Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -40,14 +40,14 @@ data:
----
====
+
.Minimal `{my-product-secrets}` Secret example
.Minimal {product} Secret example
====
[source,yaml,subs="+attributes,+quotes"]
----
apiVersion: v1
kind: Secret
metadata:
name: {my-product-secrets}
name: `_<my_product_secrets>_`
StringData:
secret11.txt: |
secret-content
Expand All @@ -69,9 +69,14 @@ spec:
key: file12.txt
mountPath: /my/my-rhdh-config-map/path
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_`
key: secret11.txt
mountPath: /my/my-rhdh-secret/path

----
====

[NOTE]
====
`_<my_product_secrets>_` is your preferred {product-short} secret name, specifying the identifier for your secret configuration within {product-short}.
====
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Your changes on this configuration might get reverted on {product-short} restart
* By using the link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/cli_tools/index#cli-about-cli_cli-developer-commands[{openshift-cli}], you have access, with developer permissions, to the {ocp-short} cluster aimed at containing your {product-short} instance.

.Procedure
. Author your custom `{my-product-secrets}.txt` file to provision your secrets as environment variables values in an {ocp-short} secret, rather than in clear text in your configuration files.
. Author your custom `_<my_product_secrets>_.txt` file to provision your secrets as environment variables values in an {ocp-short} secret, rather than in clear text in your configuration files.
It contains one secret per line in `KEY=value` form.
+
* link:{authentication-book-url}[Enter your authentication secrets].
Expand Down Expand Up @@ -71,16 +71,21 @@ $ oc create configmap {my-app-config-config-map} --from-file={my-app-config-file
+
Alternatively, link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/nodes/index#nnodes-pods-configmap-create-from-console_configmaps[create the config map by using the web console].

.. Provision your `{my-product-secrets}.txt` file to the `{my-product-secrets}` secret in the _<{my-product-namespace}>_ project.
.. Provision your `_<my_product_secrets>_.txt` file to the `_<my_product_secrets>_` secret in the _<{my-product-namespace}>_ project.
+
[source,terminal,subs="+attributes,+quotes"]
----
$ oc create secret generic {my-product-secrets} --from-file={my-product-secrets}.txt --namespace={my-product-namespace}
$ oc create secret generic `_<my_product_secrets>_` --from-file=`_<my_product_secrets>_.txt` --namespace={my-product-namespace}
----
+
Alternatively,
link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/nodes/index#nodes-pods-secrets-creating-web-console-secrets_nodes-pods-secrets[create the secret by using the web console].

[NOTE]
====
`_<my_product_secrets>_` is your preferred {product-short} secret name, specifying the identifier for your secret configuration within {product-short}.
====

.Next steps
Consider provisioning additional config maps and secrets:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ spec:
- name: {my-app-config-config-map}
extraEnvs:
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_`
extraFiles:
mountPath: /opt/app-root/src
replicas: 1
Expand Down Expand Up @@ -60,7 +60,7 @@ spec:
dynamicPluginsConfigMapName: dynamic-plugins-rhdh
extraEnvs:
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_`
- name: {my-product-database-secrets}
extraFiles:
mountPath: /opt/app-root/src
Expand Down Expand Up @@ -136,31 +136,36 @@ spec:
`spec.application.extraEnvs.secrets`:::
Enter your environment variables secret name list.
+
.Inject the environment variables in your `{my-product-secrets}` secret
.Inject the environment variables in your {product} secret
====
[source,yaml,subs="+attributes,+quotes"]
----
spec:
application:
extraEnvs:
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_`
----
====
+
.Inject the environment variables in the `{my-product-secrets}` and `{my-product-database-secrets}` secrets
.Inject the environment variables in the {product} and `{my-product-database-secrets}` secrets
====
[source,yaml,subs="+attributes,+quotes"]
----
spec:
application:
extraEnvs:
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_`
- name: {my-product-database-secrets}
----
====

[NOTE]
====
`_<my_product_secrets>_` is your preferred {product-short} secret name, specifying the identifier for your secret configuration within {product-short}.
====

`spec.application.extraFiles.secrets`:::
Enter your certificates files secret name and files list.
+
Expand Down
9 changes: 4 additions & 5 deletions modules/customizing/proc-customizing-the-backend-secret.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,15 @@ You can define your custom {product-short} backend secret.

.Procedure

. To define the {product-short} backend secret,
add to your custom `{my-product-secrets}.txt` file the `BACKEND_SECRET` environment variable with a base64 encoded string.
. To define the {product-short} backend secret, add to your custom `_<my_product_secrets>_.txt` file the `BACKEND_SECRET` environment variable with a base64 encoded string.
Use a unique value for each {product-short} instance.
+
[source,terminal,subs="+attributes"]
[source,yaml,subs="+quotes,+attributes"]
----
$ echo > {my-product-secrets}.txt "BACKEND_SECRET=$(node -p 'require("crypto").randomBytes(24).toString("base64")')"
$ echo > `_<my_product_secrets>_.txt` "BACKEND_SECRET=$(node -p 'require("crypto").randomBytes(24).toString("base64")')"
----
+
.`{my-product-secrets}.txt` example
.`_<my_product_secrets>_.txt` example
----
BACKEND_SECRET=3E2/rIPuZNFCtYHoxVP8wjriffnN1q/z
----
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ You can store the configuration for dynamic plugins in a `ConfigMap` object that

[NOTE]
====
If the `pluginConfig` field references environment variables, you must define the variables in your {my-product-secrets} secret.
If the `pluginConfig` field references environment variables, you must define the variables in your `_<my_product_secrets>_` secret.
====

