Skip to content

Commit 1bee860

Browse files
arm4barm4b
authored
Merge pull request #203 from cognifloyd/refactor-secrets
Refactor secrets and auto-generate password + ssh_key
2 parents d2691ee + 62c600a commit 1bee860

File tree

9 files changed

+77
-72
lines changed

9 files changed

+77
-72
lines changed

‎.circleci/config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
helm-lint:
1515
working_directory: ~/stackstorm-ha
1616
docker:
17-
- image: lachlanevenson/k8s-helm:v3.3.4
17+
- image: lachlanevenson/k8s-helm:v3.4.2
1818
steps:
1919
- checkout
2020
- run:

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
* st2chatops change: If `st2chatops.env.ST2_API_KEY` is defined, do not set `ST2_AUTH_USERNAME` or `ST2_AUTH_PASSWORD` env vars any more. (#197) (by @cognifloyd)
99
* Add image.tag overrides for all deployments. (#200) (by @cognifloyd)
1010
* If your k8s cluster admin requires custom annotations (eg: to indicate mongo or rabbitmq usage), you can now add those to each set of pods. (#195) (by @cognifloyd)
11+
* BREAKING CHANGE: Move secrets.st2.* values into st2.* (#203) (by @cognifloyd)
12+
* Auto-generate password and ssh_key secrets. (#203) (by @cognifloyd)
1113
* Add optional hubot-scripts volume to st2chatops pod. To add this, define `st2chatops.hubotScriptsVolume`. (#207) (by @cognifloyd)
1214
* Add advanced pod placment (nodeSelector, affinity, tolerations) to specs for batch Jobs pods. (#193) (by @cognifloyd)
1315
* Allow adding dnsPolicy and/or dnsConfig to all pods. (#201) (by @cognifloyd)

‎templates/NOTES.txt‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,13 @@ Ingress is enabled. You may access following endpoints:
3939
{{- end }}
4040
{{- end }}
4141

42-
2. Login with the following credentials:
43-
username: {{ .Values.secrets.st2.username }}
44-
password: {{ .Values.secrets.st2.password }}
42+
2. Get the password needed to login:
43+
kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.data.password}" secret {{ .Release.Name }}-st2-auth | base64 --decode
4544

46-
3. Use st2 CLI:
45+
3. Login with this username and the password retrieved above:
46+
username: {{ .Values.st2.username }}
47+
48+
4. Use st2 CLI:
4749
export ST2CLIENT=$(kubectl get --namespace {{ .Release.Namespace }} pod -l app=st2client,release={{ .Release.Name }} -o jsonpath="{.items[0].metadata.name}")
4850
kubectl exec -it ${ST2CLIENT} --namespace {{ .Release.Namespace }} -- st2 --version
4951

‎templates/configmaps_st2-conf.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ data:
3939
{{- end }}
4040
port = {{ index .Values "mongodb" "service" "port" }}
4141
{{- end }}
42-
{{- if .Values.secrets.st2.datastore_crypto_key }}
42+
{{- if .Values.st2.datastore_crypto_key }}
4343
[keyvalue]
4444
encryption_key_path = /etc/st2/keys/datastore_key.json
4545
{{- end }}

