n0rad · n0rad · May 6, 2025 · May 6, 2025
diff --git a/base/ci/advanced-result.yaml b/base/ci/advanced-result.yaml
@@ -40,6 +40,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: main

diff --git a/base/ci/basic-result.yaml b/base/ci/basic-result.yaml
@@ -44,6 +44,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: main

diff --git a/base/ci/inferenceService-result.yaml b/base/ci/inferenceService-result.yaml
@@ -44,6 +44,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: main

diff --git a/base/ci/multiple-workloads-main-result.yaml b/base/ci/multiple-workloads-main-result.yaml
@@ -75,6 +75,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: main
@@ -91,6 +92,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-titi-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: titi

diff --git a/base/ci/multiple-workloads-result.yaml b/base/ci/multiple-workloads-result.yaml
@@ -75,6 +75,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-titi-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: titi
@@ -91,6 +92,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-toto-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: toto

diff --git a/base/ci/test-result.yaml b/base/ci/test-result.yaml
@@ -40,6 +40,7 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: release-name-sa-token
+  namespace: default
   labels:
     app: release-name
     app.kubernetes.io/component: main

diff --git a/base/schema/resources.json b/base/schema/resources.json
@@ -315,6 +315,18 @@
           "$ref": "resources/persistentVolumes.json#/instance"
         }
       }
+    },
+    "secrets": {
+      "title": "Render some secrets, indexed by an identifier",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": false,
+      "patternProperties": {
+        "^[0-9a-z-]*$": {
+          "title": "Identifier of the secret",
+          "$ref": "resources/secrets.json#/instance"
+        }
+      }
     }
   }
 }
diff --git a/base/schema/resources/secrets.json b/base/schema/resources/secrets.json
@@ -0,0 +1,40 @@
+{
+  "instance": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "enabled": {
+        "$ref": "../lib/utils.json#/enabled"
+      },
+      "annotations": {
+        "$ref": "../lib/k8s.json#/Annotations"
+      },
+      "labels": {
+        "$ref": "../lib/k8s.json#/Labels"
+      },
+      "namespace": {
+	"type": "string"
+      },
+      "nameOverride": {
+        "$ref": "../lib/utils.json#/nameOverride"
+      },
+      "type": {
+        "type": "string"
+      },
+      "stringData": {
+        "title": "Secret data as string",
+        "type": "object",
+        "additionalProperties": {
+          "type": "string"
+        }
+      },
+      "data": {
+        "title": "Secret data as base64 encoded",
+        "type": "object",
+        "additionalProperties": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}
diff --git a/base/templates/loader/_generate.tpl b/base/templates/loader/_generate.tpl
@@ -36,6 +36,7 @@ Secondary entrypoint and primary loader for the common chart
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "routes") | nindent 0 -}}
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "configMaps") | nindent 0 -}}
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "sealedSecrets") | nindent 0 -}}
+  {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "secrets") | nindent 0 -}}
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "networkPolicies") | nindent 0 -}}
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "podDisruptionBudgets") | nindent 0 -}}
   {{- include "base.lib.resource.renderResources" (dict "rootContext" $ "class" "horizontalPodAutoscalers") | nindent 0 -}}

diff --git a/base/templates/resources/pods/metadata/_annotations.tpl b/base/templates/resources/pods/metadata/_annotations.tpl
@@ -30,9 +30,23 @@ Returns the value for annotations
     -}}
   {{- end -}}
 
-  {{- /* Add Secrets checksum */ -}}
-  {{- $secretsFound := dict -}}
+  {{- /* Add SealedSecrets checksum */ -}}
+  {{- $sealedSecretsFound := dict -}}
   {{- range $name, $secret := $rootContext.Values.resources.sealedSecrets -}}
+    {{- if include "base.lib.utils.isEnabled" $secret -}}
+      {{- $_ := set $sealedSecretsFound $name (toYaml $secret.encryptedData | sha256sum) -}}
+    {{- end -}}
+  {{- end -}}
+  {{- if $sealedSecretsFound -}}
+    {{- $annotations = merge
+      (dict "checksum/sealedSecrets" (toYaml $sealedSecretsFound | sha256sum))
+      $annotations
+    -}}
+  {{- end -}}
+
+  {{- /* Add secrets checksum */ -}}
+  {{- $secretsFound := dict -}}
+  {{- range $name, $secret := $rootContext.Values.resources.secrets -}}
     {{- if include "base.lib.utils.isEnabled" $secret -}}
       {{- $_ := set $secretsFound $name (toYaml $secret.encryptedData | sha256sum) -}}
     {{- end -}}

