@firestartr/cli 1.50.0-snapshot-1 → 1.50.0-snapshot-2

package/build/index.js

@@ -302525,94 +302525,116 @@ const ArgoCDSchemas = [argocd_schema];
     $schema: SCHEMA,
     $id: 'ExternalSecretsProvider',
     definitions: {
+        SecretStore: {
+            $id: 'firestartr.dev://secrets/SecretStore',
+            type: 'object',
+            properties: {
+                name: { type: 'string' },
+                kind: {
+                    type: 'string',
+                    enum: ['SecretStore', 'ClusterSecretStore'],
+                },
+            },
+            required: ['name'],
+        },
+        ExternalSecretsSection: {
+            $id: 'firestartr.dev://secrets/ExternalSecretsSection',
+            type: 'object',
+            properties: {
+                refreshInterval: { type: 'string' },
+                secrets: {
+                    type: 'array',
+                    items: {
+                        additionalProperties: false,
+                        type: 'object',
+                        properties: {
+                            secretName: { type: 'string' },
+                            remoteRef: { type: 'string' },
+                        },
+                        required: ['secretName'],
+                    },
+                },
+            },
+        },
+        PushSecretsSection: {
+            $id: 'firestartr.dev://secrets/PushSecretsSection',
+            type: 'array',
+            items: {
+                type: 'object',
+                properties: {
+                    data: { type: 'object' },
+                    template: { type: 'object' },
+                    secretName: { type: 'string' },
+                    refreshInterval: { type: 'string' },
+                    generator: {
+                        type: 'object',
+                        properties: {
+                            name: { type: 'string' },
+                            kind: {
+                                type: 'string',
+                                enum: [
+                                    'ACRAccessToken',
+                                    'ClusterGenerator',
+                                    'ECRAuthorizationToken',
+                                    'Fake',
+                                    'GCRAccessToken',
+                                    'GithubAccessToken',
+                                    'QuayAccessToken',
+                                    'Password',
+                                    'STSSessionToken',
+                                    'UUID',
+                                    'VaultDynamicSecret',
+                                    'Webhook',
+                                    'Grafana',
+                                ],
+                            },
+                            apiVersion: {
+                                type: 'string',
+                            },
+                            conversionStrategy: {
+                                type: 'string',
+                            },
+                            outputKey: {
+                                type: 'string',
+                            },
+                        },
+                        required: ['name'],
+                    },
+                },
+                required: ['secretName', 'generator'],
+            },
+        },
         ExternalSecretsProvider: {
             $id: 'firestartr.dev://secrets/ExternalSecretsProvider',
             type: 'object',
             description: 'A external secrets claim provider',
             allOf: [
+                { $ref: 'firestartr.dev://common/ClaimProviderEnvelope' },
                 {
-                    $ref: 'firestartr.dev://common/ClaimProviderEnvelope',
-                },
-                {
-                    type: 'object',
-                    properties: {
-                        secretStore: {
-                            type: 'object',
+                    anyOf: [
+                        {
                             properties: {
-                                name: { type: 'string' },
-                                kind: {
-                                    type: 'string',
-                                    enum: ['SecretStore', 'ClusterSecretStore'],
+                                externalSecrets: {
+                                    $ref: 'firestartr.dev://secrets/ExternalSecretsSection',
                                 },
-                            },
-                            required: ['name'],
-                        },
-                        pushSecrets: {
-                            type: 'array',
-                            items: {
-                                type: 'object',
-                                properties: {
-                                    data: { type: 'object' },
-                                    template: { type: 'object' },
-                                    secretName: { type: 'string' },
-                                    refreshInterval: { type: 'string' },
-                                    generator: {
-                                        type: 'object',
-                                        properties: {
-                                            name: { type: 'string' },
-                                            kind: {
-                                                type: 'string',
-                                                enum: [
-                                                    'ACRAccessToken',
-                                                    'ClusterGenerator',
-                                                    'ECRAuthorizationToken',
-                                                    'Fake',
-                                                    'GCRAccessToken',
-                                                    'GithubAccessToken',
