Skip to content

Commit cc2697b

Browse files
armabarmab
authored
Merge pull request #115 from AngryDeveloper/inject-datastore-encryption-key
Allow usage of datastore encryption with a pregenerated key
2 parents 6d8e12a + d4e747d commit cc2697b

File tree

5 files changed

+110
-1
lines changed

5 files changed

+110
-1
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Changelog
22

33
## In Development
4+
* Allow injection of datastore key in cluster (#115) (by @AngryDeveloper)
45

56
## v0.30.0
67
* Pin st2 version to `v3.3dev` as a new latest development version (#129)

‎templates/configmaps_st2-conf.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ data:
3939
{{- end }}
4040
port = {{ index .Values "mongodb-ha" "port" }}
4141
{{- end }}
42+
{{- if .Values.secrets.st2.datastore_crypto_key }}
43+
[keyvalue]
44+
encryption_key_path = /etc/st2/keys/datastore_key.json
45+
{{- end }}
4246
4347
# User-defined st2 config with custom settings applied on top of everything else.
4448
# The order of merging: st2.conf < st2.docker.conf < st2.user.conf

‎templates/deployments.yaml

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ spec:
143143
heritage: {{ .Release.Service }}
144144
annotations:
145145
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
146+
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
146147
spec:
147148
imagePullSecrets:
148149
{{- if .Values.enterprise.enabled }}
@@ -204,6 +205,11 @@ spec:
204205
- name: st2-config-vol
205206
mountPath: /etc/st2/st2.user.conf
206207
subPath: st2.user.conf
208+
{{- if .Values.secrets.st2.datastore_crypto_key }}
209+
- name: st2-encryption-key-vol
210+
mountPath: /etc/st2/keys
211+
readOnly: true
212+
{{- end }}
207213
{{- if .Values.st2.packs.image.repository }}
208214
- name: st2-packs-vol
209215
mountPath: /opt/stackstorm/packs
@@ -218,6 +224,14 @@ spec:
218224
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
219225
{{- end }}
220226
volumes:
227+
{{- if .Values.secrets.st2.datastore_crypto_key }}
228+
- name: st2-encryption-key-vol
229+
secret:
230+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
231+
items:
232+
- key: datastore_crypto_key
233+
path: datastore_key.json
234+
{{- end }}
221235
- name: st2-config-vol
222236
configMap:
223237
name: {{ .Release.Name }}-st2-config
@@ -468,6 +482,14 @@ spec:
468482
- name: st2-config-vol
469483
configMap:
470484
name: {{ .Release.Name }}-st2-config
485+
{{- if .Values.secrets.st2.datastore_crypto_key }}
486+
- name: st2-encryption-key-vol
487+
secret:
488+
secretName: datastore_crypto_key
489+
items:
490+
- key: datastore_crypto_key
491+
path: datastore_key.json
492+
{{- end }}
471493
{{- with .Values.st2rulesengine.nodeSelector }}
472494
nodeSelector:
473495
{{ toYaml . | indent 8 }}
@@ -594,6 +616,7 @@ spec:
594616
heritage: {{ .Release.Service }}
595617
annotations:
596618
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
619+
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
597620
spec:
598621
{{- if .Values.enterprise.enabled }}
599622
imagePullSecrets:
@@ -616,6 +639,11 @@ spec:
616639
- name: st2-config-vol
617640
mountPath: /etc/st2/st2.user.conf
618641
subPath: st2.user.conf
642+
{{- if .Values.secrets.st2.datastore_crypto_key }}
643+
- name: st2-encryption-key-vol
644+
mountPath: /etc/st2/keys
645+
readOnly: true
646+
{{- end }}
619647
resources:
620648
{{ toYaml .Values.st2workflowengine.resources | indent 10 }}
621649
{{- if .Values.st2workflowengine.serviceAccount.attach }}
@@ -625,6 +653,14 @@ spec:
625653
- name: st2-config-vol
626654
configMap:
627655
name: {{ .Release.Name }}-st2-config
656+
{{- if .Values.secrets.st2.datastore_crypto_key }}
657+
- name: st2-encryption-key-vol
658+
secret:
659+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
660+
items:
661+
- key: datastore_crypto_key
662+
path: datastore_key.json
663+
{{- end }}
628664
{{- with .Values.st2workflowengine.nodeSelector }}
629665
nodeSelector:
630666
{{ toYaml . | indent 8 }}
@@ -831,6 +867,7 @@ spec:
831867
annotations:
832868
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") $ | sha256sum }}
833869
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") $ | sha256sum }}
870+
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") $ | sha256sum }}
834871
{{- if .annotations }}
835872
{{ toYaml .annotations | indent 8 }}
836873
{{- end }}
@@ -914,12 +951,25 @@ spec:
914951
mountPath: /opt/stackstorm/virtualenvs
915952
readOnly: true
916953
{{- end }}
954+
{{- if $.Values.secrets.st2.datastore_crypto_key }}
955+
- name: st2-encryption-key-vol
956+
mountPath: /etc/st2/keys
957+
readOnly: true
958+
{{- end }}
917959
resources:
918960
{{ toYaml .resources | indent 10 }}
919961
{{- if .serviceAccount.attach }}
920962
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" $ }}
921963
{{- end }}
922964
volumes:
965+
{{- if $.Values.secrets.st2.datastore_crypto_key }}
966+
- name: st2-encryption-key-vol
967+
secret:
968+
secretName: {{ $.Release.Name }}-st2-datastore-crypto-key
969+
items:
970+
- key: datastore_crypto_key
971+
path: datastore_key.json
972+
{{- end }}
923973
- name: st2-config-vol
924974
configMap:
925975
name: {{ $.Release.Name }}-st2-config
@@ -979,6 +1029,7 @@ spec:
9791029
annotations:
9801030
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
9811031
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1032+
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
9821033
{{- if .Values.st2actionrunner.annotations }}
9831034
{{ toYaml .Values.st2actionrunner.annotations | indent 8 }}
9841035
{{- end }}
@@ -1046,6 +1097,11 @@ spec:
10461097
- name: st2-ssh-key-vol
10471098
mountPath: /home/stanley/.ssh/
10481099
readOnly: true
1100+
{{- if .Values.secrets.st2.datastore_crypto_key }}
1101+
- name: st2-encryption-key-vol
1102+
mountPath: /etc/st2/keys
1103+
readOnly: true
1104+
{{- end }}
10491105
{{- if .Values.st2.packs.image.repository }}
10501106
- name: st2-packs-vol
10511107
mountPath: /opt/stackstorm/packs
@@ -1060,6 +1116,14 @@ spec:
10601116
serviceAccountName: {{ template "stackstorm-ha.serviceAccountName" . }}
10611117
{{- end }}
10621118
volumes:
1119+
{{- if .Values.secrets.st2.datastore_crypto_key }}
1120+
- name: st2-encryption-key-vol
1121+
secret:
1122+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
1123+
items:
1124+
- key: datastore_crypto_key
1125+
path: datastore_key.json
1126+
{{- end }}
10631127
- name: st2-config-vol
10641128
configMap:
10651129
name: {{ .Release.Name }}-st2-config
@@ -1206,6 +1270,7 @@ spec:
12061270
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") . | sha256sum }}
12071271
checksum/auth: {{ include (print $.Template.BasePath "/secrets_st2auth.yaml") . | sha256sum }}
12081272
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1273+
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
12091274
spec:
12101275
imagePullSecrets:
12111276
{{- if .Values.enterprise.enabled }}
@@ -1309,6 +1374,11 @@ spec:
13091374
- name: st2-ssh-key-vol
13101375
mountPath: /home/stanley/.ssh/
13111376
readOnly: true
1377+
{{- if .Values.secrets.st2.datastore_crypto_key }}
1378+
- name: st2-encryption-key-vol
1379+
mountPath: /etc/st2/keys
1380+
readOnly: true
1381+
{{- end }}
13121382
{{- if .Values.st2.packs.image.repository }}
13131383
- name: st2-packs-vol
13141384
mountPath: /opt/stackstorm/packs
@@ -1326,6 +1396,14 @@ spec:
13261396
memory: "5Mi"
13271397
cpu: "5m"
13281398
volumes:
1399+
{{- if .Values.secrets.st2.datastore_crypto_key }}
1400+
- name: st2-encryption-key-vol
1401+
secret:
1402+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
1403+
items:
1404+
- key: datastore_crypto_key
1405+
path: datastore_key.json
1406+
{{- end }}
13291407
- name: st2-config-vol
13301408
configMap:
13311409
name: {{ .Release.Name }}-st2-config

