Skip to content

Commit 52d9135

Browse files
rajivmuchelis10
rajivmucheli
and
s10
authored
[KMIP] Support secret-injector (#7701)
Co-authored-by: Vlad Gusev <vlad.esten@gmail.com>
1 parent 1c2f697 commit 52d9135

File tree

8 files changed

+123
-58
lines changed

8 files changed

+123
-58
lines changed

‎openstack/kmip/Chart.lock‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ dependencies:
1010
version: 0.21.0
1111
- name: mariadb
1212
repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm
13-
version: 0.14.2
13+
version: 0.15.3
1414
- name: mysql_metrics
1515
repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm
16-
version: 0.3.5
17-
digest: sha256:11a2527a2f73497204ea9ba1814c4967a0dd5c329ff2d2d80082d002a08b6a69
18-
generated: "2025-01-14T14:19:54.499578+05:30"
16+
version: 0.4.2
17+
digest: sha256:f3f8f5703a69d225a2736842b145fd4a59e04f82c26e613b37fe9e755e018c27
18+
generated: "2025-01-20T14:47:51.708911+05:30"

‎openstack/kmip/Chart.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: v2
23
name: kmip
34
description: A Helm chart for kmip-barbican integration
@@ -15,7 +16,7 @@ type: application
1516
# This is the chart version. This version number should be incremented each time you make changes
1617
# to the chart and its templates, including the app version.
1718
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.1.2
19+
version: 0.2.0
1920

2021
# This is the version number of the application being deployed. This version number should be
2122
# incremented each time you make changes to the application. Versions are not expected to
@@ -36,8 +37,8 @@ dependencies:
3637
- condition: mariadb.enabled
3738
name: mariadb
3839
repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm
39-
version: 0.14.2
40+
version: 0.15.3
4041
- condition: mariadb.enabled
4142
name: mysql_metrics
4243
repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm
43-
version: 0.3.5
44+
version: 0.4.2

‎openstack/kmip/ci/test-values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1+
---
12
global:
3+
tld: test.corp
4+
region: regionOne
25
registry: myImage
36
dbPassword: topSecret
47
barbican_service_password: topSecret
@@ -11,6 +14,7 @@ certs:
1114
server_cert: topSecret
1215
server_key: topSecret
1316
ca_crt: topSecret
17+
1418
kmip:
1519
openstack_env:
1620
username: topSecret
@@ -25,3 +29,12 @@ kmip:
2529
user_domain_name: topSecret
2630
database:
2731
password: topSecret
32+
33+
mariadb:
34+
users:
35+
kmip:
36+
user: kmip
37+
password: topSecret
38+
barbican:
39+
user: barbican
40+
password: topSecret

‎openstack/kmip/templates/_helpers.tpl‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -61,15 +61,6 @@ Create the name of the service account to use
6161
{{- end }}
6262
{{- end }}
6363

64-
{{/*
65-
Create a default fully qualified app name.
66-
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
67-
*/}}
68-
{{- define "fullname" -}}
69-
{{- $name := default .Chart.Name .Values.nameOverride -}}
70-
{{- printf "%s-%s" .Release.Name $name | trunc 63 | replace "_" "-" | trimSuffix "-" -}}
71-
{{- end -}}
72-
73-
{{- define "db_host" -}}
74-
{{.Release.Name}}-mariadb.{{.Release.Namespace}}.svc.kubernetes.{{.Values.global.region}}.{{.Values.global.tld}}
64+
{{- define "kmip.db_host" -}}
65+
{{ include "utils.db_host" . }}.{{ .Release.Namespace }}.svc.kubernetes.{{ .Values.global.region }}.{{ .Values.global.tld }}
7566
{{- end -}}