-                                                    'QuayAccessToken',
-                                                    'Password',
-                                                    'STSSessionToken',
-                                                    'UUID',
-                                                    'VaultDynamicSecret',
-                                                    'Webhook',
-                                                    'Grafana',
-                                                ],
-                                            },
-                                            apiVersion: {
-                                                type: 'string',
-                                            },
-                                            conversionStrategy: {
-                                                type: 'string',
-                                            },
-                                            outputKey: {
-                                                type: 'string',
-                                            },
-                                        },
-                                        required: ['name'],
-                                    },
+                                secretStore: {
+                                    $ref: 'firestartr.dev://secrets/SecretStore',
                                 },
-                                required: ['secretName', 'generator'],
                             },
+                            required: ['secretStore', 'externalSecrets'],
                         },
-                        externalSecrets: {
-                            type: 'object',
+                        {
                             properties: {
-                                refreshInterval: { type: 'string' },
-                                secrets: {
-                                    type: 'array',
-                                    items: {
-                                        additionalProperties: false,
-                                        type: 'object',
-                                        properties: {
-                                            secretName: { type: 'string' },
-                                        },
-                                        required: ['secretName'],
-                                    },
+                                pushSecrets: {
+                                    $ref: 'firestartr.dev://secrets/PushSecretsSection',
+                                },
+                                secretStore: {
+                                    $ref: 'firestartr.dev://secrets/SecretStore',
                                 },
                             },
+                            required: ['secretStore', 'pushSecrets'],
                         },
-                    },
-                    required: ['secretStore'],
+                    ],
                 },
             ],
         },
@@ -303313,15 +303335,19 @@ function validatePermissionsUniqueness(crs) {
             const permissions = cr.spec.permissions;
             cdk8s_renderer_src_logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
             if (permissions) {
-                const seen = new Set();
+                const rolesByIdentifier = new Map();
                 for (const perm of permissions) {
                     const identifier = perm.collaborator
                         ? perm.collaborator
                         : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    if (seen.has(identifier)) {
-                        throw new Error(`Duplicate permission reference found in FirestartrGithubRepository ${crkey}: ${identifier}\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
                     }
-                    seen.add(identifier);
                 }
             }
         }
@@ -308590,12 +308616,12 @@ class SecretsChart extends BaseSecretsChart {
     gvk() {
         return {
             kind: 'ExternalSecret/PushSecret',
-            apiVersion: 'external-secrets.io/v1alpha1',
+            apiVersion: 'external-secrets.io/v1',
         };
     }
     extraCharts() {
-        const externalSecrets = this.get('pushSecrets');
-        const pushSecrets = this.get('externalSecrets');
+        const externalSecrets = this.get('externalSecrets');
+        const pushSecrets = this.get('pushSecrets');
         const kind = this.get('claim').kind;
         const name = this.get('claim').name;
         const concatenated = externalSecrets
@@ -308627,12 +308653,12 @@ class SecretsChart extends BaseSecretsChart {
             refsData.push({
                 secretKey: secret.secretName,
                 remoteRef: {
-                    key: secret.secretName,
+                    key: secret.remoteRef ? secret.remoteRef : secret.secretName,
                 },
             });
         }
         const k8sResource = {
-            apiVersion: 'external-secrets.io/v1alpha1',
+            apiVersion: 'external-secrets.io/v1',
             kind: 'ExternalSecret',
             metadata: {
                 name: catalog_common.generic.normalizeName(claim.name),
@@ -308652,12 +308678,6 @@ class SecretsChart extends BaseSecretsChart {
                     name: catalog_common.generic.normalizeName(claim.name),
                     creationPolicy: 'Owner',
                     deletionPolicy: 'Delete',
-                    template: {
-                        engineVersion: 'v2',
-                        metadata: {
-                            data: templateData,
-                        },
-                    },
                 },
                 data: refsData,
             },
@@ -308679,7 +308699,7 @@ class SecretsChart extends BaseSecretsChart {
         }
         for (const pushSecret of pushSecretsFromClaim) {
             const k8sResource = {
