feat: allow for native package secret copying (#16)

## Description

This allows for secret copying to another namespace to align the
deployment pattern with PGO

## Related Issue

Relates to
defenseunicorns/uds-package-gitlab#150

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Checklist before merging

- [X] Test, docs, adr added or updated as needed
- [X] [Contributor Guide
Steps](https://github.com/defenseunicorns/uds-package-valkey/blob/main/CONTRIBUTING.md#developer-workflow)
followed

.github/workflows/tag-and-release.yaml

@@ -49,7 +49,7 @@ jobs:
           ghToken: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish Package
-        run: uds run -f tasks/publish.yaml package --set FLAVOR=${{ matrix.flavor }}
+        run: uds run -f tasks/publish.yaml package --set FLAVOR=${{ matrix.flavor }} --no-progress
 
       - name: Debug Output
         if: ${{ always() }}

.github/workflows/test.yaml

@@ -38,7 +38,7 @@ jobs:
     strategy:
       matrix:
         flavor: [upstream]
-        type: [install]
+        type: [install, upgrade]
 
     steps:
       - name: Checkout repository

bundle/uds-bundle.yaml

@@ -26,6 +26,12 @@ packages:
                     app: valkey-cli
                   port: 6379
                   description: "Ingress from Valkey CLI (for tests)"
+            - path: copyPassword
+              value:
+                enabled: true
+                namespace: valkey-cli
+                secretName: valkey
+                secretKey: valkey-password
         valkey:
           variables:
             - name: VALKEY_RESOURCES

chart/templates/password-secret.yaml

@@ -0,0 +1,18 @@
+{{- $password := randAlphaNum 16 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: valkey-password
+  namespace: {{ .Release.Namespace }}
+stringData:
+  valkey-password: {{ printf "%s" $password | quote }}
+{{- if .Values.copyPassword.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.copyPassword.secretName }}
+  namespace: {{ .Values.copyPassword.namespace }}
+stringData:
+  {{ dict .Values.copyPassword.secretKey $password | toYaml }}
+{{- end }}

chart/values.yaml

@@ -1 +1,7 @@
+copyPassword:
+  enabled: false
+  namespace: ""
+  secretName: ""
+  secretKey: ""
+
 custom: []

tests/valkey/uds-package.yaml

@@ -0,0 +1,16 @@
+apiVersion: uds.dev/v1alpha1
+kind: Package
+metadata:
+  name: valkey-cli
+  namespace: valkey-cli
+spec:
+  network:
+    allow:
+      - direction: Egress
+        selector:
+          app: valkey-cli
+        remoteNamespace: valkey
+        remoteSelector:
+          app.kubernetes.io/name: valkey
+        port: 6379
+        description: "Egress from Valkey CLI (for tests)"

tests/zarf.yaml

@@ -12,14 +12,14 @@ components:
       - name: valkey-cli
         namespace: valkey-cli
         files:
-          - valkey/namespace.yaml
+          - valkey/uds-package.yaml
           - valkey/valkey-cli.yaml
     images:
       - docker.io/bitnami/valkey:7.2.5-debian-12-r5
     actions:
       onDeploy:
         after:
-          - cmd: ./zarf tools kubectl get secret -n valkey valkey --template='{{ index .data "valkey-password" }}' | base64 -d
+          - cmd: ./zarf tools kubectl get secret -n valkey-cli valkey --template='{{ index .data "valkey-password" }}' | base64 -d
             mute: true
             setVariables:
               - name: VALKEY_PASSWORD

values/values.yaml

@@ -1 +1,5 @@
 architecture: standalone
+
+auth:
+  existingSecret: valkey-password
+  existingSecretPasswordKey: valkey-password