Skip to content

Commit c516226

Browse files
cognifloydcognifloyd
committed
refactor secrets values: move datastore_crypto_key to st2.*
1 parent d35a868 commit c516226

File tree

4 files changed

+24
-20
lines changed

4 files changed

+24
-20
lines changed

‎templates/configmaps_st2-conf.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ data:
3939
{{- end }}
4040
port = {{ index .Values "mongodb" "service" "port" }}
4141
{{- end }}
42-
{{- if .Values.secrets.st2.datastore_crypto_key }}
42+
{{- if .Values.st2.datastore_crypto_key }}
4343
[keyvalue]
4444
encryption_key_path = /etc/st2/keys/datastore_key.json
4545
{{- end }}

‎templates/deployments.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ spec:
184184
- name: st2-config-vol
185185
mountPath: /etc/st2/st2.user.conf
186186
subPath: st2.user.conf
187-
{{- if .Values.secrets.st2.datastore_crypto_key }}
187+
{{- if .Values.st2.datastore_crypto_key }}
188188
- name: st2-encryption-key-vol
189189
mountPath: /etc/st2/keys
190190
readOnly: true
@@ -203,7 +203,7 @@ spec:
203203
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
204204
{{- end }}
205205
volumes:
206-
{{- if .Values.secrets.st2.datastore_crypto_key }}
206+
{{- if .Values.st2.datastore_crypto_key }}
207207
- name: st2-encryption-key-vol
208208
secret:
209209
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -480,7 +480,7 @@ spec:
480480
- name: st2-config-vol
481481
configMap:
482482
name: {{ .Release.Name }}-st2-config
483-
{{- if .Values.secrets.st2.datastore_crypto_key }}
483+
{{- if .Values.st2.datastore_crypto_key }}
484484
- name: st2-encryption-key-vol
485485
secret:
486486
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -643,7 +643,7 @@ spec:
643643
- name: st2-config-vol
644644
mountPath: /etc/st2/st2.user.conf
645645
subPath: st2.user.conf
646-
{{- if .Values.secrets.st2.datastore_crypto_key }}
646+
{{- if .Values.st2.datastore_crypto_key }}
647647
- name: st2-encryption-key-vol
648648
mountPath: /etc/st2/keys
649649
readOnly: true
@@ -657,7 +657,7 @@ spec:
657657
- name: st2-config-vol
658658
configMap:
659659
name: {{ .Release.Name }}-st2-config
660-
{{- if .Values.secrets.st2.datastore_crypto_key }}
660+
{{- if .Values.st2.datastore_crypto_key }}
661661
- name: st2-encryption-key-vol
662662
secret:
663663
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -737,7 +737,7 @@ spec:
737737
- name: st2-config-vol
738738
mountPath: /etc/st2/st2.user.conf
739739
subPath: st2.user.conf
740-
{{- if .Values.secrets.st2.datastore_crypto_key }}
740+
{{- if .Values.st2.datastore_crypto_key }}
741741
- name: st2-encryption-key-vol
742742
mountPath: /etc/st2/keys
743743
readOnly: true
@@ -748,7 +748,7 @@ spec:
748748
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
749749
{{- end }}
750750
volumes:
751-
{{- if .Values.secrets.st2.datastore_crypto_key }}
751+
{{- if .Values.st2.datastore_crypto_key }}
752752
- name: st2-encryption-key-vol
753753
secret:
754754
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -946,7 +946,7 @@ spec:
946946
mountPath: /opt/stackstorm/virtualenvs
947947
readOnly: true
948948
{{- end }}
949-
{{- if $.Values.secrets.st2.datastore_crypto_key }}
949+
{{- if $.Values.st2.datastore_crypto_key }}
950950
- name: st2-encryption-key-vol
951951
mountPath: /etc/st2/keys
952952
readOnly: true
@@ -957,7 +957,7 @@ spec:
957957
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" $ }}
958958
{{- end }}
959959
volumes:
960-
{{- if $.Values.secrets.st2.datastore_crypto_key }}
960+
{{- if $.Values.st2.datastore_crypto_key }}
961961
- name: st2-encryption-key-vol
962962
secret:
963963
secretName: {{ $.Release.Name }}-st2-datastore-crypto-key
@@ -1060,7 +1060,7 @@ spec:
10601060
- name: st2-ssh-key-vol
10611061
mountPath: /home/stanley/.ssh/
10621062
readOnly: true
1063-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1063+
{{- if .Values.st2.datastore_crypto_key }}
10641064
- name: st2-encryption-key-vol
10651065
mountPath: /etc/st2/keys
10661066
readOnly: true
@@ -1079,7 +1079,7 @@ spec:
10791079
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
10801080
{{- end }}
10811081
volumes:
1082-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1082+
{{- if .Values.st2.datastore_crypto_key }}
10831083
- name: st2-encryption-key-vol
10841084
secret:
10851085
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
@@ -1307,7 +1307,7 @@ spec:
13071307
- name: st2-ssh-key-vol
13081308
mountPath: /home/stanley/.ssh/
13091309
readOnly: true
1310-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1310+
{{- if .Values.st2.datastore_crypto_key }}
13111311
- name: st2-encryption-key-vol
13121312
mountPath: /etc/st2/keys
13131313
readOnly: true
@@ -1329,7 +1329,7 @@ spec:
13291329
memory: "5Mi"
13301330
cpu: "5m"
13311331
volumes:
1332-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1332+
{{- if .Values.st2.datastore_crypto_key }}
13331333
- name: st2-encryption-key-vol
13341334
secret:
13351335
secretName: {{ .Release.Name }}-st2-datastore-crypto-key

‎templates/secrets_datastore_crypto_key.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
{{- if .Values.secrets.st2.datastore_crypto_key }}
1+
# Notify users about breaking change regarding secrets, to not destroy current installations
2+
{{- $deprecated_crypto_key := (default (dict) (default (dict) .Values.secrets).st2).datastore_crypto_key }}
3+
{{- if $deprecated_crypto_key }}
4+
{{- fail "Please update your values! The datastore_crypto_key value moved from secrets.st2.* to st2.*" }}
5+
{{- else if .Values.st2.datastore_crypto_key }}
26
---
37
apiVersion: v1
48
kind: Secret
@@ -16,6 +20,6 @@ metadata:
1620
type: Opaque
1721
data:
1822
# Datastore key used to encrypt/decrypt record for the KV store
19-
datastore_crypto_key: {{ .Values.secrets.st2.datastore_crypto_key | b64enc }}
23+
datastore_crypto_key: {{ .Values.st2.datastore_crypto_key | b64enc }}
2024

2125
{{- end }}

‎values.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ st2:
4747
username: st2admin
4848
# Password, used to login to StackStorm system
4949
password: Ch@ngeMe
50+
# ST2 crypto key for the K/V datastore.
51+
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
52+
# Warning! Replace with your own generated key!
53+
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
5054

5155
# Custom StackStorm config (st2.user.conf) which will apply settings on top of default st2.conf
5256
config: |
@@ -225,10 +229,6 @@ secrets:
225229
WE8BWLQ1vBV6c7V4Q0Wp6LuTnNnvu/lvVugJW/TbrzFw6CFe5fEISmIHAMnqVz8x
226230
OdOJyinSM1svoBGnYfyAqINKrqCSGSKmprlMo0Ma3erI7SuojWBS
227231
-----END RSA PRIVATE KEY-----
228-
# ST2 crypto key for the K/V datastore.
229-
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
230-
# Warning! Replace with your own generated key!
231-
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
232232
233233
##
234234
## StackStorm HA Cluster pod settings for each individual service/component.

0 commit comments

Comments
 (0)