Skip to content

Commit 7ee24be

Browse files
cognifloydcognifloyd
authored
Merge pull request #359: Initial External AUTH Secret
2 parents 53f700e + 7f74438 commit 7ee24be

File tree

9 files changed

+143
-12
lines changed

9 files changed

+143
-12
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
* Drop support for `networking.k8s.io/v1beta1` which was removed in kubernetes v1.22 (EOL 2022-10-28) (#353) (by @cognifloyd)
77
* Reduce duplication in label tests (#354) (by @cognifloyd)
88
* Add `st2canary` job as a Helm Hook that runs before install/upgrade to ensure `st2.packs.volumes` is configured correctly (if `st2.packs.volumes.enabled`). (#323) (by @cognifloyd)
9+
* Enable using existing `st2-auth` secret. This allows users to manage this secret outside of the Helm process. (#359) (by @bmarick)
910

1011
## v0.110.0
1112
* Switch st2 to `v3.8` as a new default stable version (#347)

‎templates/NOTES.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ Ingress is enabled. You may access following endpoints:
4040
{{- end }}
4141

4242
2. Get the password needed to login:
43-
kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.data.ST2_AUTH_PASSWORD}" secret {{ .Release.Name }}-st2-auth | base64 --decode
43+
kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.data.ST2_AUTH_PASSWORD}" secret {{ include "stackstorm-ha.secrets.st2Auth" . }} | base64 --decode
4444

4545
3. Login with this username and the password retrieved above:
4646
username: {{ .Values.st2.username }}

‎templates/_helpers.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,16 @@ Create the name of the stackstorm-ha service account to use
6969
{{- default .Chart.Name .Values.serviceAccount.serviceAccountName -}}
7070
{{- end -}}
7171

72+
73+
{{/*
74+
Create the name of the stackstorm-ha st2 auth secret to use
75+
*/}}
76+
{{- define "stackstorm-ha.secrets.st2Auth" -}}
77+
{{- $name := print .Release.Name "-st2-auth" -}}
78+
{{- default $name .Values.st2.existingAuthSecret -}}
79+
{{- end -}}
80+
81+
7282
{{/*
7383
Generate '-' prefix only when the variable is defined
7484
*/}}

‎templates/deployments.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ spec:
5252
{{- end }}
5353
envFrom:
5454
- secretRef:
55-
name: {{ .Release.Name }}-st2-auth
55+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
5656
volumeMounts:
5757
- name: htpasswd-vol
5858
mountPath: /tmp/st2
@@ -1581,7 +1581,7 @@ spec:
15811581
- configMapRef:
15821582
name: {{ .Release.Name }}-st2-urls
15831583
- secretRef:
1584-
name: {{ .Release.Name }}-st2-auth
1584+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
15851585
{{- range .Values.st2client.envFromSecrets }}
15861586
- secretRef:
15871587
name: {{ . }}
@@ -1760,7 +1760,7 @@ spec:
17601760
name: {{ .Release.Name }}-st2-urls
17611761
{{- if not (hasKey .Values.st2chatops.env "ST2_API_KEY") }}
17621762
- secretRef:
1763-
name: {{ .Release.Name }}-st2-auth
1763+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
17641764
{{- end }}
17651765
- secretRef:
17661766
name: {{ .Release.Name }}-st2chatops

‎templates/jobs.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ spec:
156156
- configMapRef:
157157
name: {{ .Release.Name }}-st2-urls
158158
- secretRef:
159-
name: {{ .Release.Name }}-st2-auth
159+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
160160
{{- range .Values.jobs.envFromSecrets }}
161161
- secretRef:
162162
name: {{ . }}
@@ -282,7 +282,7 @@ spec:
282282
- configMapRef:
283283
name: {{ .Release.Name }}-st2-urls
284284
- secretRef:
285-
name: {{ .Release.Name }}-st2-auth
285+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
286286
{{- range .Values.jobs.envFromSecrets }}
287287
- secretRef:
288288
name: {{ . }}
@@ -647,7 +647,7 @@ spec:
647647
- configMapRef:
648648
name: {{ $.Release.Name }}-st2-urls
649649
- secretRef:
650-
name: {{ $.Release.Name }}-st2-auth
650+
name: {{ include "stackstorm-ha.secrets.st2Auth" $ }}
651651
{{- range $.Values.jobs.envFromSecrets }}
652652
- secretRef:
653653
name: {{ . }}

‎templates/secrets_st2auth.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@
44
{{- if or $deprecated_username $deprecated_password }}
55
{{- fail "Please update your values! Values for username and password moved from secrets.st2.* to st2.*" }}
66
{{- end }}
7+
{{- if not .Values.st2.existingAuthSecret }}
78
---
89
apiVersion: v1
910
kind: Secret
1011
metadata:
11-
{{- $name := print .Release.Name "-st2-auth" }}
12-
name: {{ $name }}
12+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
1313
annotations:
1414
description: StackStorm username and password, used for basic .htaccess auth
1515
labels: {{- include "stackstorm-ha.labels" (list $ "st2") | nindent 4 }}
@@ -18,9 +18,10 @@ data:
1818
# Username, used to login to StackStorm system (default: st2admin)
1919
ST2_AUTH_USERNAME: {{ required "A valid secret 'st2.username' is required for StackStorm auth!" .Values.st2.username | b64enc | quote }}
2020
# Password, used to login to StackStorm system (default: auto-generated)
21-
{{- $previous := lookup "v1" "Secret" .Release.Namespace $name }}
21+
{{- $previous := lookup "v1" "Secret" .Release.Namespace (include "stackstorm-ha.secrets.st2Auth" .) }}
2222
{{- if and $previous (not .Values.st2.password) }}
2323
ST2_AUTH_PASSWORD: {{ default $previous.data.password $previous.data.ST2_AUTH_PASSWORD }}
2424
{{ else }}
2525
ST2_AUTH_PASSWORD: {{ default (randAlphaNum 12) .Values.st2.password | b64enc | quote }}
2626
{{ end }}
27+
{{- end }}

