Skip to content

feat: support for workflows #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gusfcarvalho merged 3 commits into from
Aug 29, 2025
Merged

feat: support for workflows #138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8e4fcf8
feat: support for workflows
Aug 29, 2025
8a9b682
feat: support workflowruntemplates as destinations
Aug 29, 2025
4d85403
fix: nolint
Aug 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions api/v1alpha1/destination_workflowruntemplate_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
package v1alpha1

import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

// Defines a WorkflowRunTemplateDestination. Behavior is an annotations patch.
// Default UpdateStrategy is annotations patch to trigger Workflow reconcile.
// Default MatchStrategy is matching secret-key with any of:
// * Equality against `spec.data.remoteRef.key`
// * Equality against `spec.dataFrom.remoteRef.key`
// * Regexp against `spec.dataFrom.find.name.regexp`
type WorkflowRunTemplateDestination struct {
// NamespaceSelectors selects namespaces based on labels.
// The manifest must reside in a namespace that matches at least one of these selectors.
// +optional
NamespaceSelectors []metav1.LabelSelector `json:"namespaceSelectors,omitempty"`

// LabelSelectors selects resources based on their labels.
// The resource must satisfy all conditions defined in this selector.
// Supports both matchLabels and matchExpressions for advanced filtering.
// +optional
LabelSelectors *metav1.LabelSelector `json:"labelSelectors,omitempty"`

// Names specifies a list of resource names to watch.
// The resource must have a name that matches one of these entries.
// +optional
Names []string `json:"names,omitempty"`
}
4 changes: 3 additions & 1 deletion api/v1alpha1/reloader_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,9 +76,11 @@ type NotificationSource struct {
type DestinationToWatch struct {
// Type specifies the type of destination to watch.
// +required
// +kubebuilder:validation:Enum=ExternalSecret;Deployment;PushSecret
// +kubebuilder:validation:Enum=ExternalSecret;Deployment;PushSecret;WorkflowRunTemplate
Type string `json:"type"`
// +optional
WorkflowRunTemplate *WorkflowRunTemplateDestination `json:"workflowRunTemplate,omitempty"`
// +optional
ExternalSecret *ExternalSecretDestination `json:"externalSecret,omitempty"`
// +optional
PushSecret *PushSecretDestination `json:"pushSecret,omitempty"`
Expand Down
37 changes: 37 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

121 changes: 121 additions & 0 deletions config/crd/bases/reloader.external-secrets.io_configs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -428,6 +428,7 @@ spec:
- ExternalSecret
- Deployment
- PushSecret
- WorkflowRunTemplate
type: string
updateStrategy:
description: UpdateStrategy. If not specified, will use each
Expand Down Expand Up @@ -491,6 +492,126 @@ spec:
the next object
type: string
type: object
workflowRunTemplate:
description: |-
Defines a WorkflowRunTemplateDestination. Behavior is an annotations patch.
Default UpdateStrategy is annotations patch to trigger Workflow reconcile.
Default MatchStrategy is matching secret-key with any of:
* Equality against `spec.data.remoteRef.key`
* Equality against `spec.dataFrom.remoteRef.key`
* Regexp against `spec.dataFrom.find.name.regexp`
properties:
labelSelectors:
description: |-
LabelSelectors selects resources based on their labels.
The resource must satisfy all conditions defined in this selector.
Supports both matchLabels and matchExpressions for advanced filtering.
properties:
matchExpressions:
description: matchExpressions is a list of label selector
requirements. The requirements are ANDed.
items:
description: |-
A label selector requirement is a selector that contains values, a key, and an operator that
relates the key and values.
properties:
key:
description: key is the label key that the selector
applies to.
type: string
operator:
description: |-
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: |-
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
description: |-
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
x-kubernetes-map-type: atomic
names:
description: |-
Names specifies a list of resource names to watch.
The resource must have a name that matches one of these entries.
items:
type: string
type: array
namespaceSelectors:
description: |-
NamespaceSelectors selects namespaces based on labels.
The manifest must reside in a namespace that matches at least one of these selectors.
items:
description: |-
A label selector is a label query over a set of resources. The result of matchLabels and
matchExpressions are ANDed. An empty label selector matches all objects. A null
label selector matches no objects.
properties:
matchExpressions:
description: matchExpressions is a list of label selector
requirements. The requirements are ANDed.
items:
description: |-
A label selector requirement is a selector that contains values, a key, and an operator that
relates the key and values.
properties:
key:
description: key is the label key that the selector
applies to.
type: string
operator:
description: |-
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: |-
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
description: |-
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
x-kubernetes-map-type: atomic
type: array
type: object
required:
- type
type: object
Expand Down
10 changes: 10 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,3 +59,13 @@ rules:
- configs/finalizers
verbs:
- update
- apiGroups:
- workflows.external-secrets.io
resources:
- workflowruntemplates
verbs:
- get
- list
- patch
- update
- watch
1 change: 1 addition & 0 deletions internal/controller/reloader_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ func (r *ReloaderReconciler) SetupWithManager(mgr ctrl.Manager) error {
// +kubebuilder:rbac:groups=reloader.external-secrets.io,resources=configs/finalizers,verbs=update
// For k8s ExternalSecrets and PushSecrets destination
// +kubebuilder:rbac:groups=external-secrets.io,resources=externalsecrets;pushsecrets,verbs=get;list;watch;update;patch
// +kubebuilder:rbac:groups=workflows.external-secrets.io,resources=workflowruntemplates,verbs=get;list;watch;update;patch
// For k8s Deployments destination
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch
// +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;create;update;patch
Expand Down
1 change: 1 addition & 0 deletions internal/handler/register.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,5 @@ import (
_ "github.com/external-secrets-inc/reloader/internal/handler/deployment"
_ "github.com/external-secrets-inc/reloader/internal/handler/externalsecret"
_ "github.com/external-secrets-inc/reloader/internal/handler/pushsecret"
_ "github.com/external-secrets-inc/reloader/internal/handler/workflow"
)
1 change: 1 addition & 0 deletions internal/handler/schema/schema.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ const (
EXTERNAL_SECRET = "ExternalSecret"
PUSH_SECRET = "PushSecret"
DEPLOYMENT = "Deployment"
WORKFLOW = "WorkflowRunTemplate"
)

type ApplyFn func(obj client.Object, event events.SecretRotationEvent) error
Expand Down
Loading
Loading