Add support for Go templating

README.md

@@ -135,7 +135,18 @@ The objects field of the SecretProviderClass can contain the following sub-field
   ```
   If you use the jmesPath field,  you must provide the following two sub-fields:
   * path: This required field is the [JMES path](https://jmespath.org/specification.html) to use for retrieval
-  * objectAlias: This required field specifies the file name under which the key-value pair secret will be mounted. 
+  * objectAlias: This required field specifies the file name under which the key-value pair secret will be mounted.
+
+* objectTemplate: Tgus optional field specifies a Go template for transforming the JSON object containing all key-value secrets to a desired format. For example, to transform secrets into a format that can be sourced in bash:
+```
+    objects:  |
+      - objectName: "MySecret"
+        objectType: "secretsmanager"
+        objectTemplate: |
+          {{ range $k, $v := . }}export {{ $k }}={{ $v }}
+          {{ end }}
+
+```
 
 ## Additional Considerations
 

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/aws/aws-sdk-go v1.37.0
 	github.com/jmespath/go-jmespath v0.4.0
 	google.golang.org/grpc v1.35.0
-	gopkg.in/yaml.v2 v2.3.0
 	k8s.io/api v0.20.2
 	k8s.io/apimachinery v0.20.2
 	k8s.io/client-go v0.20.2

provider/secret_descriptor.go

@@ -36,6 +36,9 @@ type SecretDescriptor struct {
 	//Optional array to specify what json key value pairs to extract from a secret and mount as individual secrets
 	JMESPath []JMESPathEntry `json:"jmesPath"`
 
+	// Optional Go template to use for transforming the secret value
+	ObjectTemplate string `json:objectTemplate`
+
 	// Path translation character (not part of YAML spec).
 	translate string `json:"-"`
 

provider/secret_value.go

@@ -1,8 +1,11 @@
 package provider
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
+	"text/template"
+
 	"github.com/jmespath/go-jmespath"
 )
 
@@ -60,3 +63,29 @@ func (p *SecretValue) getJsonSecrets() (s []*SecretValue, e error) {
 	}
 	return jsonValues, nil
 }
+
+func (p *SecretValue) getTemplatedSecrets() (*SecretValue, error) {
+
+	var data interface{}
+	err := json.Unmarshal(p.Value, &data)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid JSON used with template in secret: %s", p.Descriptor.ObjectName)
+	}
+
+	objectTemplate := p.Descriptor.ObjectTemplate
+	t, err := template.New("secretTemplate").Parse(objectTemplate)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid template %s", objectTemplate)
+	}
+
+	var result bytes.Buffer
+	err = t.Execute(&result, data)
+	if err != nil {
+		return nil, err
+	}
+	secretValue := SecretValue{
+		Value:      result.Bytes(),
+		Descriptor: p.Descriptor,
+	}
+	return &secretValue, nil
+}

provider/secret_value_test.go

@@ -70,3 +70,68 @@ func TestInvalidJMESResultType(t *testing.T) {
 
 	RunGetJsonSecretTest(t, jsonContent, path, objectAlias, expectedErrorMessage)
 }
+
+func RunGetTemplatedSecrets(t *testing.T, jsonContent string, objectTemplate string) (*SecretValue, error) {
+	descriptor := SecretDescriptor{
+		ObjectName: TEST_OBJECT_NAME,
+		ObjectTemplate:  objectTemplate,
+	}
+
+	secretValue := SecretValue{
+		Value:      []byte(jsonContent),
+		Descriptor: descriptor,
+	}
+
+	secrets, err := secretValue.getTemplatedSecrets()
+
+	if err != nil {
+		return nil, err
+	}
+
+	return secrets, nil
+}
+func TestSecretsTemplateValidJSON(t *testing.T) {
+	jsonContent := `{"username": 3, "password": "abc"}`
+	template := `
+	{{ range $k, $v := . }}export {{ $k }}={{ $v }}
+	{{ end }}`
+	expectedResult := `
+	export password=abc
+	export username=3
+	`
+	secrets, err := RunGetTemplatedSecrets(t, jsonContent, template)
+	result := string(secrets.Value)
+	if err != nil {
+		t.Fatalf("Failed during template execution %v", err)
+	}
+
+	if result != expectedResult {
+		t.Fatalf("Templated result is not correct\n got: %s\n want: %s", result, expectedResult )
+	}
+}
+
+func TestSecretsTemplateInvalidJSON(t *testing.T) {
+	jsonContent := `{"username": 3`
+	template := `
+	{{ range $k, $v := . }}export {{ $k }}={{ $v }}
+	{{ end }}`
+	expectedErrorMessage := fmt.Sprintf("Invalid JSON used with template in secret: %s", TEST_OBJECT_NAME)
+	_, err := RunGetTemplatedSecrets(t, jsonContent, template)
+
+	if err == nil || err.Error() != expectedErrorMessage {
+		t.Fatalf("Expected error: %s, got error: %v", expectedErrorMessage, err)
+	}
+}
+
+func TestSecretsTemplateInvalidTemplate(t *testing.T) {
+	jsonContent := `{"username": 3}`
+	template := `
+	{ range $k, $v := . }}export {{ $k }}={{ $v }}
+	{{ end }}`
+	expectedErrorMessage := fmt.Sprintf("Invalid template %s", template)
+	_, err := RunGetTemplatedSecrets(t, jsonContent, template)
+
+	if err == nil || err.Error() != expectedErrorMessage {
+		t.Fatalf("Expected error: %s, got error: %v", expectedErrorMessage, err)
+	}
+}

provider/secrets_manager_provider.go

@@ -80,6 +80,15 @@ func (p *SecretsManagerProvider) GetSecretValues(
 
 		values = append(values, jsonSecrets...)
 
+		//Transform secrets using provided template
+		if secret.Descriptor.ObjectTemplate != "" {
+			templatedSecrets, err := secret.getTemplatedSecrets()
+			if err != nil {
+				return nil, err
+			}
+			values = append(values, templatedSecrets)
+		}
+
 		// Update the version in the current version map.
 		for _, jsonSecret := range jsonSecrets {
 			jsonDescriptor := jsonSecret.Descriptor