secrets example (#118)

* secrets example

* more commments

* buildifier

* use array for images

examples/secrets/BUILD.bazel

@@ -0,0 +1,29 @@
+load("@com_adobe_rules_gitops//gitops:defs.bzl", "k8s_deploy")
+
+# prepare two environments: it and mynamespace. Each environment will have its own secret
+# the secret with name secret-object-name is defined in the {it|mynamespace}/secrets/secret-object-name directories
+# the secret name is the name of the directory in the secrets directory
+# the secret key is the name of the file
+# the secret value is the content of the file
+#
+# WARNING: rules_gitops secrets are intended to use in tests and development only.
+# DO NOT USE THIS IN PRODUCTION!
+# the secret value is not encrypted. It is recommended to use a secret management tool like vault or gcp secret manager
+
+[
+    k8s_deploy(
+        name = ENV + "-server",
+        cluster = CLUSTER,
+        configmaps_renaming = "hash",  # add a hash to the configmap and secret names
+        images = [
+            "//helloworld:image",
+        ],
+        manifests = glob(["*.yaml"]),  # we will use deployment.yaml to demonstrate a secret injection
+        namespace = ENV,
+        secrets_srcs = glob([ENV + "/secrets/**/*"]),
+    )
+    for (ENV, CLUSTER) in [
+        ("it", "it-cluster"),
+        ("mynamespace", "dev-cluster"),
+    ]
+]

examples/secrets/deployment.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: helloworld
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: helloworld
+  template:
+    metadata:
+      labels:
+        app: helloworld
+    spec:
+      containers:
+        - name: helloworld
+          image: //helloworld:image
+          resources:
+            requests:
+              memory: 2Mi
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: secret-object-name # <- secret object name without hash suffix
+                  key: apikey

examples/secrets/it/secrets/secret-object-name/apikey

@@ -0,0 +1 @@
+IT test api key

examples/secrets/mynamespace/secrets/secret-object-name/apikey

@@ -0,0 +1 @@
+dev api key