From dd2eb7146cba688f6ef9537f9bd0e1d8999cc6cf Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sat, 4 Nov 2023 12:24:21 +0100
Subject: [PATCH] Added vault secret support to template chart and updated
 README

---
 helm/template/Chart.yaml                      |  4 ++--
 helm/template/README.md                       | 14 +++++++++++--
 .../_templates/vault-secrets-app.yaml         |  1 +
 helm/template/_values.yaml                    | 11 ++++++++++
 helm/template/templates/_secret.yaml          |  2 +-
 .../templates/_vault-secrets-app.yaml         | 21 +++++++++++++++++++
 6 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 helm/template/_templates/vault-secrets-app.yaml
 create mode 100644 helm/template/templates/_vault-secrets-app.yaml

diff --git a/helm/template/Chart.yaml b/helm/template/Chart.yaml
index 4346e54..12c325c 100644
--- a/helm/template/Chart.yaml
+++ b/helm/template/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: template
 description: A Helm library chart containing common templates, keeping application templates short
 type: library
-version: 0.1.25
+version: 0.2.0
 maintainers:
   - name: Jim Martens
     url: https://2martens.de
@@ -11,7 +11,7 @@ sources:
 annotations:
   artifacthub.io/changes: |
     - kind: added
-      description: Added namespace selector
+      description: Added support for Vault Secrets
   artifacthub.io/signKey: |
     fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
     url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc
diff --git a/helm/template/README.md b/helm/template/README.md
index 257ebdd..2d634bd 100644
--- a/helm/template/README.md
+++ b/helm/template/README.md
@@ -54,9 +54,13 @@ NOTES.txt
 {{- end }}
 ```
 
+podmonitor.yaml:
+
+```yaml
+{ { - include "template.podmonitor" . - } }
+```
+
 secret.yaml:
-If you want to use external secrets, you MUST NOT include the secret
-template but implement it yourself. 
 ```yaml
 {{- include "template.secret" . -}}
 ```
@@ -71,6 +75,12 @@ serviceaccount.yaml
 {{- include "template.serviceAccount" . -}}
 ```
 
+vault-secrets-app.yaml
+
+```yaml
+{ { - include "template.vaultSecretsApp" . - } }
+```
+
 tests/test-connection.yaml
 ```yaml
 apiVersion: v1
diff --git a/helm/template/_templates/vault-secrets-app.yaml b/helm/template/_templates/vault-secrets-app.yaml
new file mode 100644
index 0000000..8a9f06c
--- /dev/null
+++ b/helm/template/_templates/vault-secrets-app.yaml
@@ -0,0 +1 @@
+{ { - include "template.vaultSecretsApp" . - } }
diff --git a/helm/template/_values.yaml b/helm/template/_values.yaml
index 0581e47..b4171ac 100644
--- a/helm/template/_values.yaml
+++ b/helm/template/_values.yaml
@@ -136,6 +136,17 @@ autoscaling:
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
+vault:
+  enabled: false
+  # name of the Vault secrets applications
+  applicationName: ""
+  # id of the organization in Vault secrets
+  organizationId: ""
+  # id of the project in Vault secrets
+  projectId: ""
+  # if not provided, vault-secrets-operator-system will be used
+  operatorNamespace: ""
+
 # Configure nodeSelector, contents will be added verbatim to key nodeSelector in deployment pod template
 nodeSelector: {}
 
diff --git a/helm/template/templates/_secret.yaml b/helm/template/templates/_secret.yaml
index 0c05b80..5fe41b0 100644
--- a/helm/template/templates/_secret.yaml
+++ b/helm/template/templates/_secret.yaml
@@ -1,5 +1,5 @@
 {{- define "template.secret" -}}
-{{- if .Values.secrets }}
+{{- if and .Values.secrets (not .Values.vault.enabled) }}
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/helm/template/templates/_vault-secrets-app.yaml b/helm/template/templates/_vault-secrets-app.yaml
new file mode 100644
index 0000000..16eb65d
--- /dev/null
+++ b/helm/template/templates/_vault-secrets-app.yaml
@@ -0,0 +1,21 @@
+{{- define "template.vaultSecretsApp" -}}
+{{- if .Values.vault.enabled }}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: HCPVaultSecretsApp
+metadata:
+  name: {{ include "template.fullname" . }}
+  namespace: {{ .Values.vault.operatorNamespace | default "vault-secrets-operator-system" }}
+  labels:
+    {{- include "template.labels" . | nindent 4 }}
+spec:
+  appName: {{ .Values.vault.applicationName }}
+  hcpAuthRef: {{ .Values.vault.operatorNamespace | default "vault-secrets-operator-system" }}/hcp-auth
+  destination:
+    create: true
+    labels:
+      {{- include "template.labels" . | nindent 6 }}
+      hvs: "true"
+    name: {{ include "template.fullname" . }}
+  refreshAfter: 1h
+{{- end }}
+{{- end }}
\ No newline at end of file