-                apiVersion: 'external-secrets.io/v1alpha1',
+                apiVersion: 'external-secrets.io/v1',
                 kind: 'PushSecret',
                 metadata: {
                     name: catalog_common.generic.normalizeName(`${pushSecret.secretName}-${claim.name}`),
@@ -308702,7 +308722,7 @@ class SecretsChart extends BaseSecretsChart {
                     selector: {
                         generatorRef: {
                             apiVersion: pushSecret.generator?.apiVersion ||
-                                'generators.external-secrets.io/v1alpha1',
+                                'generators.external-secrets.io/v1',
                             kind: pushSecret.generator?.kind || 'Password',
                             name: pushSecret.generator.name,
                         },
@@ -308944,6 +308964,52 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
     };
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crossReferences.ts
+const IS_COMPONENT_CLAIM_REF = new RegExp(/^ComponentClaim-/);
+function validateSubReferences(renderClaims) {
+    for (const ref of Object.keys(renderClaims)) {
+        if (IS_COMPONENT_CLAIM_REF.test(ref))
+            validateClaimsSecretsRefs(ref, renderClaims);
+    }
+}
+function validateClaimsSecretsRefs(ref, renderClaims) {
+    const claim = renderClaims[ref].claim;
+    const secrets = claim.providers.github.secrets;
+    if (!secrets) {
+        return;
+    }
+    for (const section of ['actions', 'codespaces', 'copilot']) {
+        const secretsSection = secrets[section];
+        if (!secretsSection) {
+            continue;
+        }
+        for (const secret of secretsSection) {
+            const [secretName, key] = secret.value.split(':').slice(2);
+            const keyFound = searchSecretKey(renderClaims[`SecretsClaim-${secretName}`].claim, key);
+            if (!keyFound) {
+                throw new Error(`CrossReference error: ComponentClaim/${claim.name} references a secret key inexistent: '${secretName}/${key}'`);
+            }
+        }
+    }
+}
+function searchSecretKey(secretClaim, key) {
+    let found = false;
+    if ('pushSecrets' in secretClaim.providers['external_secrets']) {
+        found =
+            secretClaim.providers['external_secrets'].pushSecrets.find((secret) => {
+                return secret.secretName === key;
+            }) !== undefined;
+    }
+    if (!found &&
+        'externalSecrets' in secretClaim.providers['external_secrets']) {
+        found =
+            secretClaim.providers['external_secrets'].externalSecrets.secrets.find((secret) => {
+                return secret.secretName === key;
+            }) !== undefined;
+    }
+    return found;
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -308951,6 +309017,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -308966,6 +309033,7 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     const data = await loadClaimsList(claimList);
     const result = await renderClaims(catalogScope, firestartrScope, data);
     try {
+        validateSubReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
@@ -312731,7 +312799,7 @@ async function provisionRepositorySecrets(scope, repo, fsGithubRepository) {
         for (const section of sections) {
             if (section in secrets) {
                 for (const secret of secrets[section]) {
-                    await provisionRepositorySecret(scope, fsGithubRepository, section, secret.name, secret.ref);
+                    await provisionRepositorySecret(scope, fsGithubRepository, section, secret.name, secret.ref, repo);
                 }
             }
         }
@@ -312740,7 +312808,7 @@ async function provisionRepositorySecrets(scope, repo, fsGithubRepository) {
         provisioner_src_logger.info(`FirestartrGithubRepository ${fsGithubRepository.metadata.name} does not have a secrets section`);
     }
 }
-async function provisionRepositorySecret(scope, repo, section, repoSecretName, secretRef) {
+async function provisionRepositorySecret(scope, repo, section, repoSecretName, secretRef, repoResource) {
     provisioner_src_logger.info(`Provisioning repo secret ${repo.metadata.name}/${section}/${repoSecretName}`);
     const secretClass = section === 'actions'
         ? actions_secret/* ActionsSecret */.N
@@ -312750,19 +312818,42 @@ async function provisionRepositorySecret(scope, repo, section, repoSecretName, s
                 ? dependabot_secret/* DependabotSecret */.c
                 : null;
     if (secretClass) {
-        const { key_id, encrypted_value } = await encryptSecret(repo, secretRef);
-        const resourceKey = `${section}-${repoSecretName.toLowerCase()}-secret`;
-        const tfStateKey = `_${repo.getTfStateKey()}-${resourceKey}`;
-        const sc = new secretClass(scope, tfStateKey, {
-            secretName: repoSecretName,
-            repository: repo.metadata.name,
-            encryptedValue: encrypted_value,
-        });
-        provisioner_src_logger.info(tfStateKey);
-        repo.addResourceToStack(resourceKey, sc);
+        const fSecretCreation = process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']
+            ? createUnencryptedSecret
+            : createEncryptedSecrect;
+        await fSecretCreation(scope, repo, secretRef, secretClass, section, repoSecretName, repoResource);
         provisioner_src_logger.info(`RepoSecret provisioned ${section}-${repoSecretName.toLowerCase()}-secret`);
     }
 }
+async function createEncryptedSecrect(scope, repo, secretRef, secretClass, section, repoSecretName, repoResource) {
+    const { key_id, encrypted_value } = await encryptSecret(repo, secretRef);
+    const resourceKey = `${section}-${repoSecretName.toLowerCase()}-secret`;
+    const tfStateKey = `_${repo.getTfStateKey()}-${resourceKey}`;
+    const sc = new secretClass(scope, tfStateKey, {
+        secretName: repoSecretName,
