernetes.io/instance: external-secrets app.kubernetes.io/version: "v1.2.0" app.kubernetes.io/managed-by: external-secrets-operator spec: podSelector: matchLabels: - app.kubernetes.io/name: external-secrets-cert-controller + app.kubernetes.io/name: external-secrets policyTypes: - Egress - Ingress @@ -277,35 +208,36 @@ spec: - protocol: TCP port: 8080`) -func externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYaml, nil +func externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYml, nil } -func externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYamlBytes() +func externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: eso-sys-allow-api-server-egress-for-main-controller + name: eso-sys-allow-api-server-egress-for-webhook namespace: external-secrets labels: - app.kubernetes.io/name: external-secrets + app.kubernetes.io/name: external-secrets-webhook app.kubernetes.io/instance: external-secrets app.kubernetes.io/version: "v1.2.0" app.kubernetes.io/managed-by: external-secrets-operator + external-secrets.io/component: webhook spec: podSelector: matchLabels: - app.kubernetes.io/name: external-secrets + app.kubernetes.io/name: external-secrets-webhook policyTypes: - Egress - Ingress @@ -314,6 +246,9 @@ spec: - protocol: TCP port: 6443 ingress: + - ports: + - protocol: TCP + port: 10250 # Allow Prometheus/monitoring to scrape metrics - from: - namespaceSelector: @@ -323,22 +258,22 @@ spec: - protocol: TCP port: 8080`) -func externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYaml, nil +func externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYml, nil } -func externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYamlBytes() +func externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsNetworkpolicy_allowDnsYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesAllowDnsYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: labels: @@ -375,22 +310,22 @@ spec: policyTypes: - Egress`) -func externalSecretsNetworkpolicy_allowDnsYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_allowDnsYaml, nil +func externalSecretsNetworkpoliciesAllowDnsYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesAllowDnsYml, nil } -func externalSecretsNetworkpolicy_allowDnsYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_allowDnsYamlBytes() +func externalSecretsNetworkpoliciesAllowDnsYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesAllowDnsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_allow-dns.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/networkpolicies/allow-dns.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsNetworkpolicy_denyAllYaml = []byte(`apiVersion: networking.k8s.io/v1 +var _externalSecretsNetworkpoliciesDenyAllYml = []byte(`apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: eso-sys-deny-all-traffic @@ -406,22 +341,66 @@ spec: - Ingress - Egress`) -func externalSecretsNetworkpolicy_denyAllYamlBytes() ([]byte, error) { - return _externalSecretsNetworkpolicy_denyAllYaml, nil +func externalSecretsNetworkpoliciesDenyAllYmlBytes() ([]byte, error) { + return _externalSecretsNetworkpoliciesDenyAllYml, nil +} + +func externalSecretsNetworkpoliciesDenyAllYml() (*asset, error) { + bytes, err := externalSecretsNetworkpoliciesDenyAllYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "external-secrets/networkpolicies/deny-all.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _externalSecretsOperandCertificate_bitwardenTlsCertsYml = []byte(`apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-tls-certs + namespace: external-secrets + labels: + app.kubernetes.io/name: bitwarden-tls-certs + app.kubernetes.io/instance: external-secrets + app.kubernetes.io/version: "v0.19.0" + app.kubernetes.io/managed-by: external-secrets-operator +spec: + secretName: bitwarden-tls-certs + dnsNames: + - bitwarden-sdk-server.external-secrets.svc.cluster.local + - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local + - localhost + ipAddresses: + - 127.0.0.1 + - ::1 + privateKey: + algorithm: RSA + encoding: PKCS8 + size: 2048 + issuerRef: + group: cert-manager.io + kind: Issuer + name: my-issuer + duration: "8760h"`) + +func externalSecretsOperandCertificate_bitwardenTlsCertsYmlBytes() ([]byte, error) { + return _externalSecretsOperandCertificate_bitwardenTlsCertsYml, nil } -func externalSecretsNetworkpolicy_denyAllYaml() (*asset, error) { - bytes, err := externalSecretsNetworkpolicy_denyAllYamlBytes() +func externalSecretsOperandCertificate_bitwardenTlsCertsYml() (*asset, error) { + bytes, err := externalSecretsOperandCertificate_bitwardenTlsCertsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/networkpolicy_deny-all.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/certificate_bitwarden-tls-certs.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesCertificate_externalSecretsWebhookYml = []byte(`--- +var _externalSecretsOperandCertificate_externalSecretsWebhookYml = []byte(`--- apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -447,22 +426,22 @@ spec: secretName: external-secrets-webhook `) -func externalSecretsResourcesCertificate_externalSecretsWebhookYmlBytes() ([]byte, error) { - return _externalSecretsResourcesCertificate_externalSecretsWebhookYml, nil +func externalSecretsOperandCertificate_externalSecretsWebhookYmlBytes() ([]byte, error) { + return _externalSecretsOperandCertificate_externalSecretsWebhookYml, nil } -func externalSecretsResourcesCertificate_externalSecretsWebhookYml() (*asset, error) { - bytes, err := externalSecretsResourcesCertificate_externalSecretsWebhookYmlBytes() +func externalSecretsOperandCertificate_externalSecretsWebhookYml() (*asset, error) { + bytes, err := externalSecretsOperandCertificate_externalSecretsWebhookYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/certificate_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/certificate_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrole_externalSecretsCertControllerYml = []byte(`--- +var _externalSecretsOperandClusterrole_externalSecretsCertControllerYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -545,22 +524,22 @@ rules: - "patch" `) -func externalSecretsResourcesClusterrole_externalSecretsCertControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrole_externalSecretsCertControllerYml, nil +func externalSecretsOperandClusterrole_externalSecretsCertControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrole_externalSecretsCertControllerYml, nil } -func externalSecretsResourcesClusterrole_externalSecretsCertControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrole_externalSecretsCertControllerYmlBytes() +func externalSecretsOperandClusterrole_externalSecretsCertControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrole_externalSecretsCertControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrole_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrole_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrole_externalSecretsControllerYml = []byte(`--- +var _externalSecretsOperandClusterrole_externalSecretsControllerYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -712,22 +691,22 @@ rules: - "delete" `) -func externalSecretsResourcesClusterrole_externalSecretsControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrole_externalSecretsControllerYml, nil +func externalSecretsOperandClusterrole_externalSecretsControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrole_externalSecretsControllerYml, nil } -func externalSecretsResourcesClusterrole_externalSecretsControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrole_externalSecretsControllerYmlBytes() +func externalSecretsOperandClusterrole_externalSecretsControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrole_externalSecretsControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrole_external-secrets-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrole_external-secrets-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrole_externalSecretsEditYml = []byte(`--- +var _externalSecretsOperandClusterrole_externalSecretsEditYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -781,22 +760,22 @@ rules: - "update" `) -func externalSecretsResourcesClusterrole_externalSecretsEditYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrole_externalSecretsEditYml, nil +func externalSecretsOperandClusterrole_externalSecretsEditYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrole_externalSecretsEditYml, nil } -func externalSecretsResourcesClusterrole_externalSecretsEditYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrole_externalSecretsEditYmlBytes() +func externalSecretsOperandClusterrole_externalSecretsEditYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrole_externalSecretsEditYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrole_external-secrets-edit.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrole_external-secrets-edit.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrole_externalSecretsServicebindingsYml = []byte(`--- +var _externalSecretsOperandClusterrole_externalSecretsServicebindingsYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -819,22 +798,22 @@ rules: - "watch" `) -func externalSecretsResourcesClusterrole_externalSecretsServicebindingsYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrole_externalSecretsServicebindingsYml, nil +func externalSecretsOperandClusterrole_externalSecretsServicebindingsYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrole_externalSecretsServicebindingsYml, nil } -func externalSecretsResourcesClusterrole_externalSecretsServicebindingsYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrole_externalSecretsServicebindingsYmlBytes() +func externalSecretsOperandClusterrole_externalSecretsServicebindingsYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrole_externalSecretsServicebindingsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrole_external-secrets-servicebindings.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrole_external-secrets-servicebindings.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrole_externalSecretsViewYml = []byte(`--- +var _externalSecretsOperandClusterrole_externalSecretsViewYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -885,22 +864,22 @@ rules: - "list" `) -func externalSecretsResourcesClusterrole_externalSecretsViewYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrole_externalSecretsViewYml, nil +func externalSecretsOperandClusterrole_externalSecretsViewYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrole_externalSecretsViewYml, nil } -func externalSecretsResourcesClusterrole_externalSecretsViewYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrole_externalSecretsViewYmlBytes() +func externalSecretsOperandClusterrole_externalSecretsViewYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrole_externalSecretsViewYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrole_external-secrets-view.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrole_external-secrets-view.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYml = []byte(`--- +var _externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: @@ -920,22 +899,22 @@ subjects: kind: ServiceAccount `) -func externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYml, nil +func externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYml, nil } -func externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYmlBytes() +func externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesClusterrolebinding_externalSecretsControllerYml = []byte(`--- +var _externalSecretsOperandClusterrolebinding_externalSecretsControllerYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: @@ -955,22 +934,22 @@ subjects: kind: ServiceAccount `) -func externalSecretsResourcesClusterrolebinding_externalSecretsControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesClusterrolebinding_externalSecretsControllerYml, nil +func externalSecretsOperandClusterrolebinding_externalSecretsControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandClusterrolebinding_externalSecretsControllerYml, nil } -func externalSecretsResourcesClusterrolebinding_externalSecretsControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesClusterrolebinding_externalSecretsControllerYmlBytes() +func externalSecretsOperandClusterrolebinding_externalSecretsControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandClusterrolebinding_externalSecretsControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/clusterrolebinding_external-secrets-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/clusterrolebinding_external-secrets-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesDeployment_bitwardenSdkServerYml = []byte(`--- +var _externalSecretsOperandDeployment_bitwardenSdkServerYml = []byte(`--- apiVersion: apps/v1 kind: Deployment metadata: @@ -1031,22 +1010,22 @@ spec: path: ca.pem `) -func externalSecretsResourcesDeployment_bitwardenSdkServerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesDeployment_bitwardenSdkServerYml, nil +func externalSecretsOperandDeployment_bitwardenSdkServerYmlBytes() ([]byte, error) { + return _externalSecretsOperandDeployment_bitwardenSdkServerYml, nil } -func externalSecretsResourcesDeployment_bitwardenSdkServerYml() (*asset, error) { - bytes, err := externalSecretsResourcesDeployment_bitwardenSdkServerYmlBytes() +func externalSecretsOperandDeployment_bitwardenSdkServerYml() (*asset, error) { + bytes, err := externalSecretsOperandDeployment_bitwardenSdkServerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/deployment_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/deployment_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesDeployment_externalSecretsCertControllerYml = []byte(`--- +var _externalSecretsOperandDeployment_externalSecretsCertControllerYml = []byte(`--- apiVersion: apps/v1 kind: Deployment metadata: @@ -1119,22 +1098,22 @@ spec: successThreshold: 1 `) -func externalSecretsResourcesDeployment_externalSecretsCertControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesDeployment_externalSecretsCertControllerYml, nil +func externalSecretsOperandDeployment_externalSecretsCertControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandDeployment_externalSecretsCertControllerYml, nil } -func externalSecretsResourcesDeployment_externalSecretsCertControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesDeployment_externalSecretsCertControllerYmlBytes() +func externalSecretsOperandDeployment_externalSecretsCertControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandDeployment_externalSecretsCertControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/deployment_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/deployment_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesDeployment_externalSecretsWebhookYml = []byte(`--- +var _externalSecretsOperandDeployment_externalSecretsWebhookYml = []byte(`--- apiVersion: apps/v1 kind: Deployment metadata: @@ -1216,22 +1195,22 @@ spec: secretName: external-secrets-webhook `) -func externalSecretsResourcesDeployment_externalSecretsWebhookYmlBytes() ([]byte, error) { - return _externalSecretsResourcesDeployment_externalSecretsWebhookYml, nil +func externalSecretsOperandDeployment_externalSecretsWebhookYmlBytes() ([]byte, error) { + return _externalSecretsOperandDeployment_externalSecretsWebhookYml, nil } -func externalSecretsResourcesDeployment_externalSecretsWebhookYml() (*asset, error) { - bytes, err := externalSecretsResourcesDeployment_externalSecretsWebhookYmlBytes() +func externalSecretsOperandDeployment_externalSecretsWebhookYml() (*asset, error) { + bytes, err := externalSecretsOperandDeployment_externalSecretsWebhookYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/deployment_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/deployment_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesDeployment_externalSecretsYml = []byte(`--- +var _externalSecretsOperandDeployment_externalSecretsYml = []byte(`--- apiVersion: apps/v1 kind: Deployment metadata: @@ -1290,22 +1269,43 @@ spec: dnsPolicy: ClusterFirst `) -func externalSecretsResourcesDeployment_externalSecretsYmlBytes() ([]byte, error) { - return _externalSecretsResourcesDeployment_externalSecretsYml, nil +func externalSecretsOperandDeployment_externalSecretsYmlBytes() ([]byte, error) { + return _externalSecretsOperandDeployment_externalSecretsYml, nil } -func externalSecretsResourcesDeployment_externalSecretsYml() (*asset, error) { - bytes, err := externalSecretsResourcesDeployment_externalSecretsYmlBytes() +func externalSecretsOperandDeployment_externalSecretsYml() (*asset, error) { + bytes, err := externalSecretsOperandDeployment_externalSecretsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/deployment_external-secrets.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/deployment_external-secrets.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesRole_externalSecretsLeaderelectionYml = []byte(`--- +var _externalSecretsOperandNamespace_externalSecretsYml = []byte(`apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets +`) + +func externalSecretsOperandNamespace_externalSecretsYmlBytes() ([]byte, error) { + return _externalSecretsOperandNamespace_externalSecretsYml, nil +} + +func externalSecretsOperandNamespace_externalSecretsYml() (*asset, error) { + bytes, err := externalSecretsOperandNamespace_externalSecretsYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "external-secrets/operand/namespace_external-secrets.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _externalSecretsOperandRole_externalSecretsLeaderelectionYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: @@ -1344,22 +1344,22 @@ rules: - "patch" `) -func externalSecretsResourcesRole_externalSecretsLeaderelectionYmlBytes() ([]byte, error) { - return _externalSecretsResourcesRole_externalSecretsLeaderelectionYml, nil +func externalSecretsOperandRole_externalSecretsLeaderelectionYmlBytes() ([]byte, error) { + return _externalSecretsOperandRole_externalSecretsLeaderelectionYml, nil } -func externalSecretsResourcesRole_externalSecretsLeaderelectionYml() (*asset, error) { - bytes, err := externalSecretsResourcesRole_externalSecretsLeaderelectionYmlBytes() +func externalSecretsOperandRole_externalSecretsLeaderelectionYml() (*asset, error) { + bytes, err := externalSecretsOperandRole_externalSecretsLeaderelectionYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/role_external-secrets-leaderelection.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/role_external-secrets-leaderelection.