diff --git a/base/templates/resources/sealedSecrets/pod_metadata_test.yaml b/base/templates/resources/sealedSecrets/pod_metadata_test.yaml
@@ -17,6 +17,6 @@ tests:
       value: Deployment
     asserts:
       - equal:
-          path: spec.template.metadata.annotations.checksum/secrets
+          path: spec.template.metadata.annotations.checksum/sealedSecrets
           value:
             afdf20f511621d5cb358c5e8b0da2d14cdbe2549fb12fa123f6a6e9baabef26e
diff --git a/base/templates/resources/secrets/_class.tpl b/base/templates/resources/secrets/_class.tpl
@@ -27,6 +27,7 @@ type: {{ . }}
 {{- end }}
 metadata:
   name: {{ $object.name }}
+  namespace: {{ default $rootContext.Release.Namespace $object.namespace }}
   {{- with $labels }}
   labels: {{- toYaml . | nindent 4 -}}
   {{- end }}

diff --git a/base/templates/resources/secrets/metadata_test.yaml b/base/templates/resources/secrets/metadata_test.yaml
@@ -0,0 +1,136 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
+suite: secrets metadata
+templates:
+  - base.yaml
+values:
+  - ../../../tests/overallValues.yaml
+tests:
+  - it: default metadata should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - notExists:
+          path: metadata.annotations
+      - equal:
+          path: metadata.labels
+          value:
+            app: RELEASE-NAME
+            app.kubernetes.io/component: secret
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: RELEASE-NAME
+            helm.sh/chart: base-template-0.0.0
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+
+  - it: Setting secret namepace should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            namespace: &namespace myFancyNamespace
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: *namespace
+
+  - it: custom metadata should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            annotations:
+              test_annotation: test
+            labels:
+              test_label: test
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            test_annotation: test
+      - equal:
+          path: metadata.labels
+          value:
+            app: RELEASE-NAME
+            app.kubernetes.io/component: secret
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: RELEASE-NAME
+            helm.sh/chart: base-template-0.0.0
+            test_label: test
+
+  - it: custom metadata with global metadata should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      global:
+        labels:
+          global_label: test
+        annotations:
+          global_annotation: test
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            annotations:
+              test_annotation: test
+            labels:
+              test_label: test
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            global_annotation: test
+            test_annotation: test
+      - equal:
+          path: metadata.labels
+          value:
+            app: RELEASE-NAME
+            app.kubernetes.io/component: secret
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: RELEASE-NAME
+            global_label: test
+            helm.sh/chart: base-template-0.0.0
+            test_label: test
+
+  - it: custom secret type should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            type: &type kubernetes.io/service-account-token
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: type
+          value: *type
diff --git a/base/templates/resources/secrets/names_test.yaml b/base/templates/resources/secrets/names_test.yaml
@@ -0,0 +1,88 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
+suite: secret names
+templates:
+  - base.yaml
+values:
+  - ../../../tests/overallValues.yaml
+tests:
+  - it: default should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+    asserts:
+      - containsDocument:
+          kind: Secret
+        not: true
+
+  - it: with disabled secret should pass
+    set:
+      resources.secrets.secret.enabled: false
+    asserts:
+      - containsDocument:
+          kind: Secret
+        not: true
+
+  - it: with multiple secrets should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            data: {}
+          secondary:
+            enabled: true
+            data: {}
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: RELEASE-NAME-secret
+        isKind:
+          of: Secret
+      - documentSelector:
+          path: metadata.name
+          value: RELEASE-NAME-secret
+        exists:
+          path: metadata.name
+      - documentSelector:
+          path: metadata.name
+          value: RELEASE-NAME-secondary
+        isKind:
+          of: Secret
+      - documentSelector:
+          path: metadata.name
+          value: RELEASE-NAME-secondary
+        exists:
+          path: metadata.name
+
+  - it: default name should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-secret
+
+  - it: with nameOverride should pass
+    set:
+      mainWorkload.serviceAccount.enabled: false
+      resources:
+        secrets:
+          secret:
+            enabled: true
+            nameOverride: http
+            data: {}
+    documentSelector:
+      path: kind
+      value: Secret
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-http