feat: add external secret store api and interface

pkg/apis/secrets/types.go

@@ -0,0 +1,33 @@
+package secrets
+
+// SecretStoreSpec contains configuration to describe target secret store.
+type SecretStoreSpec struct {
+	Provider *ProviderSpec `yaml:"provider" json:"provider"`
+}
+
+// ProviderSpec contains provider-specific configuration.
+type ProviderSpec struct {
+	// AWS configures a store to retrieve secrets from AWS Secrets Manager.
+	AWS *AWSProvider `yaml:"aws,omitempty" json:"aws,omitempty"`
+	// Vault configures a store to retrieve secrets from HashiCorp Vault.
+	Vault *VaultProvider `yaml:"vault,omitempty" json:"vault,omitempty"`
+}
+
+// AWSProvider configures a store to retrieve secrets from AWS Secrets Manager.
+type AWSProvider struct {
+	// AWS Region to be used to interact with AWS Secrets Manager.
+	// Examples are us-east-1, us-west-2, etc.
+	Region string `yaml:"region" json:"region"`
+	// The profile to be used to interact with AWS Secrets Manager.
+	// If not set, the default profile created with `aws configure` will be used.
+	Profile string `yaml:"profile,omitempty" json:"profile,omitempty"`
+}
+
+// VaultProvider configures a store to retrieve secrets from HashiCorp Vault.
+type VaultProvider struct {
+	// Server is the target Vault server address to connect, e.g: "https://vault.example.com:8200".
+	Server string `yaml:"server" json:"server"`
+
+	// Path is the mount path of the Vault KV backend endpoint, e.g: "secret".
+	Path string `yaml:"path,omitempty" json:"path,omitempty"`
+}

pkg/secrets/interface.go

@@ -0,0 +1,21 @@
+package secrets
+
+import (
+	"context"
+
+	secretsapi "kusionstack.io/kusion/pkg/apis/secrets"
+)
+
+// SecretStore provides the interface to interact with various cloud secret manager.
+type SecretStore interface {
+	// GetSecret retrieves ref secret from various cloud secret manager.
+	GetSecret(ctx context.Context, ref string) ([]byte, error)
+}
+
+// SecretStoreProvider is a factory type for secret store.
+type SecretStoreProvider interface {
+	// Type returns a string that reflects the type of this provider.
+	Type() string
+	// NewSecretStore constructs a usable secret store with specific provider spec.
+	NewSecretStore(spec *secretsapi.SecretStoreSpec) (SecretStore, error)
+}