‎templates/deployments.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ spec:
187187
- name: st2-config-vol
188188
mountPath: /etc/st2/st2.user.conf
189189
subPath: st2.user.conf
190-
{{- if .Values.secrets.st2.datastore_crypto_key }}
190+
{{- if .Values.st2.datastore_crypto_key }}
191191
- name: st2-encryption-key-vol
192192
mountPath: /etc/st2/keys
193193
readOnly: true
@@ -206,7 +206,7 @@ spec:
206206
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
207207
{{- end }}
208208
volumes:
209-
{{- if .Values.secrets.st2.datastore_crypto_key }}
209+
{{- if .Values.st2.datastore_crypto_key }}
210210
- name: st2-encryption-key-vol
211211
secret:
212212
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -492,7 +492,7 @@ spec:
492492
- name: st2-config-vol
493493
configMap:
494494
name: {{ .Release.Name }}-st2-config
495-
{{- if .Values.secrets.st2.datastore_crypto_key }}
495+
{{- if .Values.st2.datastore_crypto_key }}
496496
- name: st2-encryption-key-vol
497497
secret:
498498
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -661,7 +661,7 @@ spec:
661661
- name: st2-config-vol
662662
mountPath: /etc/st2/st2.user.conf
663663
subPath: st2.user.conf
664-
{{- if .Values.secrets.st2.datastore_crypto_key }}
664+
{{- if .Values.st2.datastore_crypto_key }}
665665
- name: st2-encryption-key-vol
666666
mountPath: /etc/st2/keys
667667
readOnly: true
@@ -675,7 +675,7 @@ spec:
675675
- name: st2-config-vol
676676
configMap:
677677
name: {{ .Release.Name }}-st2-config
678-
{{- if .Values.secrets.st2.datastore_crypto_key }}
678+
{{- if .Values.st2.datastore_crypto_key }}
679679
- name: st2-encryption-key-vol
680680
secret:
681681
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -758,7 +758,7 @@ spec:
758758
- name: st2-config-vol
759759
mountPath: /etc/st2/st2.user.conf
760760
subPath: st2.user.conf
761-
{{- if .Values.secrets.st2.datastore_crypto_key }}
761+
{{- if .Values.st2.datastore_crypto_key }}
762762
- name: st2-encryption-key-vol
763763
mountPath: /etc/st2/keys
764764
readOnly: true
@@ -769,7 +769,7 @@ spec:
769769
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
770770
{{- end }}
771771
volumes:
772-
{{- if .Values.secrets.st2.datastore_crypto_key }}
772+
{{- if .Values.st2.datastore_crypto_key }}
773773
- name: st2-encryption-key-vol
774774
secret:
775775
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -973,7 +973,7 @@ spec:
973973
mountPath: /opt/stackstorm/virtualenvs
974974
readOnly: true
975975
{{- end }}
976-
{{- if $.Values.secrets.st2.datastore_crypto_key }}
976+
{{- if $.Values.st2.datastore_crypto_key }}
977977
- name: st2-encryption-key-vol
978978
mountPath: /etc/st2/keys
979979
readOnly: true
@@ -984,7 +984,7 @@ spec:
984984
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" $ }}
985985
{{- end }}
986986
volumes:
987-
{{- if $.Values.secrets.st2.datastore_crypto_key }}
987+
{{- if $.Values.st2.datastore_crypto_key }}
988988
- name: st2-encryption-key-vol
989989
secret:
990990
secretName: {{ $.Release.Name }}-st2-datastore-crypto-key
@@ -1090,7 +1090,7 @@ spec:
10901090
- name: st2-ssh-key-vol
10911091
mountPath: /home/stanley/.ssh/
10921092
readOnly: true
1093-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1093+
{{- if .Values.st2.datastore_crypto_key }}
10941094
- name: st2-encryption-key-vol
10951095
mountPath: /etc/st2/keys
10961096
readOnly: true
@@ -1109,7 +1109,7 @@ spec:
11091109
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
11101110
{{- end }}
11111111
volumes:
1112-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1112+
{{- if .Values.st2.datastore_crypto_key }}
11131113
- name: st2-encryption-key-vol
11141114
secret:
11151115
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -1343,7 +1343,7 @@ spec:
13431343
- name: st2-ssh-key-vol
13441344
mountPath: /home/stanley/.ssh/
13451345
readOnly: true
1346-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1346+
{{- if .Values.st2.datastore_crypto_key }}
13471347
- name: st2-encryption-key-vol
13481348
mountPath: /etc/st2/keys
13491349
readOnly: true
@@ -1365,7 +1365,7 @@ spec:
13651365
memory: "5Mi"
13661366
cpu: "5m"
13671367
volumes:
1368-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1368+
{{- if .Values.st2.datastore_crypto_key }}
13691369
- name: st2-encryption-key-vol
13701370
secret:
13711371
secretName: {{ .Release.Name }}-st2-datastore-crypto-key

‎templates/secrets_datastore_crypto_key.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1+
# Notify users about breaking change regarding secrets, to not destroy current installations
2+
{{- $deprecated_crypto_key := (default (dict) (default (dict) .Values.secrets).st2).datastore_crypto_key }}
3+
{{- if $deprecated_crypto_key }}
4+
{{- fail "Please update your values! The datastore_crypto_key value moved from secrets.st2.* to st2.*" }}
5+
{{- else if .Values.st2.datastore_crypto_key }}
26
---
37
apiVersion: v1
48
kind: Secret
@@ -16,6 +20,6 @@ metadata:
1620
type: Opaque
1721
data:
1822
# Datastore key used to encrypt/decrypt record for the KV store
19-
datastore_crypto_key: {{ .Values.secrets.st2.datastore_crypto_key | b64enc }}
23+
datastore_crypto_key: {{ .Values.st2.datastore_crypto_key | b64enc }}
2024

