Skip to content

Commit d59b8c4

Browse files
author
Valentin TORIKIAN
committed
Refactored secrets handling for datastore key
1 parent 61629ac commit d59b8c4

File tree

5 files changed

+72
-43
lines changed

5 files changed

+72
-43
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* Change ingress name from `<release name>-ingress` to <release name>-st2web-ingress, useful when using `stackstorm-ha` as a requirement for another chart. (#112) (by @erenatas)
55
* Fix st2web ingress which should have been defined as an Integer instead of a String (#111) (by @erenatas)
66
* Add an option to inject hostAliases in the st2actionrunner containers (#114)
7+
* Allow injection of datastore key in cluster (#115) (by @AngryDeveloper)
78

89
## v0.24.0
910
* Fix st2web ingress to use `/` path by default instead of `/*`, useful for nginx ingress controller (#103) (by @erenatas)

‎templates/configmaps_st2-conf.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,9 @@ data:
3737
{{- end }}
3838
port = {{ index .Values "mongodb-ha" "port" }}
3939
{{- end }}
40-
{{- if .Values.st2.datastoreEncryption.enabled }}
40+
{{- if .Values.secrets.st2.datastore_crypto_key }}
4141
[keyvalue]
42-
encryption_key_path = {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}/encryption_key.json
42+
encryption_key_path = /etc/st2/keys/datastore_key.json
4343
{{- end }}
4444
4545
# User-defined st2 config with custom settings applied on top of everything else.