+        repository: repo.metadata.name,
+        encryptedValue: encrypted_value,
+        dependsOn: [repoResource],
+    });
+    provisioner_src_logger.info(tfStateKey);
+    repo.addResourceToStack(resourceKey, sc);
+}
+async function createUnencryptedSecret(scope, repo, secretRef, secretClass, section, repoSecretName, repoResource) {
+    const plainTextSecret = repo.resolveSecretRef({
+        name: secretRef.name,
+        key: secretRef.key,
+    });
+    const resourceKey = `${section}-${repoSecretName.toLowerCase()}-secret`;
+    const tfStateKey = `_${repo.getTfStateKey()}-${resourceKey}`;
+    const sc = new secretClass(scope, tfStateKey, {
+        secretName: repoSecretName,
+        plaintextValue: plainTextSecret,
+        repository: repo.metadata.name,
+        dependsOn: [repoResource],
+    });
+    provisioner_src_logger.info(tfStateKey);
+    repo.addResourceToStack(resourceKey, sc);
+}
 async function encryptSecret(repo, secretRef) {
     const plainTextSecret = repo.resolveSecretRef({
         name: secretRef.name,
@@ -312792,7 +312883,7 @@ async function provisionRepositoryVariables(scope, repo, fsGithubRepository) {
                             key: repoVar.ref.key,
                         });
                     }
-                    await provisionRepositoryVar(scope, fsGithubRepository, section, repoVar.name, plainTextSecret ? plainTextSecret : repoVar.value);
+                    await provisionRepositoryVar(scope, fsGithubRepository, section, repoVar.name, plainTextSecret ? plainTextSecret : repoVar.value, repo);
                 }
             }
         }
@@ -312801,7 +312892,7 @@ async function provisionRepositoryVariables(scope, repo, fsGithubRepository) {
         //  log.info(`FirestartrGithubRepository ${fsGithubRepository.metadata.name} does not have a vars section`)
     }
 }
-async function provisionRepositoryVar(scope, repo, section, repoVarName, value) {
+async function provisionRepositoryVar(scope, repo, section, repoVarName, value, repoResource) {
     provisioner_src_logger.info(`Provisioning repo var ${repo.metadata.name}/${section}/${repoVarName}`);
     const varClass = section === 'actions' ? actions_variable/* ActionsVariable */.m : null;
     if (varClass) {
@@ -312811,6 +312902,7 @@ async function provisionRepositoryVar(scope, repo, section, repoVarName, value)
             variableName: repoVarName,
             repository: repo.metadata.name,
             value,
+            dependsOn: [repoResource],
         });
         provisioner_src_logger.info(tfStateKey);
         repo.addResourceToStack(resourceKey, sc);
@@ -313538,18 +313630,13 @@ async function runTerraform(entity, command, stream) {
         ? '/library/packages/provisioner'
         : '/library/provisioner', 'cdktf.out', 'stacks', entityID);
     provisioner_src_logger.info(`Running terraform with command ${command} in ${workDir}`);
+    // filter environment variables to exclude those starting with 'GITHUB'
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GITHUB')));
     return new Promise((ok, ko) => {
         const terraformProcess = (0,external_child_process_.spawn)('terraform', [...command], {
             stdio: ['inherit', 'pipe', 'pipe'],
             cwd: workDir,
-            env: {
-                PATH: process.env.PATH,
-                ORG: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.org),
-                TOKEN: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.token),
-                KUBERNETES_SERVICE_HOST: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.kubernetesServiceHost),
-                KUBERNETES_SERVICE_PORT: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.kubernetesServicePort),
-                CDKTF_LOG_LEVEL: 'DEBUG',
-            },
+            env,
         });
         let output = '';
         terraformProcess.stdout.on('data', (log) => {
@@ -314255,7 +314342,7 @@ ${commentContent}
         }
     }
     catch (e) {
-        operator_src_logger.error(`An error occurred while publishing user feedback for item '${item.kind}/${item.metadata.name}' on pull request '${lastPr.number}': '${e}'.`);
+        operator_src_logger.error(`An error occurred while publishing user feedback for item '${item.kind}/${item.metadata.name}': '${e}'.`);
     }
 }
 async function publishApply(item, applyOutput, kind) {
@@ -315697,38 +315784,48 @@ async function* errorPolicyCompatibility(syncPolicy, generalPolicy, item, op) {
 
 ;// CONCATENATED MODULE: ../operator/src/user-feedback-ops/tf-checkrun.ts
 
+
 async function TFCheckRun(cmd, item) {
-    const prInfo = tf_checkrun_extractPrInfo(item);
-    if (!prInfo.prNumber) {
-        throw new Error('TFCheckRun: prNumber not retrievable');
+    try {
+        const prInfo = tf_checkrun_extractPrInfo(item);
+        const checkRun = await github_0.feedback.createCheckRun(prInfo.org, prInfo.repo, tf_checkrun_helperCreateCheckRunName(cmd), {
+            pullNumber: Number(prInfo.prNumber),
+            includeCheckRunComment: true,
+            checkRunComment: `The TFWorkspace is being processed (cmd=${cmd}). Details: `,
+        });
+        checkRun.mdOptionsDetails({
+            quotes: 'terraform',
+        });
+        checkRun.update('Initiating', 'queued');
+        return {
+            fnData: (d) => {
+                checkRun.update(d.toString(), 'in_progress');
+            },
+            fnEnd: () => {
+                checkRun.close('OK', true);
+            },
+            fnOnError: (err) => {
+                checkRun.close('KO', false);
+            },
+        };
+    }
+    catch (e) {
+        // log error and return empty fns
+        logger_logger.warn('Error in TFCheckRun:', e);
+        return {
+            fnData: (d) => { },
+            fnEnd: () => { },
+            fnOnError: (err) => { },
+        };
     }