2125
{{- end }}

‎templates/secrets_ssh.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
1+
# Notify users about breaking change regarding secrets, to not destroy current installations
2+
{{- $deprecated_ssh_key := (default (dict) (default (dict) .Values.secrets).st2).ssh_key }}
3+
{{- if $deprecated_ssh_key }}
4+
{{- fail "Please update your values! The ssh_key value moved from secrets.st2.* to st2.*" }}
5+
{{- end }}
16
---
27
apiVersion: v1
38
kind: Secret
49
metadata:
5-
name: {{ .Release.Name }}-st2-ssh
10+
{{- $name := print .Release.Name "-st2-ssh" }}
11+
name: {{ $name }}
612
annotations:
713
description: StackStorm SSH secret key for 'stanley' user, used to run actions on remote machines
814
labels:
@@ -15,4 +21,9 @@ metadata:
1521
type: Opaque
1622
data:
1723
# SSH private key for the 'stanley' system user ('system_user.ssh_key_file' in st2.conf).
18-
private_key: {{ required "Secret 'st2.ssh_key' is required for StackStorm system user!" .Values.secrets.st2.ssh_key | b64enc | quote }}
24+
{{- $previous := lookup "v1" "Secret" .Release.Namespace $name }}
25+
{{- if and $previous (not .Values.st2.ssh_key) }}
26+
private_key: {{ $previous.data.private_key }}
27+
{{ else }}
28+
private_key: {{ default (genPrivateKey "rsa") .Values.st2.ssh_key | b64enc | quote }}
29+
{{ end }}

‎templates/secrets_st2auth.yaml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,15 @@
1+
# Notify users about breaking change regarding secrets, to not destroy current installations
2+
{{- $deprecated_username := (default (dict) (default (dict) .Values.secrets).st2).username }}
3+
{{- $deprecated_password := (default (dict) (default (dict) .Values.secrets).st2).pasword }}
4+
{{- if or $deprecated_username $deprecated_password }}
5+
{{- fail "Please update your values! Values for username and password moved from secrets.st2.* to st2.*" }}
6+
{{- end }}
17
---
28
apiVersion: v1
39
kind: Secret
410
metadata:
5-
name: {{ .Release.Name }}-st2-auth
11+
{{- $name := print .Release.Name "-st2-auth" }}
12+
name: {{ $name }}
613
annotations:
714
description: StackStorm username and password, used for basic .htaccess auth
815
labels:
@@ -15,6 +22,11 @@ metadata:
1522
type: Opaque
1623
data:
1724
# Username, used to login to StackStorm system (default: st2admin)
18-
username: {{ required "A valid secret 'st2.username' is required for StackStorm auth!" .Values.secrets.st2.username | b64enc | quote }}
19-
# Password, used to login to StackStorm system (default: Ch@ngeMe)
20-
password: {{ required "A valid secret 'st2.password' is required for StackStorm auth!" .Values.secrets.st2.password | b64enc | quote }}
25+
username: {{ required "A valid secret 'st2.username' is required for StackStorm auth!" .Values.st2.username | b64enc | quote }}
26+
# Password, used to login to StackStorm system (default: auto-generated)
27+
{{- $previous := lookup "v1" "Secret" .Release.Namespace $name }}
28+
{{- if and $previous (not .Values.st2.password) }}
29+
password: {{ $previous.data.password }}
30+
{{ else }}
31+
password: {{ default (randAlphaNum 12) .Values.st2.password | b64enc | quote }}
32+
{{ end }}

‎values.yaml‎

Lines changed: 19 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,24 @@ serviceAccount:
4141
## StackStorm shared variables
4242
##
4343
st2:
44+
# Username, used to login to StackStorm system
45+
username: st2admin
46+
# Password, used to login to StackStorm system
47+
# If set, st2.password always overrides any existing password.
48+
# If not set, the password is auto-generated on install and preserved across upgrades.
49+
#password: Ch@ngeMe
50+
# ST2 crypto key for the K/V datastore.
51+
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
52+
# Warning! Replace with your own generated key!
53+
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
54+
# SSH private key for the 'stanley' system user ('system_user.ssh_key_file' in st2.conf)
55+
# If set, st2.ssh_key always overrides any existing ssh_key.
56+
# If not set, the ssh_key is auto-generated on install and preserved across upgrades.
57+
#ssh_key: |-
58+
# -----BEGIN RSA PRIVATE KEY-----
59+
# ...
60+
# -----END RSA PRIVATE KEY-----
61+
4462
# Custom StackStorm config (st2.user.conf) which will apply settings on top of default st2.conf
4563
config: |
4664
[api]
@@ -180,52 +198,8 @@ ingress:
180198
# - chart-example.test
181199