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYml = []byte(`--- +var _externalSecretsOperandRolebinding_externalSecretsLeaderelectionYml = []byte(`--- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: @@ -1380,22 +1380,22 @@ subjects: namespace: external-secrets `) -func externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYmlBytes() ([]byte, error) { - return _externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYml, nil +func externalSecretsOperandRolebinding_externalSecretsLeaderelectionYmlBytes() ([]byte, error) { + return _externalSecretsOperandRolebinding_externalSecretsLeaderelectionYml, nil } -func externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYml() (*asset, error) { - bytes, err := externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYmlBytes() +func externalSecretsOperandRolebinding_externalSecretsLeaderelectionYml() (*asset, error) { + bytes, err := externalSecretsOperandRolebinding_externalSecretsLeaderelectionYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/rolebinding_external-secrets-leaderelection.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/rolebinding_external-secrets-leaderelection.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesSecret_externalSecretsWebhookYml = []byte(`--- +var _externalSecretsOperandSecret_externalSecretsWebhookYml = []byte(`--- apiVersion: v1 kind: Secret metadata: @@ -1409,22 +1409,22 @@ metadata: external-secrets.io/component: webhook `) -func externalSecretsResourcesSecret_externalSecretsWebhookYmlBytes() ([]byte, error) { - return _externalSecretsResourcesSecret_externalSecretsWebhookYml, nil +func externalSecretsOperandSecret_externalSecretsWebhookYmlBytes() ([]byte, error) { + return _externalSecretsOperandSecret_externalSecretsWebhookYml, nil } -func externalSecretsResourcesSecret_externalSecretsWebhookYml() (*asset, error) { - bytes, err := externalSecretsResourcesSecret_externalSecretsWebhookYmlBytes() +func externalSecretsOperandSecret_externalSecretsWebhookYml() (*asset, error) { + bytes, err := externalSecretsOperandSecret_externalSecretsWebhookYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/secret_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/secret_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesService_bitwardenSdkServerYml = []byte(`--- +var _externalSecretsOperandService_bitwardenSdkServerYml = []byte(`--- apiVersion: v1 kind: Service metadata: @@ -1446,22 +1446,22 @@ spec: app.kubernetes.io/instance: external-secrets `) -func externalSecretsResourcesService_bitwardenSdkServerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesService_bitwardenSdkServerYml, nil +func externalSecretsOperandService_bitwardenSdkServerYmlBytes() ([]byte, error) { + return _externalSecretsOperandService_bitwardenSdkServerYml, nil } -func externalSecretsResourcesService_bitwardenSdkServerYml() (*asset, error) { - bytes, err := externalSecretsResourcesService_bitwardenSdkServerYmlBytes() +func externalSecretsOperandService_bitwardenSdkServerYml() (*asset, error) { + bytes, err := externalSecretsOperandService_bitwardenSdkServerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/service_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/service_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesService_externalSecretsCertControllerMetricsYml = []byte(`--- +var _externalSecretsOperandService_externalSecretsCertControllerMetricsYml = []byte(`--- apiVersion: v1 kind: Service metadata: @@ -1484,22 +1484,22 @@ spec: app.kubernetes.io/instance: external-secrets `) -func externalSecretsResourcesService_externalSecretsCertControllerMetricsYmlBytes() ([]byte, error) { - return _externalSecretsResourcesService_externalSecretsCertControllerMetricsYml, nil +func externalSecretsOperandService_externalSecretsCertControllerMetricsYmlBytes() ([]byte, error) { + return _externalSecretsOperandService_externalSecretsCertControllerMetricsYml, nil } -func externalSecretsResourcesService_externalSecretsCertControllerMetricsYml() (*asset, error) { - bytes, err := externalSecretsResourcesService_externalSecretsCertControllerMetricsYmlBytes() +func externalSecretsOperandService_externalSecretsCertControllerMetricsYml() (*asset, error) { + bytes, err := externalSecretsOperandService_externalSecretsCertControllerMetricsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/service_external-secrets-cert-controller-metrics.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/service_external-secrets-cert-controller-metrics.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesService_externalSecretsMetricsYml = []byte(`--- +var _externalSecretsOperandService_externalSecretsMetricsYml = []byte(`--- apiVersion: v1 kind: Service metadata: @@ -1522,22 +1522,22 @@ spec: app.kubernetes.io/instance: external-secrets `) -func externalSecretsResourcesService_externalSecretsMetricsYmlBytes() ([]byte, error) { - return _externalSecretsResourcesService_externalSecretsMetricsYml, nil +func externalSecretsOperandService_externalSecretsMetricsYmlBytes() ([]byte, error) { + return _externalSecretsOperandService_externalSecretsMetricsYml, nil } -func externalSecretsResourcesService_externalSecretsMetricsYml() (*asset, error) { - bytes, err := externalSecretsResourcesService_externalSecretsMetricsYmlBytes() +func externalSecretsOperandService_externalSecretsMetricsYml() (*asset, error) { + bytes, err := externalSecretsOperandService_externalSecretsMetricsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/service_external-secrets-metrics.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/service_external-secrets-metrics.