Skip to content

Added vault feauture #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Added vault feauture #130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6a42a5b
Added vault feauture
Shifna12Zarnaz Aug 1, 2023
42c0439
Made Vault as an optional
Shifna12Zarnaz Aug 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions agent/container/pkg/clients/nats_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
package clients

import (
"context"
"fmt"
"log"
"time"

"github.com/intelops/kubviz/agent/container/pkg/config"

"github.com/intelops/kubviz/credential"
"github.com/nats-io/nats.go"
)

Expand All @@ -27,8 +28,22 @@ type NATSContext struct {
func NewNATSContext(conf *config.Config) (*NATSContext, error) {
fmt.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
time.Sleep(1 * time.Second)

conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))
var token string
if (conf.Enabled){
cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
if err != nil {
return nil, err
}
token=cred["nats"]
}else{
token=conf.NatsToken
}
// cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
// if err != nil {
// return nil, err
// }
// token:=cred["nats"]
conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
if err != nil {
return nil, err
}
Expand Down
12 changes: 12 additions & 0 deletions agent/container/pkg/config/configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,23 @@ package config

// Config will have the configuration details
type Config struct {
Enabled bool `envconfig:"ENABLED"`
NatsAddress string `envconfig:"NATS_ADDRESS"`
CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
EntityName string `envconfig:"NATS_ENTITY_NAME" default:"astra"`


NatsToken string `envconfig:"NATS_TOKEN"`
Port int `envconfig:"PORT"`
StreamName string `envconfig:"STREAM_NAME"`
}
// type VaultConfig struct {

// NatsAddress string `envconfig:"NATS_ADDRESS"`
// CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
// EntityName string `envconfig:"NATS_ENTITY_NAME" default:"astra"`

// }

type GithubConfig struct {
Org string `envconfig:"GITHUB_ORG"`
Expand Down
20 changes: 19 additions & 1 deletion agent/git/pkg/clients/nats_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
package clients

import (
"context"
"fmt"

"github.com/intelops/kubviz/agent/git/pkg/config"
"github.com/intelops/kubviz/credential"
"github.com/intelops/kubviz/model"

"log"
Expand All @@ -30,7 +32,23 @@ func NewNATSContext(conf *config.Config) (*NATSContext, error) {
fmt.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
time.Sleep(1 * time.Second)

conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))
var token string
if (conf.Enabled){
cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
if err != nil {
return nil, err
}
token=cred["nats"]
}else{
token=conf.NatsToken
}
// cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
// if err != nil {
// return nil, err
// }
// token:=cred["nats"]

conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
if err != nil {
return nil, err
}
Expand Down
4 changes: 4 additions & 0 deletions agent/git/pkg/config/configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,11 @@ package config

//Config will have the configuration details
type Config struct {
Enabled bool `envconfig:"ENABLED"`
NatsAddress string `envconfig:"NATS_ADDRESS"`
CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
EntityName string `envconfig:"NATS_ENTITY_NAME" default:"astra"`

NatsToken string `envconfig:"NATS_TOKEN"`
Port int `envconfig:"PORT"`
StreamName string `envconfig:"STREAM_NAME"`
Expand Down
2 changes: 1 addition & 1 deletion charts/agent/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.2.6
version: 0.2.7

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
9 changes: 9 additions & 0 deletions charts/agent/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: "vault-role-kubviz"
data:
roleName: vault-role-kubviz
policyNames: {{ .Values.vault.policyNames | quote }}
servieAccounts: {{ include "agent.serviceAccountName" . }}
servieAccountNameSpaces: {{ .Release.Namespace }}
36 changes: 30 additions & 6 deletions charts/agent/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,11 @@ spec:
env:
- name: CLUSTER_NAME
value: {{ .Values.clusterName }}
- name: NATS_TOKEN
value: {{ .Values.nats.auth.token }}
- name: NATS_ADDRESS
value: {{ .Values.nats.host }}

# - name: NATS_TOKEN
# value: {{ .Values.nats.auth.token }}
# - name: NATS_ADDRESS
# value: {{ .Values.nats.host }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.git_bridge.enabled }}
Expand All @@ -72,6 +73,29 @@ spec:
resources:
{{- toYaml .Values.git_bridge.resources | nindent 12 }}
{{- end }}
{{- if .Values.vault.enabled }}

env:
- name: ENABLED
value: {{ .Values.vault.enabled }}

- name: VAULT_ADDR
value: {{ .Values.vault.address }}
- name: VAULT_ROLE
value: {{ .Values.vault.role }}

- name: NATS_CRED_IDENTIFIER
value: {{ .Values.vault.credidentifier | quote }}
- name: NATS_ENTITY_NAME
value: {{ .Values.vault.entityname | quote }}
{{- else }}
env:
- name: NATS_TOKEN
value: {{ .Values.nats.auth.token }}
- name: NATS_ADDRESS
value: {{ .Values.nats.host }}

{{- end }}
{{- if .Values.container_bridge.enabled }}
- name: container-bridge
image: "{{ .Values.container_bridge.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
Expand All @@ -83,8 +107,8 @@ spec:
env:
- name: CLUSTER_NAME
value: {{ .Values.clusterName }}
- name: NATS_TOKEN
value: {{ .Values.nats.auth.token }}
# - name: NATS_TOKEN
# value: {{ .Values.nats.auth.token }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these also same way, incase vault integration not enabled then we need to inject this variable.

