feat: support override IAM endpoint in IBM provider for APIkey auth (#5550)

* feat: support override IAM endpoint in IBM provider for APIkey auth

Issues: external-secrets/external-secrets/issues/2963

Signed-off-by: Fidel Ruiz <fidelruiz1617@gmail.com>

* feat: support override IAM endpoint in IBM provider for APIkey auth

Issues: external-secrets/external-secrets/issues/2963

Signed-off-by: Fidel Ruiz <fidelruiz1617@gmail.com>

* run make check-diff

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>

---------

Signed-off-by: Fidel Ruiz <fidelruiz1617@gmail.com>
Co-authored-by: Fidel Ruiz <fidel.ruiz@ibm.com>
Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
Co-authored-by: Gergely Brautigam <skarlso777@gmail.com>

apis/externalsecrets/v1/secretstore_ibm_types.go

@@ -42,6 +42,9 @@ type IBMAuth struct {
 type IBMAuthSecretRef struct {
 	// The SecretAccessKey is used for authentication
 	SecretAPIKey esmeta.SecretKeySelector `json:"secretApiKeySecretRef,omitempty"`
+
+	// The IAM endpoint used to obain a token
+	IAMEndpoint string `json:"iamEndpoint,omitempty"`
 }
 
 // IBMAuthContainerAuth defines container-based authentication with IAM Trusted Profile.

config/crds/bases/external-secrets.io_clustersecretstores.yaml

@@ -2320,6 +2320,9 @@ spec:
                             description: IBMAuthSecretRef contains the secret reference
                               for IBM Cloud API key authentication.
                             properties:
+                              iamEndpoint:
+                                description: The IAM endpoint used to obain a token
+                                type: string
                               secretApiKeySecretRef:
                                 description: The SecretAccessKey is used for authentication
                                 properties:

config/crds/bases/external-secrets.io_secretstores.yaml

@@ -2320,6 +2320,9 @@ spec:
                             description: IBMAuthSecretRef contains the secret reference
                               for IBM Cloud API key authentication.
                             properties:
+                              iamEndpoint:
+                                description: The IAM endpoint used to obain a token
+                                type: string
                               secretApiKeySecretRef:
                                 description: The SecretAccessKey is used for authentication
                                 properties:

deploy/crds/bundle.yaml

@@ -4238,6 +4238,9 @@ spec:
                             secretRef:
                               description: IBMAuthSecretRef contains the secret reference for IBM Cloud API key authentication.
                               properties:
+                                iamEndpoint:
+                                  description: The IAM endpoint used to obain a token
+                                  type: string
                                 secretApiKeySecretRef:
                                   description: The SecretAccessKey is used for authentication
                                   properties:
@@ -15551,6 +15554,9 @@ spec:
                             secretRef:
                               description: IBMAuthSecretRef contains the secret reference for IBM Cloud API key authentication.
                               properties:
+                                iamEndpoint:
+                                  description: The IAM endpoint used to obain a token
+                                  type: string
                                 secretApiKeySecretRef:
                                   description: The SecretAccessKey is used for authentication
                                   properties:

docs/api/spec.md

@@ -6113,6 +6113,17 @@ External Secrets meta/v1.SecretKeySelector
 <p>The SecretAccessKey is used for authentication</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>iamEndpoint</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>The IAM endpoint used to obain a token</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="external-secrets.io/v1.IBMProvider">IBMProvider

docs/snippets/ibm-secret-store.yaml

@@ -15,3 +15,4 @@ spec:
           secretApiKeySecretRef:
             name: ibm-secret
             key: apiKey
+          iamEndpoint: "https://iam.cloud.ibm.com"

providers/v1/ibm/provider.go

@@ -62,6 +62,8 @@ const (
 	errNotImplemented           = "not implemented"
 	errKeyDoesNotExist          = "key %s does not exist in secret %s"
 	errFieldIsEmpty             = "warn: %s is empty for secret %s\n"
+
+	iamDefaultEndpoint = "https://iam.cloud.ibm.com"
 )
 
 var contextTimeout = time.Minute * 2
@@ -666,7 +668,7 @@ func (ibm *providerIBM) NewClient(ctx context.Context, store esv1.GenericStore,
 		}
 		if containerAuthEndpoint == "" {
 			// API default path
-			containerAuthEndpoint = "https://iam.cloud.ibm.com"
+			containerAuthEndpoint = iamDefaultEndpoint
 		}
 
 		authenticator, err := core.NewContainerAuthenticatorBuilder().
@@ -690,10 +692,16 @@ func (ibm *providerIBM) NewClient(ctx context.Context, store esv1.GenericStore,
 			return nil, err
 		}
 
+		iamEndpoint := iStore.store.Auth.SecretRef.IAMEndpoint
+		if iamEndpoint == "" {
+			// API default path
+			iamEndpoint = iamDefaultEndpoint
+		}
 		secretsManager, err = sm.NewSecretsManagerV2(&sm.SecretsManagerV2Options{
 			URL: *storeSpec.Provider.IBM.ServiceURL,
 			Authenticator: &core.IamAuthenticator{
 				ApiKey: string(iStore.credentials),
+				URL:    iamEndpoint,
 			},
 		})
 	}

providers/v1/ibm/provider_test.go

@@ -178,6 +178,7 @@ func TestValidateStore(t *testing.T) {
 			Key:       "bar",
 			Namespace: &ns,
 		},
+		IAMEndpoint: "https://iam.cloud.ibm.com",
 	}
 	_, err = p.ValidateStore(store)
 	if err == nil {

tests/__snapshot__/clustersecretstore-v1.yaml

@@ -358,6 +358,7 @@ spec:
           profile: string
           tokenLocation: string
         secretRef:
+          iamEndpoint: string
           secretApiKeySecretRef:
             key: string
             name: string

tests/__snapshot__/secretstore-v1.yaml

@@ -358,6 +358,7 @@ spec:
           profile: string
           tokenLocation: string
         secretRef:
+          iamEndpoint: string
           secretApiKeySecretRef:
             key: string
             name: string