@@ -13,6 +13,7 @@ import (
1313 "github.com/k0sproject/k0s/pkg/apis/k0s/v1beta1"
1414 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
1515 "github.com/sirupsen/logrus"
16+ "golang.org/x/crypto/bcrypt"
1617 "gopkg.in/yaml.v3"
1718 corev1 "k8s.io/api/core/v1"
1819 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
4243 ImageOverride = ""
4344 MigrationsImageOverride = ""
4445 CounterRegex = regexp .MustCompile (`(\d+)/(\d+)` )
46+ Password = ""
4547)
4648
4749// protectedFields are helm values that are not overwritten when upgrading the addon.
@@ -64,6 +66,10 @@ var helmValues = map[string]interface{}{
6466 "replicated.com/disaster-recovery" : "infra" ,
6567 "replicated.com/disaster-recovery-chart" : "kotsadm" ,
6668 },
69+ "passwordSecretRef" : map [string ]interface {}{
70+ "name" : "kotsadm-password" ,
71+ "key" : "passwordBcrypt" ,
72+ },
6773}
6874
6975func init () {
@@ -160,31 +166,16 @@ func (a *AdminConsole) GetCurrentChartConfig() *v1beta1.Chart {
160166 return nil
161167}
162168
163- // addPasswordToHelmValues adds the adminconsole password to the helm values.
164- func (a * AdminConsole ) addPasswordToHelmValues () error {
165- curconfig := a .GetCurrentChartConfig ()
166- if curconfig == nil {
167- pass , err := a .askPassword ()
168- if err != nil {
169- return fmt .Errorf ("unable to ask password: %w" , err )
170- }
171- helmValues ["password" ] = pass
172- return nil
173- }
174- pass , err := getPasswordFromConfig (curconfig )
175- if err != nil {
176- return fmt .Errorf ("unable to get password from current config: %w" , err )
177- }
178- helmValues ["password" ] = pass
179- return nil
180- }
181-
182169// GenerateHelmConfig generates the helm config for the adminconsole and writes the charts to
183170// the disk.
184171func (a * AdminConsole ) GenerateHelmConfig (onlyDefaults bool ) ([]v1beta1.Chart , []v1beta1.Repository , error ) {
185172 if ! onlyDefaults {
186- if err := a .addPasswordToHelmValues (); err != nil {
187- return nil , nil , fmt .Errorf ("unable to add password to helm values: %w" , err )
173+ if Password == "" {
174+ var err error
175+ Password , err = a .askPassword ()
176+ if err != nil {
177+ return nil , nil , fmt .Errorf ("unable to set kotsadm-password: %w" , err )
178+ }
188179 }
189180 helmValues ["embeddedClusterID" ] = metrics .ClusterID ().String ()
190181 if a .airgapBundle != "" {
@@ -218,6 +209,10 @@ func (a *AdminConsole) Outro(ctx context.Context, cli client.Client) error {
218209 loading .Infof ("Waiting for Admin Console to deploy" )
219210 defer loading .Close ()
220211
212+ if err := createKotsPasswordSecret (ctx , cli , a .namespace , Password ); err != nil {
213+ return fmt .Errorf ("unable to create kots password secret: %w" , err )
214+ }
215+
221216 if a .airgapBundle != "" {
222217 err := createRegistrySecret (ctx , cli , a .namespace )
223218 if err != nil {
@@ -330,10 +325,47 @@ func createRegistrySecret(ctx context.Context, cli client.Client, namespace stri
330325 },
331326 Type : "kubernetes.io/dockerconfigjson" ,
332327 }
328+
333329 err := cli .Create (ctx , & registryCreds )
334330 if err != nil {
335331 return fmt .Errorf ("unable to create registry-auth secret: %w" , err )
336332 }
337333
338334 return nil
339335}
336+
337+ func createKotsPasswordSecret (ctx context.Context , cli client.Client , namespace string , password string ) error {
338+ if err := kubeutils .WaitForNamespace (ctx , cli , namespace ); err != nil {
339+ return err
340+ }
341+
342+ passwordBcrypt , err := bcrypt .GenerateFromPassword ([]byte (password ), 10 )
343+ if err != nil {
344+ return fmt .Errorf ("unable to generate bcrypt from password: %w" , err )
345+ }
346+
347+ kotsPasswordSecret := corev1.Secret {
348+ TypeMeta : metav1.TypeMeta {
349+ Kind : "Secret" ,
350+ APIVersion : "v1" ,
351+ },
352+ ObjectMeta : metav1.ObjectMeta {
353+ Name : "kotsadm-password" ,
354+ Namespace : namespace ,
355+ Labels : map [string ]string {
356+ "kots.io/kotsadm" : "true" ,
357+ "replicated.com/disaster-recovery" : "infra" ,
358+ },
359+ },
360+ Data : map [string ][]byte {
361+ "passwordBcrypt" : []byte (passwordBcrypt ),
362+ },
363+ }
364+
365+ err = cli .Create (ctx , & kotsPasswordSecret )
366+ if err != nil {
367+ return fmt .Errorf ("unable to create kotsadm-password secret: %w" , err )
368+ }
369+
370+ return nil
371+ }
0 commit comments