‎templates/tests/st2tests-pod.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ spec:
4343
- configMapRef:
4444
name: {{ .Release.Name }}-st2-urls
4545
- secretRef:
46-
name: {{ .Release.Name }}-st2-auth
46+
name: {{ include "stackstorm-ha.secrets.st2Auth" . }}
4747
env:
4848
- name: BATS_HELPERS_DIR
4949
value: /tools

‎tests/unit/secrets_test.yaml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
suite: Secret files
3+
templates:
4+
# primary template files
5+
- secrets_st2auth.yaml
6+
- deployments.yaml
7+
- jobs.yaml
8+
9+
# included templates must also be listed
10+
- configmaps_overrides.yaml
11+
- configmaps_packs.yaml
12+
- configmaps_rbac.yaml
13+
- configmaps_st2-conf.yaml
14+
- configmaps_st2-urls.yaml
15+
- configmaps_st2web.yaml
16+
- secrets_datastore_crypto_key.yaml
17+
- secrets_ssh.yaml
18+
- secrets_st2apikeys.yaml
19+
- secrets_st2auth.yaml
20+
- secrets_st2chatops.yaml
21+
22+
tests:
23+
- it: ST2 Auth Secret include by default
24+
template: secrets_st2auth.yaml
25+
set:
26+
st2: {}
27+
release:
28+
name: st2ha
29+
asserts:
30+
- hasDocuments:
31+
count: 1
32+
- isNotEmpty:
33+
path: data.ST2_AUTH_PASSWORD
34+
documentIndex: 0
35+
- equal:
36+
path: data.ST2_AUTH_USERNAME
37+
value: c3QyYWRtaW4=
38+
documentIndex: 0
39+
40+
- it: ST2 Auth Secret set custom username and password
41+
template: secrets_st2auth.yaml
42+
set:
43+
st2:
44+
username: example
45+
password: badPassword
46+
release:
47+
name: st2ha
48+
asserts:
49+
- hasDocuments:
50+
count: 1
51+
- equal:
52+
path: data.ST2_AUTH_USERNAME
53+
value: "ZXhhbXBsZQ==" # Base64 encoded value
54+
documentIndex: 0
55+
- equal:
56+
path: data.ST2_AUTH_PASSWORD
57+
value: "YmFkUGFzc3dvcmQ=" # Base64 encoded value
58+
documentIndex: 0
59+
60+
- it: ST2 Auth Secret disable generation
61+
template: secrets_st2auth.yaml
62+
set:
63+
st2:
64+
existingAuthSecret: "hello-world"
65+
release:
66+
name: st2ha
67+
asserts:
68+
- hasDocuments:
69+
count: 0
70+
71+
- it: ST2 Auth Secret custom secret Name
72+
template: deployments.yaml
73+
set:
74+
st2:
75+
existingAuthSecret: "hello-world"
76+
st2chatops:
77+
enabled: true
78+
release:
79+
name: st2ha
80+
asserts:
81+
- hasDocuments:
82+
count: 14
83+
- equal:
84+
path: spec.template.spec.initContainers[2].envFrom[0].secretRef.name
85+
value: "hello-world"
86+
documentIndex: 0 # st2auth
87+
- equal:
88+
path: spec.template.spec.initContainers[0].envFrom[1].secretRef.name
89+
value: "hello-world"
90+
documentIndex: 12 # st2client
91+
- equal:
92+
path: spec.template.spec.containers[0].envFrom[1].secretRef.name
93+
value: "hello-world"
94+
documentIndex: 13 # st2chatops
95+
96+
- it: ST2 Auth Secret custom secret Name
97+
template: jobs.yaml
98+
set:
99+
st2:
100+
existingAuthSecret: "hello-world"
101+
st2chatops:
102+
enabled: true
103+
release:
104+
name: st2ha
105+
asserts:
106+
- hasDocuments:
107+
count: 3
108+
- equal:
109+
path: spec.template.spec.initContainers[2].envFrom[1].secretRef.name
110+
value: "hello-world"
111+
documentIndex: 0 # st2-apikey-load
112+
- equal:
113+
path: spec.template.spec.initContainers[1].envFrom[1].secretRef.name
114+
value: "hello-world"
115+
documentIndex: 1 # st2-key-load

‎values.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,11 @@ st2:
6060
# Password, used to login to StackStorm system
6161
# If set, st2.password always overrides any existing password.
6262
# If not set, the password is auto-generated on install and preserved across upgrades.
63+
# Disabled if st2.existingAuthSecret is set
6364
#password: Ch@ngeMe
65+
# Name of existing ST2 Auth secret, disables creation of this secret
66+
# existingAuthSecret: ""
67+
6468
# ST2 crypto key for the K/V datastore.
6569
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
6670
# If set, st2.datastore_crypto_key always overrides any existing datastore_crypto_key.
@@ -81,7 +85,7 @@ st2:
8185
config: |
8286
[api]
8387
allow_origin = '*'
84-
# fixes no replicaset found bug;
88+
# fixes no replicaset found bug;
8589
[database]
8690
# Connection and server selection timeout (in ms).
8791
connection_timeout = 5000

0 commit comments

Comments
 (0)