Removing gitExternal secrets from globals

Signed-off-by: Markos Kandylis <markos_kandylis@hotmail.com>

Author: markoskandylis

charts/fleet-secret/README.MD

@@ -160,6 +160,11 @@ gitExternalSecrets:
       secretManagerSecretName: "git-addons-creds"
 ```
 
+Values defined under `global.gitExternalSecrets.externalSecrets` act as shared defaults and
+are deep-merged with the chart-level `gitExternalSecrets.externalSecrets`. Define the common
+portions (for example `secretName`, `secretType`, or annotations) globally and only override
+the differing keys per cluster or environment.
+
 ## Notes
 
 - All secrets are created in the ArgoCD namespace by default
@@ -178,4 +183,4 @@ gitExternalSecrets:
 ## License
 
 This chart is licensed under the Apache License 2.0.
-```
+```

charts/fleet-secret/templates/gitExternalSecret.yaml

@@ -1,26 +1,20 @@
 {{- if .Values.gitExternalSecrets.enabled }}
-{{- $globalGitSecrets := dict }}
-{{- if and .Values.global .Values.global.gitExternalSecrets .Values.global.gitExternalSecrets.externalSecrets }}
-{{- $globalGitSecrets = .Values.global.gitExternalSecrets.externalSecrets }}
-{{- end }}
-{{- $secretStoreRefName := .Values.global.gitExternalSecrets.secretStoreRefName | default "" -}}
+{{- $secretStoreRefName := .Values.gitExternalSecrets.secretStoreRefName | default "" -}}
 {{- $secretStoreRefKind := .Values.global.gitExternalSecrets.secretStoreRefKind | default "" -}}
 {{- $useHttp := .Values.global.gitExternalSecrets.useHttp | default false -}}
 {{- $useGitHubApp := .Values.global.gitExternalSecrets.useGitHubApp | default false -}}
 {{- $usePrivateKey := .Values.global.gitExternalSecrets.usePrivateKey | default false -}}
 {{- $clusterGitSecrets := .Values.gitExternalSecrets.externalSecrets | default dict }}
-{{/*Merging Git External Secrets*/}}
-{{- $mergedSecrets := merge $clusterGitSecrets $globalGitSecrets }}
 
-{{- range $externalSecretName, $externalSecret := $mergedSecrets }}
+{{- range $externalSecretName, $externalSecret := $clusterGitSecrets }}
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: {{ $externalSecretName }}
 spec:
   secretStoreRef:
-    kind: {{ $secretStoreRefKind }}
-    name: {{ $secretStoreRefName }}
+    kind: {{ $externalSecret.secretStoreRefKind | default $secretStoreRefKind }}
+    name: {{ $externalSecret.secretStoreRefName | default $secretStoreRefName  }}
   refreshInterval: "1m"
   target:
     name: {{ $externalSecret.secretName }}
@@ -37,15 +31,13 @@ spec:
         {{- else }}
         url: "{{`{{ .url }}`}}"
         {{- end }}
-        {{- if $useHttp }}
+        {{- if $externalSecret.useHttp | default $useHttp }}
         username: "{{`{{ .username }}`}}"
         password: "{{`{{ .password }}`}}"
-        {{- end }}
-        {{- if $usePrivateKey }}
+        {{- else if $externalSecret.usePrivateKey | default $usePrivateKey }}
         insecureIgnoreHostKey: "true"
         sshPrivateKey: "{{`{{ .private_key }}`}}"
-        {{- end }}
-        {{- if $useGitHubApp }}
+        {{- else if $externalSecret.useGitHubApp | default $useGitHubApp }}
         githubAppID: "{{`{{ .github_app_id }}`}}"
         githubAppInstallationID: "{{`{{ .github_app_installation_id }}`}}"
         githubAppPrivateKey:  "{{`{{ .github_private_key }}`}}"

charts/fleet-secret/values.yaml

@@ -1,11 +1,5 @@
 # Example of global values to append if we want to add more endpoints withough replciation
 global:
-  gitExternalSecrets:
-    useGitHubApp: true
-    secretStoreRefName: fleet-git-eks-secret-store
-    secretStoreRefKind: SecretStore
-    externalSecrets: {}
-
   # ecrAuthenticationToken:
   #   registry_endpoints:
   #     - 1234456698772.dkr.ecr.eu-west-2.amazonaws.com
@@ -23,6 +17,19 @@ gitExternalSecrets:
   secretStoreRefName: fleet-git-eks-secret-store
   secretStoreRefKind: SecretStore
   externalSecrets: {}
+  # We can overwrite above values on the cluster secret level
+  # Example:
+  # externalSecrets:
+  #   addons:
+  #     secretName: git-addons
+  #     secretManagerSecretName: shared/addons
+  #     secretType: repository
+  #   resources:
+  #     secretName: git-resources
+  #     secretStoreRefName: cluster-git-eks-secret-store
+  #     secretStoreRefKind: ClusterSecretStore
+  #     secretManagerSecretName: shared/resources
+  #     secretType: repository
 
 externalSecret:
   enabled: false