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesService_externalSecretsWebhookYml = []byte(`--- +var _externalSecretsOperandService_externalSecretsWebhookYml = []byte(`--- apiVersion: v1 kind: Service metadata: @@ -1565,22 +1565,22 @@ spec: app.kubernetes.io/instance: external-secrets `) -func externalSecretsResourcesService_externalSecretsWebhookYmlBytes() ([]byte, error) { - return _externalSecretsResourcesService_externalSecretsWebhookYml, nil +func externalSecretsOperandService_externalSecretsWebhookYmlBytes() ([]byte, error) { + return _externalSecretsOperandService_externalSecretsWebhookYml, nil } -func externalSecretsResourcesService_externalSecretsWebhookYml() (*asset, error) { - bytes, err := externalSecretsResourcesService_externalSecretsWebhookYmlBytes() +func externalSecretsOperandService_externalSecretsWebhookYml() (*asset, error) { + bytes, err := externalSecretsOperandService_externalSecretsWebhookYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/service_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/service_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesServiceaccount_bitwardenSdkServerYml = []byte(`--- +var _externalSecretsOperandServiceaccount_bitwardenSdkServerYml = []byte(`--- apiVersion: v1 kind: ServiceAccount metadata: @@ -1593,22 +1593,22 @@ metadata: app.kubernetes.io/managed-by: external-secrets-operator `) -func externalSecretsResourcesServiceaccount_bitwardenSdkServerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesServiceaccount_bitwardenSdkServerYml, nil +func externalSecretsOperandServiceaccount_bitwardenSdkServerYmlBytes() ([]byte, error) { + return _externalSecretsOperandServiceaccount_bitwardenSdkServerYml, nil } -func externalSecretsResourcesServiceaccount_bitwardenSdkServerYml() (*asset, error) { - bytes, err := externalSecretsResourcesServiceaccount_bitwardenSdkServerYmlBytes() +func externalSecretsOperandServiceaccount_bitwardenSdkServerYml() (*asset, error) { + bytes, err := externalSecretsOperandServiceaccount_bitwardenSdkServerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesServiceaccount_externalSecretsCertControllerYml = []byte(`--- +var _externalSecretsOperandServiceaccount_externalSecretsCertControllerYml = []byte(`--- apiVersion: v1 kind: ServiceAccount metadata: @@ -1621,22 +1621,22 @@ metadata: app.kubernetes.io/managed-by: external-secrets-operator `) -func externalSecretsResourcesServiceaccount_externalSecretsCertControllerYmlBytes() ([]byte, error) { - return _externalSecretsResourcesServiceaccount_externalSecretsCertControllerYml, nil +func externalSecretsOperandServiceaccount_externalSecretsCertControllerYmlBytes() ([]byte, error) { + return _externalSecretsOperandServiceaccount_externalSecretsCertControllerYml, nil } -func externalSecretsResourcesServiceaccount_externalSecretsCertControllerYml() (*asset, error) { - bytes, err := externalSecretsResourcesServiceaccount_externalSecretsCertControllerYmlBytes() +func externalSecretsOperandServiceaccount_externalSecretsCertControllerYml() (*asset, error) { + bytes, err := externalSecretsOperandServiceaccount_externalSecretsCertControllerYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesServiceaccount_externalSecretsWebhookYml = []byte(`--- +var _externalSecretsOperandServiceaccount_externalSecretsWebhookYml = []byte(`--- apiVersion: v1 kind: ServiceAccount metadata: @@ -1649,22 +1649,22 @@ metadata: app.kubernetes.io/managed-by: external-secrets-operator `) -func externalSecretsResourcesServiceaccount_externalSecretsWebhookYmlBytes() ([]byte, error) { - return _externalSecretsResourcesServiceaccount_externalSecretsWebhookYml, nil +func externalSecretsOperandServiceaccount_externalSecretsWebhookYmlBytes() ([]byte, error) { + return _externalSecretsOperandServiceaccount_externalSecretsWebhookYml, nil } -func externalSecretsResourcesServiceaccount_externalSecretsWebhookYml() (*asset, error) { - bytes, err := externalSecretsResourcesServiceaccount_externalSecretsWebhookYmlBytes() +func externalSecretsOperandServiceaccount_externalSecretsWebhookYml() (*asset, error) { + bytes, err := externalSecretsOperandServiceaccount_externalSecretsWebhookYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/serviceaccount_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/serviceaccount_external-secrets-webhook.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesServiceaccount_externalSecretsYml = []byte(`--- +var _externalSecretsOperandServiceaccount_externalSecretsYml = []byte(`--- apiVersion: v1 kind: ServiceAccount metadata: @@ -1677,22 +1677,22 @@ metadata: app.kubernetes.io/managed-by: external-secrets-operator `) -func externalSecretsResourcesServiceaccount_externalSecretsYmlBytes() ([]byte, error) { - return _externalSecretsResourcesServiceaccount_externalSecretsYml, nil +func externalSecretsOperandServiceaccount_externalSecretsYmlBytes() ([]byte, error) { + return _externalSecretsOperandServiceaccount_externalSecretsYml, nil } -func externalSecretsResourcesServiceaccount_externalSecretsYml() (*asset, error) { - bytes, err := externalSecretsResourcesServiceaccount_externalSecretsYmlBytes() +func externalSecretsOperandServiceaccount_externalSecretsYml() (*asset, error) { + bytes, err := externalSecretsOperandServiceaccount_externalSecretsYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/serviceaccount_external-secrets.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/serviceaccount_external-secrets.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYml = []byte(`--- +var _externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYml = []byte(`--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -1722,22 +1722,22 @@ webhooks: failurePolicy: Fail `) -func externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYmlBytes() ([]byte, error) { - return _externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYml, nil +func externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYmlBytes() ([]byte, error) { + return _externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYml, nil } -func externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYml() (*asset, error) { - bytes, err := externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYmlBytes() +func externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYml() (*asset, error) { + bytes, err := externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } -var _externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYml = []byte(`--- +var _externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYml = []byte(`--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -1783,17 +1783,17 @@ webhooks: failurePolicy: Fail `) -func externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYmlBytes() ([]byte, error) { - return _externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYml, nil +func externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYmlBytes() ([]byte, error) { + return _externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYml, nil } -func externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYml() (*asset, error) { - bytes, err := externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYmlBytes() +func externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYml() (*asset, error) { + bytes, err := externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYmlBytes() if err != nil { return nil, err } - info := bindataFileInfo{name: "external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + info := bindataFileInfo{name: "external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} a := &asset{bytes: bytes, info: info} return a, nil } @@ -1850,39 +1850,39 @@ func AssetNames() []string { // _bindata is a table, holding each asset generator, mapped to its name. var _bindata = map[string]func() (*asset, error){ - "external-secrets/certificate_bitwarden-tls-certs.yml": externalSecretsCertificate_bitwardenTlsCertsYml, - "external-secrets/external-secrets-namespace.yaml": externalSecretsExternalSecretsNamespaceYaml, - "external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml": externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYaml, - "external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml": externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYaml, - "external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml": externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYaml, - "external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml": externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYaml, - "external-secrets/networkpolicy_allow-dns.yaml": externalSecretsNetworkpolicy_allowDnsYaml, - "external-secrets/networkpolicy_deny-all.yaml": externalSecretsNetworkpolicy_denyAllYaml, - "external-secrets/resources/certificate_external-secrets-webhook.yml": externalSecretsResourcesCertificate_externalSecretsWebhookYml, - "external-secrets/resources/clusterrole_external-secrets-cert-controller.yml": externalSecretsResourcesClusterrole_externalSecretsCertControllerYml, - "external-secrets/resources/clusterrole_external-secrets-controller.yml": externalSecretsResourcesClusterrole_externalSecretsControllerYml, - "external-secrets/resources/clusterrole_external-secrets-edit.yml": externalSecretsResourcesClusterrole_externalSecretsEditYml, - "external-secrets/resources/clusterrole_external-secrets-servicebindings.yml": externalSecretsResourcesClusterrole_externalSecretsServicebindingsYml, - "external-secrets/resources/clusterrole_external-secrets-view.yml": externalSecretsResourcesClusterrole_externalSecretsViewYml, - "external-secrets/resources/clusterrolebinding_external-secrets-cert-controller.yml": externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYml, - "external-secrets/resources/clusterrolebinding_external-secrets-controller.yml": externalSecretsResourcesClusterrolebinding_externalSecretsControllerYml, - "external-secrets/resources/deployment_bitwarden-sdk-server.yml": externalSecretsResourcesDeployment_bitwardenSdkServerYml, - "external-secrets/resources/deployment_external-secrets-cert-controller.yml": externalSecretsResourcesDeployment_externalSecretsCertControllerYml, - "external-secrets/resources/deployment_external-secrets-webhook.yml": externalSecretsResourcesDeployment_externalSecretsWebhookYml, - "external-secrets/resources/deployment_external-secrets.yml": externalSecretsResourcesDeployment_externalSecretsYml, - "external-secrets/resources/role_external-secrets-leaderelection.yml": externalSecretsResourcesRole_externalSecretsLeaderelectionYml, - "external-secrets/resources/rolebinding_external-secrets-leaderelection.yml": externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYml, - "external-secrets/resources/secret_external-secrets-webhook.yml": externalSecretsResourcesSecret_externalSecretsWebhookYml, - "external-secrets/resources/service_bitwarden-sdk-server.yml": externalSecretsResourcesService_bitwardenSdkServerYml, - "external-secrets/resources/service_external-secrets-cert-controller-metrics.yml": externalSecretsResourcesService_externalSecretsCertControllerMetricsYml, - "external-secrets/resources/service_external-secrets-metrics.yml": externalSecretsResourcesService_externalSecretsMetricsYml, - "external-secrets/resources/service_external-secrets-webhook.yml": externalSecretsResourcesService_externalSecretsWebhookYml, - "external-secrets/resources/serviceaccount_bitwarden-sdk-server.yml": externalSecretsResourcesServiceaccount_bitwardenSdkServerYml, - "external-secrets/resources/serviceaccount_external-secrets-cert-controller.yml": externalSecretsResourcesServiceaccount_externalSecretsCertControllerYml, - "external-secrets/resources/serviceaccount_external-secrets-webhook.yml": externalSecretsResourcesServiceaccount_externalSecretsWebhookYml, - "external-secrets/resources/serviceaccount_external-secrets.yml": externalSecretsResourcesServiceaccount_externalSecretsYml, - "external-secrets/resources/validatingwebhookconfiguration_externalsecret-validate.yml": externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYml, - "external-secrets/resources/validatingwebhookconfiguration_secretstore-validate.yml": externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYml, + "external-secrets/networkpolicies/allow-api-server-egress-for-bitwarden-sever.yml": externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYml, + "external-secrets/networkpolicies/allow-api-server-egress-for-cert-controller-traffic.yml": externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYml, + "external-secrets/networkpolicies/allow-api-server-egress-for-main-controller-traffic.yml": externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYml, + "external-secrets/networkpolicies/allow-api-server-egress-for-webhook-traffic.yml": externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYml, + "external-secrets/networkpolicies/allow-dns.yml": externalSecretsNetworkpoliciesAllowDnsYml, + "external-secrets/networkpolicies/deny-all.yml": externalSecretsNetworkpoliciesDenyAllYml, + "external-secrets/operand/certificate_bitwarden-tls-certs.yml": externalSecretsOperandCertificate_bitwardenTlsCertsYml, + "external-secrets/operand/certificate_external-secrets-webhook.yml": externalSecretsOperandCertificate_externalSecretsWebhookYml, + "external-secrets/operand/clusterrole_external-secrets-cert-controller.yml": externalSecretsOperandClusterrole_externalSecretsCertControllerYml, + "external-secrets/operand/clusterrole_external-secrets