Add Recursive Secret Discovery, Combining Secrets, and Key Normalization

[perestoronin]

Add Recursive Secret Discovery, Combining Secrets, and Key Normalization

Overview

This PR introduces:

1. Recursive Secret Discovery: List secrets under a specified Vault root path.
2. Combine Secrets: Merge multiple secrets into one Kubernetes Secret.
3. Key Normalization: Convert keys to SCREAMING_SNAKE_CASE.

These features are optional and backward-compatible.

---

Key Changes

1. CRD Updates

New fields added under syncConfig:

• vaultRootPath (optional): Root path for recursive discovery.
• combineSecrets (default: true): Combine secrets into one.
• normalizeToScreamingCase (default: true): Normalize keys.

Example:

syncConfig: vaultRootPath: "secret/data/my-app" combineSecrets: true normalizeToScreamingCase: true

---

Features

Recursive Secret Discovery

Performs a LIST request on the specified vaultRootPath.

Example:

secrets, err := listVaultSecrets(vaultClient, vss.Spec.SyncConfig.VaultRootPath)

Combine Secrets

Merges secrets into a single map if combineSecrets = true.

Example:

combinedData, err := processCombinedSecrets(ctx, vaultClient, secrets, true)

Key Normalization

Normalizes keys to SCREAMING_SNAKE_CASE using strcase.ToScreamingSnake.

Example:

normalizedKey := strcase.ToScreamingSnake(key)

---

Usage Examples

Combined Secrets

syncConfig: vaultRootPath: "secret/data/my-app" combineSecrets: true normalizeToScreamingCase: true

Individual Secrets

syncConfig: vaultRootPath: "secret/data/my-app" combineSecrets: false normalizeToScreamingCase: true

---

Backward Compatibility

• Existing configurations without syncConfig remain unaffected.
• New features are optional and require explicit configuration.

Conclusion

This PR enhances VSO with recursive secret discovery, combining secrets, and key normalization while maintaining backward compatibility. Feedback is welcome!

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}