Skip to content

Commit a344ad4

Browse files
migmartrimigmartri
authored
feat(deployment): Azure KeyVault support (#389)
Signed-off-by: Miguel Martinez Trivino <[email protected]>
1 parent 9f0165b commit a344ad4

File tree

4 files changed

+36
-15
lines changed

4 files changed

+36
-15
lines changed

‎deployment/chainloop/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Chainloop is an open source software supply chain control plane, a
44

55
type: application
66
# Bump the patch (not minor, not major) version on each change in the Chart Source code
7-
version: 1.19.0
7+
version: 1.19.1
88
# Do not update appVersion, this is handled automatically by the release process
99
appVersion: v0.20.0
1010

‎deployment/chainloop/README.md‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -383,17 +383,21 @@ chainloop config save \
383383
384384
### Secrets Backend
385385
386-
| Name | Description | Value |
387-
| --------------------------------------------------- | ------------------------------------------------------------------------ | ----------- |
388-
| `secretsBackend.backend` | Secrets backend type ("vault", "awsSecretManager" or "gcpSecretManager") | `vault` |
389-
| `secretsBackend.secretPrefix` | Prefix that will be pre-pended to all secrets in the storage backend | `chainloop` |
390-
| `secretsBackend.vault.address` | Vault address | |
391-
| `secretsBackend.vault.token` | Vault authentication token | |
392-
| `secretsBackend.awsSecretManager.accessKey` | AWS Access KEY ID | |
393-
| `secretsBackend.awsSecretManager.secretKey` | AWS Secret Key | |
394-
| `secretsBackend.awsSecretManager.region` | AWS Secret Manager Region | |
395-
| `secretsBackend.gcpSecretManager.projectId` | GCP Project ID | |
396-
| `secretsBackend.gcpSecretManager.serviceAccountKey` | GCP Auth Key | |
386+
| Name | Description | Value |
387+
| --------------------------------------------------- | ----------------------------------------------------------------------------------------- | ----------- |
388+
| `secretsBackend.backend` | Secrets backend type ("vault", "awsSecretManager" or "gcpSecretManager", "azureKeyVault") | `vault` |
389+
| `secretsBackend.secretPrefix` | Prefix that will be pre-pended to all secrets in the storage backend | `chainloop` |
390+
| `secretsBackend.vault.address` | Vault address | |
391+
| `secretsBackend.vault.token` | Vault authentication token | |
392+
| `secretsBackend.awsSecretManager.accessKey` | AWS Access KEY ID | |
393+
| `secretsBackend.awsSecretManager.secretKey` | AWS Secret Key | |
394+
| `secretsBackend.awsSecretManager.region` | AWS Secret Manager Region | |
395+
| `secretsBackend.gcpSecretManager.projectId` | GCP Project ID | |
396+
| `secretsBackend.gcpSecretManager.serviceAccountKey` | GCP Auth Key | |
397+
| `secretsBackend.azureKeyVault.tenantID` | Active Directory Tenant ID | |
398+
| `secretsBackend.azureKeyVault.clientID` | Registered application / service principal client ID | |
399+
| `secretsBackend.azureKeyVault.clientSecret` | Service principal client secret | |
400+
| `secretsBackend.azureKeyVault.vaultURI` | Azure Key Vault URL | |
397401
398402
### Authentication
399403

‎deployment/chainloop/templates/_helpers.tpl‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,12 @@ gcpSecretManager:
8484
{{- if eq .gcpSecretManager.serviceAccountKey "" }}
8585
{{- fail ".Values.secretsBackend.gcpSecretManager.serviceAccountKey not set" }}
8686
{{- end }}
87-
87+
{{- else if eq .backend "azureKeyVault" }}
88+
azure_key_vault:
89+
tenant_id: {{ required "AD tenantID required" .azureKeyVault.tenantID | quote }}
90+
client_id: {{ required "Service principal ID required" .azureKeyVault.clientID | quote }}
91+
client_secret: {{ required "Service principal secret required" .azureKeyVault.clientSecret | quote }}
92+
vault_uri: {{ required "Azure Vault URL required" .azureKeyVault.vaultURI | quote }}
8893
{{- end }}
8994
{{- end }}
9095
{{- end -}}

‎deployment/chainloop/values.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ GKEMonitoring:
2222

2323
## Location where to store sensitive data. If development.true? and no overrides provided, the setup will connect to a development instance of Vault
2424
secretsBackend:
25-
## @param secretsBackend.backend Secrets backend type ("vault", "awsSecretManager" or "gcpSecretManager")
25+
## @param secretsBackend.backend Secrets backend type ("vault", "awsSecretManager" or "gcpSecretManager", "azureKeyVault")
2626
##
27-
backend: "vault" # "awsSecretManager"
27+
backend: "vault" # "awsSecretManager | gcpSecretManager | azureKeyVault"
2828
## @param secretsBackend.secretPrefix Prefix that will be pre-pended to all secrets in the storage backend
2929
##
3030
secretPrefix: "chainloop"
@@ -53,6 +53,17 @@ secretsBackend:
5353
# projectId: ""
5454
# serviceAccountKey: ""
5555

56+
## @extra secretsBackend.azureKeyVault.tenantID Active Directory Tenant ID
57+
## @extra secretsBackend.azureKeyVault.clientID Registered application / service principal client ID
58+
## @extra secretsBackend.azureKeyVault.clientSecret Service principal client secret
59+
## @extra secretsBackend.azureKeyVault.vaultURI Azure Key Vault URL
60+
##
61+
# azureKeyVault:
62+
# tenantID: ""
63+
# clientID: ""
64+
# clientSecret: ""
65+
# vaultURI: ""
66+
5667
## @section Authentication
5768
##
5869

@@ -634,6 +645,7 @@ cas:
634645
## @skip cas.ingressAPI.annotations.nginx.ingress.kubernetes.io/backend-protocol
635646
## Tell Nginx Ingress Controller to expect gRPC traffic
636647
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
648+
## @skip cas.ingressAPI.annotations.nginx.ingress.kubernetes.io/client-body-buffer-size
637649
# Improve upload speed by adding client buffering used by http2 control-flows
638650
# https://github.com/chainloop-dev/chainloop/issues/375
639651
nginx.ingress.kubernetes.io/client-body-buffer-size: "3M"

0 commit comments

Comments
 (0)