-controller.yml": externalSecretsOperandClusterrole_externalSecretsControllerYml, + "external-secrets/operand/clusterrole_external-secrets-edit.yml": externalSecretsOperandClusterrole_externalSecretsEditYml, + "external-secrets/operand/clusterrole_external-secrets-servicebindings.yml": externalSecretsOperandClusterrole_externalSecretsServicebindingsYml, + "external-secrets/operand/clusterrole_external-secrets-view.yml": externalSecretsOperandClusterrole_externalSecretsViewYml, + "external-secrets/operand/clusterrolebinding_external-secrets-cert-controller.yml": externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYml, + "external-secrets/operand/clusterrolebinding_external-secrets-controller.yml": externalSecretsOperandClusterrolebinding_externalSecretsControllerYml, + "external-secrets/operand/deployment_bitwarden-sdk-server.yml": externalSecretsOperandDeployment_bitwardenSdkServerYml, + "external-secrets/operand/deployment_external-secrets-cert-controller.yml": externalSecretsOperandDeployment_externalSecretsCertControllerYml, + "external-secrets/operand/deployment_external-secrets-webhook.yml": externalSecretsOperandDeployment_externalSecretsWebhookYml, + "external-secrets/operand/deployment_external-secrets.yml": externalSecretsOperandDeployment_externalSecretsYml, + "external-secrets/operand/namespace_external-secrets.yml": externalSecretsOperandNamespace_externalSecretsYml, + "external-secrets/operand/role_external-secrets-leaderelection.yml": externalSecretsOperandRole_externalSecretsLeaderelectionYml, + "external-secrets/operand/rolebinding_external-secrets-leaderelection.yml": externalSecretsOperandRolebinding_externalSecretsLeaderelectionYml, + "external-secrets/operand/secret_external-secrets-webhook.yml": externalSecretsOperandSecret_externalSecretsWebhookYml, + "external-secrets/operand/service_bitwarden-sdk-server.yml": externalSecretsOperandService_bitwardenSdkServerYml, + "external-secrets/operand/service_external-secrets-cert-controller-metrics.yml": externalSecretsOperandService_externalSecretsCertControllerMetricsYml, + "external-secrets/operand/service_external-secrets-metrics.yml": externalSecretsOperandService_externalSecretsMetricsYml, + "external-secrets/operand/service_external-secrets-webhook.yml": externalSecretsOperandService_externalSecretsWebhookYml, + "external-secrets/operand/serviceaccount_bitwarden-sdk-server.yml": externalSecretsOperandServiceaccount_bitwardenSdkServerYml, + "external-secrets/operand/serviceaccount_external-secrets-cert-controller.yml": externalSecretsOperandServiceaccount_externalSecretsCertControllerYml, + "external-secrets/operand/serviceaccount_external-secrets-webhook.yml": externalSecretsOperandServiceaccount_externalSecretsWebhookYml, + "external-secrets/operand/serviceaccount_external-secrets.yml": externalSecretsOperandServiceaccount_externalSecretsYml, + "external-secrets/operand/validatingwebhookconfiguration_externalsecret-validate.yml": externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYml, + "external-secrets/operand/validatingwebhookconfiguration_secretstore-validate.yml": externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYml, } // AssetDir returns the file names below a certain @@ -1929,40 +1929,42 @@ type bintree struct { var _bintree = &bintree{nil, map[string]*bintree{ "external-secrets": {nil, map[string]*bintree{ - "certificate_bitwarden-tls-certs.yml": {externalSecretsCertificate_bitwardenTlsCertsYml, map[string]*bintree{}}, - "external-secrets-namespace.yaml": {externalSecretsExternalSecretsNamespaceYaml, map[string]*bintree{}}, - "networkpolicy_allow-api-server-and-webhook-traffic.yaml": {externalSecretsNetworkpolicy_allowApiServerAndWebhookTrafficYaml, map[string]*bintree{}}, - "networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml": {externalSecretsNetworkpolicy_allowApiServerEgressForBitwardenSeverYaml, map[string]*bintree{}}, - "networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml": {externalSecretsNetworkpolicy_allowApiServerEgressForCertControllerTrafficYaml, map[string]*bintree{}}, - "networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml": {externalSecretsNetworkpolicy_allowApiServerEgressForMainControllerTrafficYaml, map[string]*bintree{}}, - "networkpolicy_allow-dns.yaml": {externalSecretsNetworkpolicy_allowDnsYaml, map[string]*bintree{}}, - "networkpolicy_deny-all.yaml": {externalSecretsNetworkpolicy_denyAllYaml, map[string]*bintree{}}, - "resources": {nil, map[string]*bintree{ - "certificate_external-secrets-webhook.yml": {externalSecretsResourcesCertificate_externalSecretsWebhookYml, map[string]*bintree{}}, - "clusterrole_external-secrets-cert-controller.yml": {externalSecretsResourcesClusterrole_externalSecretsCertControllerYml, map[string]*bintree{}}, - "clusterrole_external-secrets-controller.yml": {externalSecretsResourcesClusterrole_externalSecretsControllerYml, map[string]*bintree{}}, - "clusterrole_external-secrets-edit.yml": {externalSecretsResourcesClusterrole_externalSecretsEditYml, map[string]*bintree{}}, - "clusterrole_external-secrets-servicebindings.yml": {externalSecretsResourcesClusterrole_externalSecretsServicebindingsYml, map[string]*bintree{}}, - "clusterrole_external-secrets-view.yml": {externalSecretsResourcesClusterrole_externalSecretsViewYml, map[string]*bintree{}}, - "clusterrolebinding_external-secrets-cert-controller.yml": {externalSecretsResourcesClusterrolebinding_externalSecretsCertControllerYml, map[string]*bintree{}}, - "clusterrolebinding_external-secrets-controller.yml": {externalSecretsResourcesClusterrolebinding_externalSecretsControllerYml, map[string]*bintree{}}, - "deployment_bitwarden-sdk-server.yml": {externalSecretsResourcesDeployment_bitwardenSdkServerYml, map[string]*bintree{}}, - "deployment_external-secrets-cert-controller.yml": {externalSecretsResourcesDeployment_externalSecretsCertControllerYml, map[string]*bintree{}}, - "deployment_external-secrets-webhook.yml": {externalSecretsResourcesDeployment_externalSecretsWebhookYml, map[string]*bintree{}}, - "deployment_external-secrets.yml": {externalSecretsResourcesDeployment_externalSecretsYml, map[string]*bintree{}}, - "role_external-secrets-leaderelection.yml": {externalSecretsResourcesRole_externalSecretsLeaderelectionYml, map[string