- name: NATS_ADDRESS
value: {{ .Values.nats.host }}
resources:
Expand Down
16 changes: 13 additions & 3 deletions charts/agent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,15 @@ resources:
cpu: 200m
memory: 256Mi

vault:
enabled: true
address: http://vault:8200
role: "vault-role-kubviz"
policyNames: "vault-policy-cluster-admin,vault-policy-cluster-read"
host: kubviz-client-nats
credidentifier: auth-token
entityname: nats

autoscaling:
enabled: false
minReplicas: 1
Expand All @@ -144,6 +153,7 @@ affinity: {}

clusterName: "kubviz"
nats:
host: kubviz-client-nats
auth:
token: "UfmrJOYwYCCsgQvxvcfJ3BdI6c8WBbnD"
enabled: false
host: kubviz-client-nats
auth:
token: "UfmrJOYwYCCsgQvxvcfJ3BdI6c8WBbnD"
2 changes: 1 addition & 1 deletion charts/client/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.2.4
version: 0.2.5

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
10 changes: 10 additions & 0 deletions charts/client/templates/configmap-kubviz.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: "vault-role-kubviz"
data:
roleName: vault-role-kubviz
policyNames: {{ .Values.vault.policyNames | quote }}
servieAccounts: {{ include "client.serviceAccountName" . }}
servieAccountNameSpaces: {{ .Release.Namespace }}

33 changes: 32 additions & 1 deletion charts/client/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,11 +45,42 @@ spec:
# httpGet:
# path: /
# port: http
{{- if .Values.vault.enabled }}

env:
- name: ENABLED
value: {{ .Values.vault.enabled }}

- name: VAULT_ADDR
value: {{ .Values.vault.address }}
- name: VAULT_ROLE
value: {{ .Values.vault.role }}

- name: NATS_CRED_IDENTIFIER
value: {{ .Values.vault.credidentifier | quote }}
- name: NATS_ENTITY_NAME
value: {{ .Values.vault.entityname | quote }}
{{- else }}
env:
- name: NATS_TOKEN
value: {{ .Values.nats.auth.token }}
- name: NATS_ADDRESS
value: {{ include "client.fullname" . }}-nats
value: {{ .Values.nats.host }}

{{- end }}
env:
# - name: VAULT_ADDR
# value: {{ .Values.vault.address }}
# - name: VAULT_ROLE
# value: {{ .Values.vault.role }}
# - name: NATS_CRED_IDENTIFIER
# value: {{ .Values.nats.credidentifier | quote }}
# - name: NATS_ENTITY_NAME
# value: {{ .Values.nats.entityname | quote }}
# - name: NATS_TOKEN
# value: {{ .Values.nats.auth.token }}
# - name: NATS_ADDRESS
# value: {{ include "client.fullname" . }}-nats
- name: DB_ADDRESS
value: {{ include "client.fullname" . }}-clickhouse
- name: DB_PORT
Expand Down
15 changes: 13 additions & 2 deletions charts/client/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,17 @@ resources: {}
# cpu: 100m
# memory: 128Mi



vault:
enabled: true
address: http://vault:8200
role: "vault-role-kubviz"
policyNames: "vault-policy-cluster-admin,vault-policy-cluster-read"
credidentifier: auth-token
entityname: nats


autoscaling:
enabled: false
minReplicas: 1
Expand All @@ -79,10 +90,10 @@ tolerations: []
affinity: {}

nats:
enabled: true

#Authentication setup
auth:
enabled: true
enabled: false
token: "UfmrJOYwYCCsgQvxvcfJ3BdI6c8WBbnD"
nats:
jetstream:
Expand Down
22 changes: 21 additions & 1 deletion client/pkg/clients/clients.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
package clients

import (
"context"
"fmt"
"log"
"time"

"github.com/intelops/kubviz/client/pkg/clickhouse"

"github.com/intelops/kubviz/client/pkg/config"
"github.com/intelops/kubviz/credential"
"github.com/nats-io/nats.go"
)

Expand All @@ -21,7 +24,24 @@ func NewNATSContext(conf *config.Config, dbClient clickhouse.DBInterface) (*NATS
log.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
time.Sleep(1 * time.Second)

conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))

var token string
if (conf.Enabled){
cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
if err != nil {
return nil, err
}
token=cred["nats"]
}else{
token=conf.NatsToken
}
// cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
// if err != nil {
// return nil, err
// }
// token:=cred["nats"]

conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
if err != nil {
return nil, err
}
Expand Down
4 changes: 4 additions & 0 deletions client/pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,11 @@
package config

type Config struct {
Enabled bool `envconfig:"ENABLED"`
NatsAddress string `envconfig:"NATS_ADDRESS"`
CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
EntityName string `envconfig:"NATS_ENTITY_NAME" default:"astra"`

NatsToken string `envconfig:"NATS_TOKEN"`
DbPort int `envconfig:"DB_PORT"`
DBAddress string `envconfig:"DB_ADDRESS"`
Expand Down
27 changes: 27 additions & 0 deletions credential/credential.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
package credential

import (
"context"

"github.com/intelops/go-common/credentials"
"github.com/pkg/errors"
)

const (
credentialType = "cluster-cred"
)

func GetGenericCredential(ctx context.Context, Entity, CredIdentifier string) (map[string]string, error) {
credReader, err := credentials.NewCredentialReader(ctx)
if err != nil {
err = errors.WithMessage(err, "error in initializing credential reader")
return nil, err
}
cred, err := credReader.GetCredential(context.Background(), credentialType, Entity, CredIdentifier)
if err != nil {
err = errors.WithMessage(err, "error in reading credential")
return nil, err
}

return cred, nil
}
Loading