‎openstack/kmip/templates/deployment.yaml‎

Lines changed: 64 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ spec:
3737
{{- toYaml . | nindent 8 }}
3838
{{- end }}
3939
annotations:
40-
configmap-etc-hash: {{ include (print $.Template.BasePath "/etc-configmap.yaml") . | sha256sum }}
40+
secrets-etc-hash: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
4141
{{- if .Values.proxysql.mode }}
4242
prometheus.io/scrape: "true"
4343
prometheus.io/targets: {{ required ".Values.alerts.prometheus missing" .Values.alerts.prometheus | quote }}
44-
{{- end }}
44+
{{- end }}
4545
spec:
4646
serviceAccountName: {{ include "kmip.serviceAccountName" . }}-barbican
4747
containers:
@@ -56,26 +56,38 @@ spec:
5656
- name: KMIP_MARIADB_SERVICE_PORT
5757
value: "3306"
5858
- name: KMIP_MARIADB_SERVICE_USER
59-
value: {{ .Values.mariadb.users.kmip.user | quote }}
60-
- name: KMIP_MARIADB_SERVICE_PASSWORD
61-
value: {{ .Values.mariadb.users.kmip.password | quote }}
59+
valueFrom:
60+
secretKeyRef:
61+
name: kmip-secrets
62+
key: mariadb_user
63+
- name: KMIP_MARIADB_SERVICE_USER
64+
valueFrom:
65+
secretKeyRef:
66+
name: kmip-secrets
67+
key: mariadb_password
6268
- name: KMIP_MARIADB_NAME
6369
value: "kmip"
6470
- name: BARBICAN_MARIADB_SERVICE_HOST
6571
value: "barbican-mariadb"
6672
- name: BARBICAN_MARIADB_SERVICE_PORT
6773
value: "3306"
6874
- name: BARBICAN_MARIADB_SERVICE_USER
69-
value: {{ .Values.mariadb.users.barbican.user | quote }}
75+
valueFrom:
76+
secretKeyRef:
77+
name: kmip-secrets
78+
key: barbican_mariadb_service_user
7079
- name: BARBICAN_MARIADB_SERVICE_PASSWORD
71-
value: {{ .Values.mariadb.users.barbican.password | quote }}
80+
valueFrom:
81+
secretKeyRef:
82+
name: kmip-secrets
83+
key: barbican_mariadb_service_password
7284
- name: BARBICAN_MARIADB_NAME
7385
value: "barbican"
7486
command: ["sh", "-c"]
7587
args:
7688
- |
77-
echo "Sleeping for 30 seconds before starting the application...";
78-
sleep 30;
89+
echo "Sleeping for 15 seconds before starting the application...";
90+
sleep 15;
7991
echo "Starting the application...";
8092
python /app/app.py;
8193
echo "Application exited. Keeping container alive...";
@@ -93,31 +105,61 @@ spec:
93105
- name: OS_AUTH_URL
94106
value: "https://{{ include "keystone_api_endpoint_host_public" . }}:443/v3"
95107
- name: OS_USERNAME
96-
value: {{ .Values.kmip.openstack_env.username | quote }}
108+
valueFrom:
109+
secretKeyRef:
110+
name: kmip-secrets
111+
key: os_username
97112
- name: OS_PASSWORD
98-
value: {{ .Values.kmip.openstack_env.password | quote }}
113+
valueFrom:
114+
secretKeyRef:
115+
name: kmip-secrets
116+
key: os_password
99117
- name: OS_PROJECT_ID
100-
value: {{ .Values.kmip.openstack_env.project_id | quote }}
118+
valueFrom:
119+
secretKeyRef:
120+
name: kmip-secrets
121+
key: os_project_id
101122
- name: OS_APPLICATION_CREDENTIAL_NAME
102-
value: {{ .Values.kmip.openstack_env.appl_cred_name | quote }}
123+
valueFrom:
124+
secretKeyRef:
125+
name: kmip-secrets
126+
key: os_application_credential_name
103127
- name: OS_APPLICATION_CREDENTIAL_SECRET
104-
value: {{ .Values.kmip.openstack_env.appl_cred_secret | quote }}
128+
valueFrom:
129+
secretKeyRef:
130+
name: kmip-secrets
131+
key: os_application_credential_secret
105132
- name: OS_AUTH_TYPE
106133
value: "v3applicationcredential"
107134
- name: OS_REGION_NAME
108-
value: {{ .Values.kmip.openstack_env.region_name | quote }}
135+
valueFrom:
136+
secretKeyRef:
137+
name: kmip-secrets
138+
key: os_region_name
109139
- name: OS_PROJECT_DOMAIN_NAME
110-
value: {{ .Values.kmip.openstack_env.project_domain_name | quote }}
140+
valueFrom:
141+
secretKeyRef:
142+
name: kmip-secrets
143+
key: os_project_domain_name
111144
- name: OS_IDENTITY_API_VERSION
112-
value: {{ .Values.kmip.openstack_env.identity_api_version | quote }}
145+
valueFrom:
146+
secretKeyRef:
147+
name: kmip-secrets
148+
key: os_identity_api_version
113149
- name: OS_PROJECT_NAME
114-
value: {{ .Values.kmip.openstack_env.project_name | quote }}
150+
valueFrom:
151+
secretKeyRef:
152+
name: kmip-secrets
153+
key: os_project_name
115154
- name: OS_USER_DOMAIN_NAME
116-
value: {{ .Values.kmip.openstack_env.user_domain_name | quote }}
155+
valueFrom:
156+
secretKeyRef:
157+
name: kmip-secrets
158+
key: os_user_domain_name
117159
ports:
118160
- name: http
119161
containerPort: {{ .Values.service.ports.port }}
120-
protocol: TCP
162+
protocol: TCP
121163
resources:
122164
requests:
123165
memory: 0
@@ -141,8 +183,8 @@ spec:
141183
readOnly: true
142184
volumes:
143185
- name: kmip-barbican-etc
144-
configMap:
145-
name: kmip-barbican-etc
186+
secret:
187+
secretName: kmip-barbican-etc
146188
- name: kmip-certificates
147189
secret:
148190
secretName: kmip-certificates

