Documentation
¶
Overview ¶
Package eso holds what forge pins about the External Secrets Operator component (forge.ExternalSecretsOperator): the chart and image it installs, the keyless-signing identity that image must carry, and the CRDs forge supplies itself.
The values here are the Go half of kcl/schema.k (ESO_CHART_VERSION, ESO_IMAGE) and kcl/lib/eso.k; TestKCLPinsAgree pins them against each other.
forge supplies ONLY the CRDs the hardened install uses (ExternalSecret, SecretStore and GeneratorState). The chart is rendered `--skip-crds` AND with installCRDs=false: in chart 2.13 the CRDs are ordinary templates gated on `installCRDs`, so `--skip-crds` alone would not exclude them. The kinds the install does not process (ClusterSecretStore, ClusterExternalSecret, PushSecret, ClusterPushSecret, ClusterGenerator and the generators) have no CRD on the cluster, so nothing can create one.
Index ¶
Constants ¶
const ( // ChartOCI is the chart's OCI reference. ChartOCI = "oci://ghcr.io/external-secrets/charts/external-secrets" // ChartVersion is the pinned chart version. Chart 2.13.0 is appVersion // v2.13.0; the CRD bundle below is rendered from exactly this chart. ChartVersion = "2.13.0" // ChartName is the `--target` selector of the HelmChart forge declares. ChartName = "external-secrets" // Namespace is the default namespace the operator runs in. Namespace = "external-secrets" // ImageRepository and ImageTag are the controller image's reference; the // digest it is pinned to lives in kcl/schema.k (ESO_IMAGE). ImageRepository = "ghcr.io/external-secrets/external-secrets" ImageTag = "v2.13.0" // CosignIssuer and CosignIdentity are the keyless-signing identity a // controller image must carry (P2). The certificate's subject // alternative name is the release workflow at the main branch, issued by // GitHub Actions' OIDC provider. Verified for the pinned digest with // // cosign verify \ // --certificate-oidc-issuer https://token.actions.githubusercontent.com \ // --certificate-identity https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main \ // ghcr.io/external-secrets/external-secrets@sha256:<digest> CosignIssuer = "https://token.actions.githubusercontent.com" CosignIdentity = "https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main" )
const ComponentLabel = "forge.dev/component"
ComponentLabel names the component an object belongs to.
const ComponentName = "external-secrets-operator"
ComponentName is ComponentLabel's value for this component.
const ComponentOwnerLabel = "forge.dev/component-owner"
ComponentOwnerLabel is stamped on every object the component renders. Its value is the owner (<project>.<env>), so a second env that declares the component on the same cluster is found by label, never by name.
Variables ¶
var CRDGroups = []string{"external-secrets.io", "generators.external-secrets.io"}
CRDGroups are the API groups of the CRDs forge supplies.
var CRDNames = []string{
"externalsecrets.external-secrets.io",
"secretstores.external-secrets.io",
"generatorstates.generators.external-secrets.io",
}
CRDNames are the CustomResourceDefinitions forge supplies, in apply order.
WHY GeneratorState SHIPS THOUGH GENERATORS ARE OFF. No generator kind has a CRD here, so nothing can create a generator, and still the controller needs this one. Re-checked against chart/app v2.13.0 (SC7 rehearsal, D6): in cmd/controller/root.go the GeneratorState reconciler is registered UNCONDITIONALLY (`generatorstate.Reconciler{...}.SetupWithManager`, outside every `if enable...` block), and it watches the GeneratorState kind. Without the CRD that watch cannot sync and the manager exits at start-up with "no matches for kind GeneratorState". `--enable-generator-state=false` does NOT help: that flag only reaches the ExternalSecret reconciler (EnableGeneratorState). The CRD is an empty-by-construction table (nothing writes a GeneratorState without a generator), so shipping it widens nothing. The CRD documents are byte-for-byte the chart's, so the reason lives here and in the external-secrets skill, not in the YAML. Re-verify on every bump; drop the CRD only when a pinned release gates that reconciler on a flag the install can turn off.
Functions ¶
func CRDs ¶
CRDs returns the CRD bundle for a chart version: the three CRDs the hardened install uses, `---`-separated, in CRDNames order, each stamped with ComponentLabel and (when owner is not empty) ComponentOwnerLabel. A version forge holds no bundle for is an error, not a fallback: the CRDs and the controller move together.
Types ¶
This section is empty.
Source Files