-    const checkRun = await github_0.feedback.createCheckRun(prInfo.org, prInfo.repo, tf_checkrun_helperCreateCheckRunName(cmd), {
-        //Number(pr_number),
-        pullNumber: Number(prInfo.prNumber),
-        includeCheckRunComment: true,
-        checkRunComment: `The TFWorkspace is being processed (cmd=${cmd}). Details: `,
-    });
-    checkRun.mdOptionsDetails({
-        quotes: 'terraform',
-    });
-    checkRun.update('Initiating', 'queued');
-    return {
-        fnData: (d) => {
-            checkRun.update(d.toString(), 'in_progress');
-        },
-        fnEnd: () => {
-            checkRun.close('OK', true);
-        },
-        fnOnError: (err) => {
-            checkRun.close('KO', false);
-        },
-    };
 }
 function tf_checkrun_helperCreateCheckRunName(cmd) {
     return `TFWorkspace - ${cmd}`;
 }
 function tf_checkrun_extractPrInfo(item) {
     const prInfo = item.metadata.annotations['firestartr.dev/last-state-pr'];
+    if (!prInfo)
+        throw new Error('No firestartr.dev/last-state-pr field in CR');
     const prNumber = prInfo.split('#')[1];
     if (!prNumber)
         throw new Error('No PR number found in CR');
@@ -317485,7 +317582,8 @@ class CRStateMetrics {
         catch (err) {
             console.log(`CRStateMetrics: update ${err}`);
             this.onUpdate = false;
-            operator_src_logger.error('CR_METRICS_UPDATE', { error: err });
+            operator_src_logger.error(`On update of CR metrics: ${err}`);
+            await this.__prepareConnection();
         }
         this.onUpdate = false;
     }

package/build/packages/cdk8s_renderer/src/claims/base/schemas/index.d.ts

@@ -837,97 +837,120 @@ declare const schemas: {
         $schema: string;
         $id: string;
         definitions: {
-            ExternalSecretsProvider: {
+            SecretStore: {
                 $id: string;
                 type: string;
-                description: string;
-                allOf: ({
-                    $ref: string;
-                    type?: undefined;
-                    properties?: undefined;
-                    required?: undefined;
-                } | {
-                    type: string;
-                    properties: {
-                        secretStore: {
+                properties: {
+                    name: {
+                        type: string;
+                    };
+                    kind: {
+                        type: string;
+                        enum: string[];
+                    };
+                };
+                required: string[];
+            };
+            ExternalSecretsSection: {
+                $id: string;
+                type: string;
+                properties: {
+                    refreshInterval: {
+                        type: string;
+                    };
+                    secrets: {
+                        type: string;
+                        items: {
+                            additionalProperties: boolean;
                             type: string;
                             properties: {
-                                name: {
+                                secretName: {
                                     type: string;
                                 };
-                                kind: {
+                                remoteRef: {
                                     type: string;
-                                    enum: string[];
                                 };
                             };
                             required: string[];
                         };
-                        pushSecrets: {
+                    };
+                };
+            };
+            PushSecretsSection: {
+                $id: string;
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        data: {
+                            type: string;
+                        };
+                        template: {
+                            type: string;
+                        };
+                        secretName: {
                             type: string;
-                            items: {
-                                type: string;
-                                properties: {
-                                    data: {
-                                        type: string;
-                                    };
-                                    template: {
-                                        type: string;
-                                    };
-                                    secretName: {
-                                        type: string;
-                                    };
-                                    refreshInterval: {
-                                        type: string;
-                                    };
-                                    generator: {
-                                        type: string;
-                                        properties: {
-                                            name: {
-                                                type: string;
-                                            };
-                                            kind: {
-                                                type: string;
-                                                enum: string[];
-                                            };
-                                            apiVersion: {
-                                                type: string;
-                                            };
-                                            conversionStrategy: {
-                                                type: string;
-                                            };
-                                            outputKey: {
-                                                type: string;
-                                            };
-                                        };
-                                        required: string[];