‎openstack/kmip/templates/etc-configmap.yaml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎openstack/kmip/templates/etc/_kmip-server.conf.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[server]
2-
database_path=mysql://kmip:{{ .Values.kmip.database.password }}@{{include "db_host" .}}:3306/kmip
2+
database_path=mysql://kmip:{{ .Values.kmip.database.password | include "resolve_secret" }}@{{include "kmip.db_host" . }}:3306/kmip
33
hostname=0.0.0.0
44
port=5696
55
certificate_path=/etc/pykmip/certs/server.crt

‎openstack/kmip/templates/secrets.yaml‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,41 @@
1+
---
12
apiVersion: v1
23
kind: Secret
34
metadata:
45
name: kmip-certificates
56
type: kubernetes.io/tls
67
data:
7-
tls.crt: |
8-
{{ .Values.certs.server_cert | indent 4 }}
9-
tls.key: |
10-
{{ .Values.certs.server_key | indent 4 }}
11-
ca.crt: |
12-
{{ .Values.certs.ca_crt | indent 4 }}
8+
tls.crt: {{ .Values.certs.server_cert | b64enc | quote }}
9+
tls.key: {{ .Values.certs.server_key | b64enc | quote }}
10+
ca.crt: {{ .Values.certs.ca_crt | b64enc | quote }}
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: kmip-secrets
16+
data:
17+
mariadb_user: {{ .Values.mariadb.users.kmip.user | b64enc | quote }}
18+
mariadb_password: {{ .Values.mariadb.users.kmip.password | b64enc | quote }}
19+
os_username: {{ .Values.kmip.openstack_env.username | b64enc | quote }}
20+
os_password: {{ .Values.kmip.openstack_env.password | b64enc | quote }}
21+
os_project_id: {{ .Values.kmip.openstack_env.project_id | b64enc | quote }}
22+
os_application_credential_name: {{ .Values.kmip.openstack_env.appl_cred_name | b64enc | quote }}
23+
os_application_credential_secret: {{ .Values.kmip.openstack_env.appl_cred_secret | b64enc | quote }}
24+
os_region_name: {{ .Values.kmip.openstack_env.region_name | b64enc | quote }}
25+
os_project_domain_name: {{ .Values.kmip.openstack_env.project_domain_name | b64enc | quote }}
26+
os_identity_api_version: {{ .Values.kmip.openstack_env.identity_api_version | b64enc | quote }}
27+
os_project_name: {{ .Values.kmip.openstack_env.project_name | b64enc | quote }}
28+
os_user_domain_name: {{ .Values.kmip.openstack_env.user_domain_name | b64enc | quote }}
29+
barbican_mariadb_service_user: {{ .Values.mariadb.users.barbican.user | b64enc | quote }}
30+
barbican_mariadb_service_password: {{ .Values.mariadb.users.barbican.password | b64enc | quote }}
31+
---
32+
apiVersion: v1
33+
kind: Secret
34+
metadata:
35+
name: kmip-barbican-etc
36+
labels:
37+
system: openstack
38+
type: configuration
39+
component: barbican
40+
data:
41+
kmip-server.conf: {{ include (print .Template.BasePath "/etc/_kmip-server.conf.tpl") . | b64enc | indent 4 }}

0 commit comments

Comments
 (0)