]*bintree{}}, - "rolebinding_external-secrets-leaderelection.yml": {externalSecretsResourcesRolebinding_externalSecretsLeaderelectionYml, map[string]*bintree{}}, - "secret_external-secrets-webhook.yml": {externalSecretsResourcesSecret_externalSecretsWebhookYml, map[string]*bintree{}}, - "service_bitwarden-sdk-server.yml": {externalSecretsResourcesService_bitwardenSdkServerYml, map[string]*bintree{}}, - "service_external-secrets-cert-controller-metrics.yml": {externalSecretsResourcesService_externalSecretsCertControllerMetricsYml, map[string]*bintree{}}, - "service_external-secrets-metrics.yml": {externalSecretsResourcesService_externalSecretsMetricsYml, map[string]*bintree{}}, - "service_external-secrets-webhook.yml": {externalSecretsResourcesService_externalSecretsWebhookYml, map[string]*bintree{}}, - "serviceaccount_bitwarden-sdk-server.yml": {externalSecretsResourcesServiceaccount_bitwardenSdkServerYml, map[string]*bintree{}}, - "serviceaccount_external-secrets-cert-controller.yml": {externalSecretsResourcesServiceaccount_externalSecretsCertControllerYml, map[string]*bintree{}}, - "serviceaccount_external-secrets-webhook.yml": {externalSecretsResourcesServiceaccount_externalSecretsWebhookYml, map[string]*bintree{}}, - "serviceaccount_external-secrets.yml": {externalSecretsResourcesServiceaccount_externalSecretsYml, map[string]*bintree{}}, - "validatingwebhookconfiguration_externalsecret-validate.yml": {externalSecretsResourcesValidatingwebhookconfiguration_externalsecretValidateYml, map[string]*bintree{}}, - "validatingwebhookconfiguration_secretstore-validate.yml": {externalSecretsResourcesValidatingwebhookconfiguration_secretstoreValidateYml, map[string]*bintree{}}, + "networkpolicies": {nil, map[string]*bintree{ + "allow-api-server-egress-for-bitwarden-sever.yml": {externalSecretsNetworkpoliciesAllowApiServerEgressForBitwardenSeverYml, map[string]*bintree{}}, + "allow-api-server-egress-for-cert-controller-traffic.yml": {externalSecretsNetworkpoliciesAllowApiServerEgressForCertControllerTrafficYml, map[string]*bintree{}}, + "allow-api-server-egress-for-main-controller-traffic.yml": {externalSecretsNetworkpoliciesAllowApiServerEgressForMainControllerTrafficYml, map[string]*bintree{}}, + "allow-api-server-egress-for-webhook-traffic.yml": {externalSecretsNetworkpoliciesAllowApiServerEgressForWebhookTrafficYml, map[string]*bintree{}}, + "allow-dns.yml": {externalSecretsNetworkpoliciesAllowDnsYml, map[string]*bintree{}}, + "deny-all.yml": {externalSecretsNetworkpoliciesDenyAllYml, map[string]*bintree{}}, + }}, + "operand": {nil, map[string]*bintree{ + "certificate_bitwarden-tls-certs.yml": {externalSecretsOperandCertificate_bitwardenTlsCertsYml, map[string]*bintree{}}, + "certificate_external-secrets-webhook.yml": {externalSecretsOperandCertificate_externalSecretsWebhookYml, map[string]*bintree{}}, + "clusterrole_external-secrets-cert-controller.yml": {externalSecretsOperandClusterrole_externalSecretsCertControllerYml, map[string]*bintree{}}, + "clusterrole_external-secrets-controller.yml": {externalSecretsOperandClusterrole_externalSecretsControllerYml, map[string]*bintree{}}, + "clusterrole_external-secrets-edit.yml": {externalSecretsOperandClusterrole_externalSecretsEditYml, map[string]*bintree{}}, + "clusterrole_external-secrets-servicebindings.yml": {externalSecretsOperandClusterrole_externalSecretsServicebindingsYml, map[string]*bintree{}}, + "clusterrole_external-secrets-view.yml": {externalSecretsOperandClusterrole_externalSecretsViewYml, map[string]*bintree{}}, + "clusterrolebinding_external-secrets-cert-controller.yml": {externalSecretsOperandClusterrolebinding_externalSecretsCertControllerYml, map[string]*bintree{}}, + "clusterrolebinding_external-secrets-controller.yml": {externalSecretsOperandClusterrolebinding_externalSecretsControllerYml, map[string]*bintree{}}, + "deployment_bitwarden-sdk-server.yml": {externalSecretsOperandDeployment_bitwardenSdkServerYml, map[string]*bintree{}}, + "deployment_external-secrets-cert-controller.yml": {externalSecretsOperandDeployment_externalSecretsCertControllerYml, map[string]*bintree{}}, + "deployment_external-secrets-webhook.yml": {externalSecretsOperandDeployment_externalSecretsWebhookYml, map[string]*bintree{}}, + "deployment_external-secrets.yml": {externalSecretsOperandDeployment_externalSecretsYml, map[string]*bintree{}}, + "namespace_external-secrets.yml": {externalSecretsOperandNamespace_externalSecretsYml, map[string]*bintree{}}, + "role_external-secrets-leaderelection.yml": {externalSecretsOperandRole_externalSecretsLeaderelectionYml, map[string]*bintree{}}, + "rolebinding_external-secrets-leaderelection.yml": {externalSecretsOperandRolebinding_externalSecretsLeaderelectionYml, map[string]*bintree{}}, + "secret_external-secrets-webhook.yml": {externalSecretsOperandSecret_externalSecretsWebhookYml, map[string]*bintree{}}, + "service_bitwarden-sdk-server.yml": {externalSecretsOperandService_bitwardenSdkServerYml, map[string]*bintree{}}, + "service_external-secrets-cert-controller-metrics.yml": {externalSecretsOperandService_externalSecretsCertControllerMetricsYml, map[string]*bintree{}}, + "service_external-secrets-metrics.yml": {externalSecretsOperandService_externalSecretsMetricsYml, map[string]*bintree{}}, + "service_external-secrets-webhook.yml": {externalSecretsOperandService_externalSecretsWebhookYml, map[string]*bintree{}}, + "serviceaccount_bitwarden-sdk-server.yml": {externalSecretsOperandServiceaccount_bitwardenSdkServerYml, map[string]*bintree{}}, + "serviceaccount_external-secrets-cert-controller.yml": {externalSecretsOperandServiceaccount_externalSecretsCertControllerYml, map[string]*bintree{}}, + "serviceaccount_external-secrets-webhook.yml": {externalSecretsOperandServiceaccount_externalSecretsWebhookYml, map[string]*bintree{}}, + "serviceaccount_external-secrets.yml": {externalSecretsOperandServiceaccount_externalSecretsYml, map[string]*bintree{}}, + "validatingwebhookconfiguration_externalsecret-validate.yml": {externalSecretsOperandValidatingwebhookconfiguration_externalsecretValidateYml, map[string]*bintree{}}, + "validatingwebhookconfiguration_secretstore-validate.yml": {externalSecretsOperandValidatingwebhookconfiguration_secretstoreValidateYml, map[string]*bintree{}}, }}, }}, }}