.Procedure
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,8 @@ data:
<1> The base URL to the Kubernetes control plane. You can run the `kubectl cluster-info` command to get the base URL.
<2> Set the value of this parameter to `false` to enable the verification of the TLS certificate.
<3> Optional: The link to the Kubernetes dashboard managing the ARO cluster.
<4> Optional: Pass the service account token using a `K8S_SERVICE_ACCOUNT_TOKEN` environment variable that you can define in your {my-product-secrets} secret.
<5> Pass the CA data using a `K8S_CONFIG_CA_DATA` environment variable that you can define in your {my-product-secrets} secret.
<4> Optional: Pass the service account token using a `K8S_SERVICE_ACCOUNT_TOKEN` environment variable that you define in your `_<my_product_secrets>_` secret.
<5> Pass the CA data using a `K8S_CONFIG_CA_DATA` environment variable that you define in your `_<my_product_secrets>_` secret.

. Save the configuration changes.

Expand Down
8 changes: 5 additions & 3 deletions modules/installation/proc-deploy-rhdh-instance-eks.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -44,19 +44,20 @@ data:
----
--

. Create a Secret named `{my-product-secrets}` and add a key named `BACKEND_SECRET` with a `Base64-encoded` string as value:
. Create a {product} secret and add a key named `BACKEND_SECRET` with a `Base64-encoded` string as value:
+
--
[source,yaml,subs="+attributes,+quotes"]
----
apiVersion: v1
kind: Secret
metadata:
name: {my-product-secrets}
name: `_<my_product_secrets>_` <1>
stringData:
# TODO: See https://backstage.io/docs/auth/service-to-service-auth/#setup
BACKEND_SECRET: "xxx"
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the unique identifier for your secret configuration within {product-short}.

[IMPORTANT]
====
Expand Down Expand Up @@ -103,8 +104,9 @@ spec:
- name: "app-config-rhdh"
extraEnvs:
secrets:
- name: {my-product-secrets}
- name: `_<my_product_secrets>_` <1>
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the identifier for your secret configuration within {product-short}.
--

. Create an Ingress resource using the following template, ensuring to customize the names as needed:
Expand Down
16 changes: 8 additions & 8 deletions modules/installation/proc-deploy-rhdh-instance-gke.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -45,20 +45,20 @@ data:
----
--

. Create a Secret named {my-product-secret} and add a key named `BACKEND_SECRET` with a `Base64-encoded` string as value:
. Create a `_<my_product_secrets>_` secret and add a key named `BACKEND_SECRET` with a `Base64-encoded` string value as shown in the following example:
+
--
.{my-product-secrets} fragment
[source,yaml]
[source,yaml,subs="+quotes,+attributes"]
----
apiVersion: v1
kind: Secret
metadata:
name: {my-product-secret}
name: `_<my_product_secrets>_` <1>
stringData:
# TODO: See https://backstage.io/docs/auth/service-to-service-auth/#setup
BACKEND_SECRET: "xxx"
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the identifier for your secret configuration within {product-short}.

[IMPORTANT]
====
Expand Down Expand Up @@ -88,7 +88,7 @@ kubectl patch serviceaccount default \
+
--
.Custom resource fragment
[source,yaml,subs="attributes+"]
[source,yaml,subs="+quotes,+attributes"]
----
apiVersion: rhdh.redhat.com/v1alpha3
kind: Backstage
Expand All @@ -106,14 +106,14 @@ spec:
- name: "app-config-rhdh"
extraEnvs:
secrets:
- name: {my-product-secret}
- name: `_<my_product_secrets>_` <1>
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the identifier for your secret configuration within {product-short}.
--

. Set up a Google-managed certificate by creating a `ManagedCertificate` object which you must attach to the Ingress.
. Set up a Google-managed certificate by creating a `ManagedCertificate` object which you must attach to the Ingress as shown in the following example:
+
--
.Example of a `ManagedCertificate` object
[source,yaml,subs="attributes+"]
----
apiVersion: networking.gke.io/v1
Expand Down
12 changes: 7 additions & 5 deletions modules/installation/proc-rhdh-deploy-aks-operator.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -114,24 +114,25 @@ data:
----
--

. Create a Secret named {my-product-secrets} and add a key named `BACKEND_SECRET` with a `Base64-encoded` string value as shown in the following example:
. Create a `_<my_product_secrets>_` secret and add a key named `BACKEND_SECRET` with a `Base64-encoded` string value as shown in the following example:
+
--
[source,yaml]
[source,yaml,subs="+attributes,+quotes"]
----
apiVersion: v1
kind: Secret
metadata:
name: {my-product-secret}
name: `_<my_product_secrets>_` <1>
stringData:
BACKEND_SECRET: "xxx"
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the identifier for your secret configuration within {product-short}.
--

. Create your `{product-custom-resource-type}` custom resource (CR) manifest file named `rhdh.yaml` and include the previously created `rhdh-pull-secret` as follows:
+
--
[source,yaml]
[source,yaml,subs="+attributes,+quotes"]
----
apiVersion: rhdh.redhat.com/v1alpha3
kind: Backstage
Expand All @@ -146,8 +147,9 @@ spec:
- name: "app-config-rhdh"
extraEnvs:
secrets:
- name: {my-product-secret}
- name: `_<my_product_secrets>_` <1>
----
<1> `_<my_product_secrets>_` is your preferred {product-short} secret name, where `_<my_product_secrets>_` specifies the identifier for your secret configuration within {product-short}.
--

. Apply the CR manifest to your namespace:
Expand Down