-                                    };
-                                };
-                                required: string[];
-                            };
                         };
-                        externalSecrets: {
+                        refreshInterval: {
+                            type: string;
+                        };
+                        generator: {
                             type: string;
                             properties: {
-                                refreshInterval: {
+                                name: {
                                     type: string;
                                 };
-                                secrets: {
+                                kind: {
+                                    type: string;
+                                    enum: string[];
+                                };
+                                apiVersion: {
+                                    type: string;
+                                };
+                                conversionStrategy: {
+                                    type: string;
+                                };
+                                outputKey: {
                                     type: string;
-                                    items: {
-                                        additionalProperties: boolean;
-                                        type: string;
-                                        properties: {
-                                            secretName: {
-                                                type: string;
-                                            };
-                                        };
-                                        required: string[];
-                                    };
                                 };
                             };
+                            required: string[];
                         };
                     };
                     required: string[];
+                };
+            };
+            ExternalSecretsProvider: {
+                $id: string;
+                type: string;
+                description: string;
+                allOf: ({
+                    $ref: string;
+                    anyOf?: undefined;
+                } | {
+                    anyOf: ({
+                        properties: {
+                            externalSecrets: {
+                                $ref: string;
+                            };
+                            secretStore: {
+                                $ref: string;
+                            };
+                            pushSecrets?: undefined;
+                        };
+                        required: string[];
+                    } | {
+                        properties: {
+                            pushSecrets: {
+                                $ref: string;
+                            };
+                            secretStore: {
+                                $ref: string;
+                            };
+                            externalSecrets?: undefined;
+                        };
+                        required: string[];
+                    })[];
                     $ref?: undefined;
                 })[];
             };

package/build/packages/cdk8s_renderer/src/claims/external-secrets/external-secrets.schema.d.ts

@@ -2,97 +2,120 @@ declare const _default: {
     $schema: string;
     $id: string;
     definitions: {
-        ExternalSecretsProvider: {
+        SecretStore: {
             $id: string;
             type: string;
-            description: string;
-            allOf: ({
-                $ref: string;
-                type?: undefined;
-                properties?: undefined;
-                required?: undefined;
-            } | {
-                type: string;
-                properties: {
-                    secretStore: {
+            properties: {
+                name: {
+                    type: string;
+                };
+                kind: {
+                    type: string;
+                    enum: string[];
+                };
+            };
+            required: string[];
+        };
+        ExternalSecretsSection: {
+            $id: string;
+            type: string;
+            properties: {
+                refreshInterval: {
+                    type: string;
+                };
+                secrets: {
+                    type: string;
+                    items: {
+                        additionalProperties: boolean;
                         type: string;
                         properties: {
-                            name: {
+                            secretName: {
                                 type: string;
                             };
-                            kind: {
+                            remoteRef: {
                                 type: string;
-                                enum: string[];
                             };
                         };
                         required: string[];
                     };
-                    pushSecrets: {
+                };
+            };
+        };
+        PushSecretsSection: {
+            $id: string;
+            type: string;
+            items: {
+                type: string;
+                properties: {
+                    data: {
+                        type: string;
+                    };
+                    template: {
+                        type: string;
+                    };
+                    secretName: {
+                        type: string;
+                    };
+                    refreshInterval: {
                         type: string;
-                        items: {
-                            type: string;
-                            properties: {
-                                data: {
-                                    type: string;