‎templates/secrets_datastore_crypto_key.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if .Values.secrets.st2.datastore_crypto_key }}
2+
---
3+
apiVersion: v1
4+
kind: Secret
5+
metadata:
6+
name: {{ .Release.Name }}-st2-datastore-crypto-key
7+
annotations:
8+
description: StackStorm crypto key used to encrypt/decrypt KV records
9+
labels:
10+
app: st2
11+
tier: backend
12+
vendor: stackstorm
13+
support: {{ template "supportMethod" . }}
14+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
15+
release: "{{ .Release.Name }}"
16+
heritage: "{{ .Release.Service }}"
17+
type: Opaque
18+
data:
19+
# Datastore key used to encrypt/decrypt record for the KV store
20+
datastore_crypto_key: {{ .Values.secrets.st2.datastore_crypto_key | b64enc }}
21+
22+
{{- end }}

‎values.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ ingress:
171171
# - chart-example.test
172172

173173
##
174-
## StackStorm HA Cluster Secrets. All fields are required!
174+
## StackStorm HA Cluster Secrets.
175175
## NB! It's highly recommended to change ALL defaults!
176176
##
177177
# TODO: Move to `secrets.yaml` when it gets implemented in Helm (https://github.com/kubernetes/helm/issues/2196) ? (#14)
@@ -213,6 +213,10 @@ secrets:
213213
WE8BWLQ1vBV6c7V4Q0Wp6LuTnNnvu/lvVugJW/TbrzFw6CFe5fEISmIHAMnqVz8x
214214
OdOJyinSM1svoBGnYfyAqINKrqCSGSKmprlMo0Ma3erI7SuojWBS
215215
-----END RSA PRIVATE KEY-----
216+
# ST2 crypto key for the K/V datastore.
217+
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
218+
# Warning! Replace with your own generated key!
219+
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
216220

217221
##
218222
## StackStorm HA Cluster pod settings for each individual service/component.

0 commit comments

Comments
 (0)