Merge pull request #96 from marklogic/features/CLD-701-secret-as-file

CLD-701 pass admin user and password using file

Author: Romain Winieski

charts/templates/statefulset.yaml

@@ -27,10 +27,16 @@ spec:
       initContainers: 
       - name: configure-group
         image: "{{ .Values.initContainerImage.repository }}:{{ .Values.initContainerImage.tag }}"
+        volumeMounts:
+            - name: mladmin-secrets
+              mountPath: /run/secrets/ml-secrets
+              readOnly: true
         command:
           - sh
           - '-c'
           - |
+            MARKLOGIC_ADMIN_USERNAME="$(< /run/secrets/ml-secrets/username)"
+            MARKLOGIC_ADMIN_PASSWORD="$(< /run/secrets/ml-secrets/password)"
             log () {
                       local TIMESTAMP=$(date +"%Y-%m-%d %T.%3N")
                       echo "${TIMESTAMP}  $@"
@@ -69,16 +75,10 @@ spec:
               exit 1
             fi                      
         env: 
-        - name: MARKLOGIC_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "marklogic.fullname" . }}-admin
-              key: username
-        - name: MARKLOGIC_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "marklogic.fullname" . }}-admin
-              key: password
+        - name: MARKLOGIC_ADMIN_USERNAME_FILE
+          value: "ml-secrets/username"
+        - name: MARKLOGIC_ADMIN_PASSWORD_FILE
+          value: "ml-secrets/password"
         - name: POD_NAME
           valueFrom:
             fieldRef:
@@ -92,6 +92,9 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy}}
           volumeMounts:
+            - name: mladmin-secrets
+              mountPath: "/run/secrets/ml-secrets"
+              readOnly: false
             - name: datadir
               mountPath: /var/opt/MarkLogic
             {{- if .Values.extraVolumeMounts }}
@@ -101,16 +104,10 @@ spec:
               mountPath: /run/secrets/ml-secrets
               readOnly: true
           env:
-            - name: MARKLOGIC_ADMIN_USERNAME
-              valueFrom:
-                  secretKeyRef:
-                    name: {{ include "marklogic.fullname" . }}-admin
-                    key: username
-            - name: MARKLOGIC_ADMIN_PASSWORD
-              valueFrom:
-                  secretKeyRef:
-                    name: {{ include "marklogic.fullname" . }}-admin
-                    key: password
+            - name: MARKLOGIC_ADMIN_USERNAME_FILE
+              value: "ml-secrets/username"
+            - name: MARKLOGIC_ADMIN_PASSWORD_FILE
+              value: "ml-secrets/password"
             {{- if .Values.auth.walletPassword }}
             - name: MARKLOGIC_WALLET_PASSWORD_FILE
               value: ml-secrets/wallet-password
@@ -152,6 +149,9 @@ spec:
                   - bash
                   - '-c'
                   - |
+                    MARKLOGIC_ADMIN_USERNAME="$(< /run/secrets/ml-secrets/username)"
+                    MARKLOGIC_ADMIN_PASSWORD="$(< /run/secrets/ml-secrets/password)"
+                    
                     pid=$(pgrep start.marklogic)
 
                     log () {
@@ -185,6 +185,9 @@ spec:
                   - bash
                   - '-c'
                   - |
+                    MARKLOGIC_ADMIN_USERNAME="$(< /run/secrets/ml-secrets/username)"
+                    MARKLOGIC_ADMIN_PASSWORD="$(< /run/secrets/ml-secrets/password)"
+
                     log () {
                       local TIMESTAMP=$(date +"%Y-%m-%d %T.%3N")
                       # Check to make sure pod doesn't terminate if PID value is empty for any reason
@@ -213,14 +216,14 @@ spec:
 
                             while (true)
                             do
-                               ml_status=$(service MarkLogic status)
-                               log "Info: [prestop] MarkLogic Status: "$ml_status
-                               if [[ "$ml_status" =~ "running" ]]; then
+                              ml_status=$(service MarkLogic status)
+                              log "Info: [prestop] MarkLogic Status: "$ml_status
+                              if [[ "$ml_status" =~ "running" ]]; then
                                   sleep 5s
                                   continue
-                               else
+                              else
                                   break
-                               fi
+                              fi
                             done
                             break
                         else
@@ -297,6 +300,9 @@ spec:
       imagePullSecrets:
         - name: {{ include "marklogic.fullname" . }}-registry
       {{- end }}
+      dnsConfig:
+        searches:
+          - {{ include "marklogic.headlessURL" . }}
       volumes:
         - name: mladmin-secrets
           secret:
@@ -341,6 +347,7 @@ spec:
         resources:
           requests:
             storage: {{ .Values.persistence.size }}
+  {{- end }}
     {{- if .Values.additionalVolumeClaimTemplates }}
     {{- toYaml .Values.additionalVolumeClaimTemplates | nindent 4 }}
     {{- end }}

charts/values.yaml

@@ -142,6 +142,17 @@ service:
   annotations: {}
 
   type: ClusterIP
+  ports:
+    - protocol: TCP
+      name: query-console
+      port: 8000
+    - protocol: TCP
+      name: admin
+      port: 8001
+    - protocol: TCP
+      name: manage
+      port: 8002
+
   ## Service listener port configuration
   ## ref: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/