-                                };
-                                template: {
-                                    type: string;
-                                };
-                                secretName: {
-                                    type: string;
-                                };
-                                refreshInterval: {
-                                    type: string;
-                                };
-                                generator: {
-                                    type: string;
-                                    properties: {
-                                        name: {
-                                            type: string;
-                                        };
-                                        kind: {
-                                            type: string;
-                                            enum: string[];
-                                        };
-                                        apiVersion: {
-                                            type: string;
-                                        };
-                                        conversionStrategy: {
-                                            type: string;
-                                        };
-                                        outputKey: {
-                                            type: string;
-                                        };
-                                    };
-                                    required: string[];
-                                };
-                            };
-                            required: string[];
-                        };
                     };
-                    externalSecrets: {
+                    generator: {
                         type: string;
                         properties: {
-                            refreshInterval: {
+                            name: {
+                                type: string;
+                            };
+                            kind: {
+                                type: string;
+                                enum: string[];
+                            };
+                            apiVersion: {
                                 type: string;
                             };
-                            secrets: {
+                            conversionStrategy: {
+                                type: string;
+                            };
+                            outputKey: {
                                 type: string;
-                                items: {
-                                    additionalProperties: boolean;
-                                    type: string;
-                                    properties: {
-                                        secretName: {
-                                            type: string;
-                                        };
-                                    };
-                                    required: string[];
-                                };
                             };
                         };
+                        required: string[];
                     };
                 };
                 required: string[];
+            };
+        };
+        ExternalSecretsProvider: {
+            $id: string;
+            type: string;
+            description: string;
+            allOf: ({
+                $ref: string;
+                anyOf?: undefined;
+            } | {
+                anyOf: ({
+                    properties: {
+                        externalSecrets: {
+                            $ref: string;
+                        };
+                        secretStore: {
+                            $ref: string;
+                        };
+                        pushSecrets?: undefined;
+                    };
+                    required: string[];
+                } | {
+                    properties: {
+                        pushSecrets: {
+                            $ref: string;
+                        };
+                        secretStore: {
+                            $ref: string;
+                        };
+                        externalSecrets?: undefined;
+                    };
+                    required: string[];
+                })[];
                 $ref?: undefined;
             })[];
         };

package/build/packages/cdk8s_renderer/src/claims/external-secrets/index.d.ts

@@ -2,97 +2,120 @@ export declare const SecretsSchemas: {
     $schema: string;
     $id: string;
     definitions: {
-        ExternalSecretsProvider: {
+        SecretStore: {
             $id: string;
             type: string;
-            description: string;
-            allOf: ({
-                $ref: string;
-                type?: undefined;
-                properties?: undefined;
-                required?: undefined;
-            } | {
-                type: string;
-                properties: {
-                    secretStore: {
+            properties: {
+                name: {
+                    type: string;
+                };
+                kind: {
+                    type: string;
+                    enum: string[];
+                };
+            };
+            required: string[];
+        };
+        ExternalSecretsSection: {
+            $id: string;
+            type: string;
+            properties: {
+                refreshInterval: {
+                    type: string;
+                };
+                secrets: {
+                    type: string;
+                    items: {
+                        additionalProperties: boolean;
                         type: string;
                         properties: {
-                            name: {
+                            secretName: {
                                 type: string;
                             };