‎templates/deployments.yaml‎

Lines changed: 42 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,9 @@ spec:
201201
- name: st2-config-vol
202202
mountPath: /etc/st2/st2.user.conf
203203
subPath: st2.user.conf
204-
{{- if .Values.st2.datastoreEncryption.enabled }}
204+
{{- if .Values.secrets.st2.datastore_crypto_key }}
205205
- name: st2-encryption-key-vol
206-
mountPath: {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}
206+
mountPath: /etc/st2/keys
207207
readOnly: true
208208
{{- end }}
209209
{{- if .Values.st2.packs.image.repository }}
@@ -217,13 +217,13 @@ spec:
217217
resources:
218218
{{ toYaml .Values.st2api.resources | indent 10 }}
219219
volumes:
220-
{{- if .Values.st2.datastoreEncryption.enabled }}
220+
{{- if .Values.secrets.st2.datastore_crypto_key }}
221221
- name: st2-encryption-key-vol
222222
secret:
223-
secretName: {{ .Values.st2.datastoreEncryption.secret.name }}
223+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
224224
items:
225-
- key: {{ .Values.st2.datastoreEncryption.secret.key | default "datastore_encryption_key.json" }}
226-
path: encryption_key.json
225+
- key: datastore_crypto_key
226+
path: datastore_key.json
227227
{{- end }}
228228
- name: st2-config-vol
229229
configMap:
@@ -460,9 +460,9 @@ spec:
460460
- name: st2-config-vol
461461
mountPath: /etc/st2/st2.user.conf
462462
subPath: st2.user.conf
463-
{{- if .Values.st2.datastoreEncryption.enabled }}
463+
{{- if .Values.secrets.st2.datastore_crypto_key }}
464464
- name: st2-encryption-key-vol
465-
mountPath: {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}
465+
mountPath: /etc/st2/keys
466466
readOnly: true
467467
{{- end }}
468468
resources:
@@ -471,13 +471,13 @@ spec:
471471
- name: st2-config-vol
472472
configMap:
473473
name: {{ .Release.Name }}-st2-config
474-
{{- if .Values.st2.datastoreEncryption.enabled }}
474+
{{- if .Values.secrets.st2.datastore_crypto_key }}
475475
- name: st2-encryption-key-vol
476476
secret:
477-
secretName: {{ .Values.st2.datastoreEncryption.secret.name }}
477+
secretName: datastore_crypto_key
478478
items:
479-
- key: {{ .Values.st2.datastoreEncryption.secret.key | default "datastore_encryption_key.json" }}
480-
path: encryption_key.json
479+
- key: datastore_crypto_key
480+
path: datastore_key.json
481481
{{- end }}
482482
{{- with .Values.st2rulesengine.nodeSelector }}
483483
nodeSelector:
@@ -624,9 +624,9 @@ spec:
624624
- name: st2-config-vol
625625
mountPath: /etc/st2/st2.user.conf
626626
subPath: st2.user.conf
627-
{{- if .Values.st2.datastoreEncryption.enabled }}
627+
{{- if .Values.secrets.st2.datastore_crypto_key }}
628628
- name: st2-encryption-key-vol
629-
mountPath: {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}
629+
mountPath: /etc/st2/keys
630630
readOnly: true
631631
{{- end }}
632632
resources:
@@ -635,12 +635,12 @@ spec:
635635
- name: st2-config-vol
636636
configMap:
637637
name: {{ .Release.Name }}-st2-config
638-
{{- if .Values.st2.datastoreEncryption.enabled }}
638+
{{- if .Values.secrets.st2.datastore_crypto_key }}
639639
- name: st2-encryption-key-vol
640640
secret:
641-
secretName: {{ .Values.st2.datastoreEncryption.secret.name }}
641+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
642642
items:
643-
- key: {{ .Values.st2.datastoreEncryption.secret.key | default "datastore_encryption_key.json" }}
643+
- key: datastore_crypto_key
644644
path: encryption_key.json
645645
{{- end }}
646646
{{- with .Values.st2workflowengine.nodeSelector }}
@@ -923,9 +923,22 @@ spec:
923923
mountPath: /opt/stackstorm/virtualenvs
924924
readOnly: true
925925
{{- end }}
926+
{{- if $.Values.secrets.st2.datastore_crypto_key }}
927+
- name: st2-encryption-key-vol
928+
mountPath: /etc/st2/keys
929+
readOnly: true
930+
{{- end }}
926931
resources:
927932
{{ toYaml .resources | indent 10 }}
928933
volumes:
934+
{{- if $.Values.secrets.st2.datastore_crypto_key }}
935+
- name: st2-encryption-key-vol
936+
secret:
937+
secretName: {{ $.Release.Name }}-st2-datastore-crypto-key
938+
items:
939+
- key: datastore_crypto_key
940+
path: datastore_key.json
941+
{{- end }}
929942
- name: st2-config-vol
930943
configMap:
931944
name: {{ $.Release.Name }}-st2-config
@@ -1049,9 +1062,9 @@ spec:
10491062
- name: st2-ssh-key-vol
10501063
mountPath: /home/stanley/.ssh/
10511064
readOnly: true
1052-
{{- if .Values.st2.datastoreEncryption.enabled }}
1065+
{{- if .Values.secrets.st2.datastore_crypto_key }}
10531066
- name: st2-encryption-key-vol
1054-
mountPath: {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}
1067+
mountPath: /etc/st2/keys
10551068
readOnly: true
10561069
{{- end }}
10571070
{{- if .Values.st2.packs.image.repository }}
@@ -1065,13 +1078,13 @@ spec:
10651078
resources:
10661079
{{ toYaml .Values.st2actionrunner.resources | indent 10 }}
10671080
volumes:
1068-
{{- if .Values.st2.datastoreEncryption.enabled }}
1081+
{{- if .Values.secrets.st2.datastore_crypto_key }}
10691082
- name: st2-encryption-key-vol
10701083
secret:
1071-
secretName: {{ .Values.st2.datastoreEncryption.secret.name }}
1084+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
10721085
items:
1073-
- key: {{ .Values.st2.datastoreEncryption.secret.key | default "datastore_encryption_key.json" }}
1074-
path: encryption_key.json
1086+
- key: datastore_crypto_key
1087+
path: datastore_key.json
10751088
{{- end }}
10761089
- name: st2-config-vol
10771090
configMap:
@@ -1319,9 +1332,9 @@ spec:
13191332
- name: st2-ssh-key-vol
13201333
mountPath: /home/stanley/.ssh/
13211334
readOnly: true
1322-
{{- if .Values.st2.datastoreEncryption.enabled }}
1335+
{{- if .Values.secrets.st2.datastore_crypto_key }}
13231336
- name: st2-encryption-key-vol
1324-
mountPath: {{ .Values.st2.datastoreEncryption.encryptionKeyPath }}
1337+
mountPath: /etc/st2/keys
13251338
readOnly: true
13261339
{{- end }}
13271340
{{- if .Values.st2.packs.image.repository }}
@@ -1341,13 +1354,13 @@ spec:
13411354
memory: "5Mi"
13421355
cpu: "5m"
13431356
volumes:
1344-
{{- if .Values.st2.datastoreEncryption.enabled }}
1357+
{{- if .Values.secrets.st2.datastore_crypto_key }}
13451358
- name: st2-encryption-key-vol
13461359
secret:
1347-
secretName: {{ .Values.st2.datastoreEncryption.secret.name }}
1360+
secretName: {{ .Release.Name }}-st2-datastore-crypto-key
13481361
items:
1349-
- key: {{ .Values.st2.datastoreEncryption.secret.key | default "datastore_encryption_key.json" }}
1350-
path: encryption_key.json
1362+
- key: datastore_crypto_key
1363+
path: datastore_key.json
13511364
{{- end }}
13521365
- name: st2-config-vol
13531366
configMap:

‎templates/secrets_datastore_crypto_key.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if .Values.secrets.st2.datastore_crypto_key }}
2+
---
3+
apiVersion: v1
4+
kind: Secret
5+
metadata:
6+
name: {{ .Release.Name }}-st2-datastore-crypto-key
7+
annotations:
8+
description: StackStorm crypto key used to encrypt/decrypt KV records
9+
labels:
10+
app: st2
11+
tier: backend
12+
vendor: stackstorm
13+
support: {{ template "supportMethod" . }}
14+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
15+
release: "{{ .Release.Name }}"
16+
heritage: "{{ .Release.Service }}"
17+
type: Opaque
18+
data:
19+
# Datastore key used to encrypt/decrypt record for the KV store
20+
datastore_crypto_key: {{ .Values.secrets.st2.datastore_crypto_key | b64enc }}
21+
22+
{{- end }}

‎values.yaml‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -62,17 +62,6 @@ st2:
6262
[api]
6363
allow_origin = '*'
6464
65-
# Optional configuration for handling a precomputed datastore encryption key
66-
datastoreEncryption:
67-
enabled: false
68-
# Where will the key be mounted in the containers
69-
encryptionKeyPath: /etc/st2/keys
70-
# secret:
71-
# # The name of the secret in which the key is stored
72-
# name: st2-encryption-key
73-
# # The key containing the json formated encryption key
74-
# key: datastore_encryption_key.json
75-
7665
# Custom pack configs and image settings.
7766
#
7867
# By default, system packs are available. However, since 'st2 pack install' cannot be run in the k8s cluster,
@@ -162,7 +151,7 @@ ingress:
162151
# - chart-example.test
163152

164153
##
165-
## StackStorm HA Cluster Secrets. All fields are required!
154+
## StackStorm HA Cluster Secrets.
166155
## NB! It's highly recommended to change ALL defaults!
167156
##
168157
# TODO: Move to `secrets.yaml` when it gets implemented in Helm (https://github.com/kubernetes/helm/issues/2196) ? (#14)
@@ -204,6 +193,10 @@ secrets:
204193
WE8BWLQ1vBV6c7V4Q0Wp6LuTnNnvu/lvVugJW/TbrzFw6CFe5fEISmIHAMnqVz8x
205194
OdOJyinSM1svoBGnYfyAqINKrqCSGSKmprlMo0Ma3erI7SuojWBS
206195
-----END RSA PRIVATE KEY-----
196+
# ST2 crypto key for the K/V datastore.
197+
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
198+
# Warning! Replace with your own generated key!
199+
#datastore_crypto_key: {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
207200

208201
##
209202
## StackStorm HA Cluster pod settings for each individual service/component.

0 commit comments

Comments
 (0)