From c817dd241169a5c39483fe848f188438ac4763b5 Mon Sep 17 00:00:00 2001 From: grameshtwilio <83727765+grameshtwilio@users.noreply.github.com> Date: Tue, 22 Aug 2023 16:08:52 -0700 Subject: [PATCH] support datastore password secret created by external resources (#464) This allows the datastore secret object to be created by external agents such as https://github.com/external-secrets/external-secrets --------- Signed-off-by: grameshtwilio Co-authored-by: Faisal Memon --- charts/spire/README.md | 3 +++ charts/spire/charts/spire-server/README.md | 3 +++ .../spire/charts/spire-server/templates/secret.yaml | 11 +++++++++++ .../charts/spire-server/templates/statefulset.yaml | 8 ++++++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 5 files changed, 33 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index b7c72ab..74dca6a 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -322,6 +322,9 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | | spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | | spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | +| spire-server.dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server | +| spire-server.dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password | +| spire-server.dataStore.sql.externalSecret.name | string | `""` | The name of the secret object | | spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" | | spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" | | spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 84fc6ef..cfda011 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -125,6 +125,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | | dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | | dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | +| dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server | +| dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password | +| dataStore.sql.externalSecret.name | string | `""` | The name of the secret object | | dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" | | dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" | | dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" | diff --git a/charts/spire/charts/spire-server/templates/secret.yaml b/charts/spire/charts/spire-server/templates/secret.yaml index fe06f7e..c318280 100644 --- a/charts/spire/charts/spire-server/templates/secret.yaml +++ b/charts/spire/charts/spire-server/templates/secret.yaml @@ -1,4 +1,14 @@ +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (ne .Values.dataStore.sql.password "") }} +{{- fail "dataStore.sql.password should not be set when dataStore.sql.externalSecret is enabled" }} +{{- end }} +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.name "") }} +{{- fail "dataStore.sql.externalSecret.name cannot be empty string when dataStore.sql.externalSecret is enabled" }} +{{- end }} +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.key "") }} +{{- fail "dataStore.sql.externalSecret.key cannot be empty string when dataStore.sql.externalSecret is enabled" }} +{{- end }} {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }} +{{- if not .Values.dataStore.sql.externalSecret.enabled }} apiVersion: v1 kind: Secret metadata: @@ -7,3 +17,4 @@ metadata: data: DBPW: {{ .Values.dataStore.sql.password | b64enc }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index d9fc9a6..151f281 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -83,12 +83,20 @@ spec: - name: PATH value: "/opt/spire/bin:/bin" {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }} + {{- if .Values.dataStore.sql.externalSecret.enabled }} + - name: DBPW + valueFrom: + secretKeyRef: + name: {{ .Values.dataStore.sql.externalSecret.name }} + key: {{ .Values.dataStore.sql.externalSecret.key }} + {{- else }} - name: DBPW valueFrom: secretKeyRef: name: {{ $fullname }}-dbpw key: DBPW {{- end }} + {{- end }} {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} - name: AWS_KMS_ACCESS_KEY_ID valueFrom: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3b943ba..0ecc5ba 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -129,6 +129,14 @@ dataStore: # -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section plugin_data: {} + # -- When an external source creates the secret. The secret should reside in the same namespace as the spire server + externalSecret: + enabled: false + # -- The name of the secret object + name: "" + # -- The key of the secret object whose value is the dataStore.sql password + key: "" + # -- The log level, valid values are "debug", "info", "warn", and "error" logLevel: info # -- The JWT issuer domain