-                            kind: {
+                            remoteRef: {
                                 type: string;
-                                enum: string[];
                             };
                         };
                         required: string[];
                     };
-                    pushSecrets: {
+                };
+            };
+        };
+        PushSecretsSection: {
+            $id: string;
+            type: string;
+            items: {
+                type: string;
+                properties: {
+                    data: {
+                        type: string;
+                    };
+                    template: {
+                        type: string;
+                    };
+                    secretName: {
+                        type: string;
+                    };
+                    refreshInterval: {
                         type: string;
-                        items: {
-                            type: string;
-                            properties: {
-                                data: {
-                                    type: string;
-                                };
-                                template: {
-                                    type: string;
-                                };
-                                secretName: {
-                                    type: string;
-                                };
-                                refreshInterval: {
-                                    type: string;
-                                };
-                                generator: {
-                                    type: string;
-                                    properties: {
-                                        name: {
-                                            type: string;
-                                        };
-                                        kind: {
-                                            type: string;
-                                            enum: string[];
-                                        };
-                                        apiVersion: {
-                                            type: string;
-                                        };
-                                        conversionStrategy: {
-                                            type: string;
-                                        };
-                                        outputKey: {
-                                            type: string;
-                                        };
-                                    };
-                                    required: string[];
-                                };
-                            };
-                            required: string[];
-                        };
                     };
-                    externalSecrets: {
+                    generator: {
                         type: string;
                         properties: {
-                            refreshInterval: {
+                            name: {
+                                type: string;
+                            };
+                            kind: {
+                                type: string;
+                                enum: string[];
+                            };
+                            apiVersion: {
                                 type: string;
                             };
-                            secrets: {
+                            conversionStrategy: {
+                                type: string;
+                            };
+                            outputKey: {
                                 type: string;
-                                items: {
-                                    additionalProperties: boolean;
-                                    type: string;
-                                    properties: {
-                                        secretName: {
-                                            type: string;
-                                        };
-                                    };
-                                    required: string[];
-                                };
                             };
                         };
+                        required: string[];
                     };
                 };
                 required: string[];
+            };
+        };
+        ExternalSecretsProvider: {
+            $id: string;
+            type: string;
+            description: string;
+            allOf: ({
+                $ref: string;
+                anyOf?: undefined;
+            } | {
+                anyOf: ({
+                    properties: {
+                        externalSecrets: {
+                            $ref: string;
+                        };
+                        secretStore: {
+                            $ref: string;
+                        };
+                        pushSecrets?: undefined;
+                    };
+                    required: string[];
+                } | {
+                    properties: {
+                        pushSecrets: {
+                            $ref: string;
+                        };
+                        secretStore: {
+                            $ref: string;
+                        };
+                        externalSecrets?: undefined;
+                    };
+                    required: string[];
+                })[];
                 $ref?: undefined;
             })[];
         };

package/build/packages/cdk8s_renderer/src/validations/crossReferences.d.ts

@@ -0,0 +1,2 @@
+import { RenderClaims } from '../renderer/types';
+export declare function validateSubReferences(renderClaims: RenderClaims): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "1.50.0-snapshot-1",
+  "version": "1.50.0-snapshot-2",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",