panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

support datastore password secret created by external resources (#464)

Browse Source 
This allows the datastore secret object to be created by external agents
such as https://github.com/external-secrets/external-secrets

---------

Signed-off-by: grameshtwilio <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
grameshtwilio
2023-08-22 16:08:52 -07:00
committed by GitHub
co-authored by Faisal Memon
parent 71ac5afa11
commit c817dd2411
5 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+3
View File
@@ -322,6 +322,9 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| spire-server.dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server |
| spire-server.dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password |
| spire-server.dataStore.sql.externalSecret.name | string | `""` | The name of the secret object |
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
charts/spire/charts/spire-server/README.md
+3
View File
@@ -125,6 +125,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server |
| dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password |
| dataStore.sql.externalSecret.name | string | `""` | The name of the secret object |
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
charts/spire/charts/spire-server/templates/secret.yaml
+11
View File
@@ -1,4 +1,14 @@
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (ne .Values.dataStore.sql.password "") }}
{{- fail "dataStore.sql.password should not be set when dataStore.sql.externalSecret is enabled" }}
{{- end }}
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.name "") }}
{{- fail "dataStore.sql.externalSecret.name cannot be empty string when dataStore.sql.externalSecret is enabled" }}
{{- end }}
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.key "") }}
{{- fail "dataStore.sql.externalSecret.key cannot be empty string when dataStore.sql.externalSecret is enabled" }}
{{- end }}
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
{{- if not .Values.dataStore.sql.externalSecret.enabled }}
apiVersion: v1
kind: Secret
metadata:
@@ -7,3 +17,4 @@ metadata:
data:
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/statefulset.yaml
+8
View File
@@ -83,12 +83,20 @@ spec:
- name: PATH
value: "/opt/spire/bin:/bin"
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
{{- if .Values.dataStore.sql.externalSecret.enabled }}
- name: DBPW
valueFrom:
secretKeyRef:
name: {{ .Values.dataStore.sql.externalSecret.name }}
key: {{ .Values.dataStore.sql.externalSecret.key }}
{{- else }}
- name: DBPW
valueFrom:
secretKeyRef:
name: {{ $fullname }}-dbpw
key: DBPW
{{- end }}
{{- end }}
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
- name: AWS_KMS_ACCESS_KEY_ID
valueFrom:
charts/spire/charts/spire-server/values.yaml
+8
View File
@@ -129,6 +129,14 @@ dataStore:
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
plugin_data: {}
# -- When an external source creates the secret. The secret should reside in the same namespace as the spire server
externalSecret:
enabled: false
# -- The name of the secret object
name: ""
# -- The key of the secret object whose value is the dataStore.sql password
key: ""
# -- The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
# -- The JWT issuer domain