182200
##
183-
## StackStorm HA Cluster Secrets.
184-
## NB! It's highly recommended to change ALL defaults!
201+
## NOTE: there used to be a secrets.st2 section here. These values have moved into st2.* above. Please update your values.
185202
##
186-
# TODO: Move to `secrets.yaml` when it gets implemented in Helm (https://github.com/kubernetes/helm/issues/2196) ? (#14)
187-
# TODO: Alternatively as part of reorganizing Helm values, consider moving values to existing `st2` and `st2web` sections ? (#14)
188-
secrets:
189-
st2:
190-
# Username, used to login to StackStorm system
191-
username: st2admin
192-
# Password, used to login to StackStorm system
193-
password: Ch@ngeMe
194-
# SSH private key for the 'stanley' system user ('system_user.ssh_key_file' in st2.conf)
195-
# Warning! Replace with your own SSH key!
196-
# TODO: For prod/stable consider auto-generating if no key provided (#15)
197-
ssh_key: |-
198-
-----BEGIN RSA PRIVATE KEY-----
199-
MIIEowIBAAKCAQEAs73kblN3XfLR6tYsHRHyX/aQKx4amcNjT+E+2ufwqkiINDyA
200-
CGim0Z4WFOEO6UtZApeOlUehp2MEFGFpl2u8vUC1b7AsWaImB4ywMIPOFblqaEag
201-
DskrFp7FOggqZFWX7NwVZpm/KkvCw/fCehnxuv+za+hUtg4Qiv86qXShrlsn98B7
202-
64Aq27oxkvhRU2OkDUP/wPNQnXzIZxfFYSvS7rGzKrswdZfWysscIUor4a+7GahM
203-
yq8PGD6qp2wkiL7wFarZerS2Sq3M06Y89yzppCoPYI6kaEPuqrjSYZvh38CAVbGG
204-
SgPv3CFgR1N3BsBEAx7OF+40R58C+3ldH8e1tQIDAQABAoIBAQCN7137YR3Zqm3p
205-
q8aaDhn/fYzK/7KxyYEbCxu/cXiyfyRPW5cfDMTuso9tXWuQ/lcDnPqTF0WoEKCg
206-
F2xyjjk0mWytDcl33nt5areXF/4dWZWVUnACPQkxi57i/J+9K3oVKJYdtzsmAz2B
207-
0pxYHzSsHk9o3sZGHUUi/fks51TlgPNgOP8hf7/K9w9+FSE26geqjddqWwQbbStI
208-
rDc3ZPMcGI4E5DuGmnrxWf4omUqScTB+bvUgN+WC02v1Bj4HaAX7PlLCUZMuTk3S
209-
BcG4v7qiglxVYdBjtHNwtg1YAoVYh6sXckxqi1XudhoRXGlgYtyrcW0mWnnB4hIQ
210-
vy7//uABAoGBANw8H1h93U1HNsqfIa1Ys3u6qZdHByHvA8e7Jk6GEFUEOAQSyxZ+
211-
0RbFWC4knuQL+YklqeDNCXekwVEvVenf2lhZ4rHNbmv/9pWhq7sQcDOQPi5nVxJl
212-
bkQoQkeNGeH8KPF1E2RsfJ8uU3NfD00yMFrNaeBUIlY44ABMOQSJREq1AoGBANDu
213-
V0IV1BahqEW5mmnTdHLG6+tiSQdutrQv4hxBL59PhwyeMvpzFgwkNmymAZMLl40D
214-
Y/0wg2lVr7Fb+peCrLpiNMEPWv/a38IEVTDm7YcsHZayEsc1vdjdMoZ8k5VNi25F
215-
+lvQ/CxDNqJGTNEBBYmb5QHopBh8YowwIrT0yZ8BAoGAFYtAGbz+SA/+WSXl+noh
216-
3Kmu62CEXxptiT1Siv3sXRSzkhpwiXvQYmTdsm3cqTxOpc7sZlRIZ87TJmj2A5Hl
217-
Xx0z4ubQtXntmkedcAg0oaarnoh3aRJJDhvOGAfCj2vGaZBlXD6MllnGyhNzgL63
218-
IjrT76DrVvnrV7wdG8d9yb0CgYAuQFT4wDRPPkIuDURtoO3qarbXSM654nx3rxHz
219-
B0svjT9sP6kxYEDFN08FBkra7noCMXn1FsRAkUNvk9kJqVfresoK4wdWFHHsVWE2
220-
jiiO/+kc7xbRGsiINY91ziYtqxjutHcT1FO+yLJTghSHQB6ls+kiXwnUkdSPDCji
221-
vj3UAQKBgE19oSdfKbpKTyHu5rs+lN/KictDuMrqAriWODCygZ1/X1J1zpqvpUbt
222-
WE8BWLQ1vBV6c7V4Q0Wp6LuTnNnvu/lvVugJW/TbrzFw6CFe5fEISmIHAMnqVz8x
223-
OdOJyinSM1svoBGnYfyAqINKrqCSGSKmprlMo0Ma3erI7SuojWBS
224-
-----END RSA PRIVATE KEY-----
225-
# ST2 crypto key for the K/V datastore.
226-
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
227-
# Warning! Replace with your own generated key!
228-
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
229203

230204
##
231205
## StackStorm HA Cluster pod settings for each individual service/component.

0 commit comments

Comments
 (0)