Use secrets for admin user bs
For better security use Kubernetes secrets to set environmental variables for the bootstrapping job - Create secret manifest for the MaaS admin user - Update job-bootstrap-admin-user to use secret for environment setup - Update job-export-api-key to source admin username from secret - Update job-import to source admin username from secret Change-Id: I0ea5a5517c5a90f481c459e836f081f3d2744dad
This commit is contained in:
parent
5cb7936b40
commit
2ad09ad90a
|
@ -42,11 +42,20 @@ spec:
|
||||||
{{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap_admin_user | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
{{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap_admin_user | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
env:
|
env:
|
||||||
- name: ADMIN_USERNAME
|
- name: ADMIN_USERNAME
|
||||||
value: {{ .Values.conf.maas.credentials.admin_username }}
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.secrets.maas_users.admin }}
|
||||||
|
key: USERNAME
|
||||||
- name: ADMIN_PASSWORD
|
- name: ADMIN_PASSWORD
|
||||||
value: {{ .Values.conf.maas.credentials.admin_password }}
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.secrets.maas_users.admin }}
|
||||||
|
key: PASSWORD
|
||||||
- name: ADMIN_EMAIL
|
- name: ADMIN_EMAIL
|
||||||
value: {{ .Values.conf.maas.credentials.admin_email}}
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.secrets.maas_users.admin }}
|
||||||
|
key: EMAIL
|
||||||
command:
|
command:
|
||||||
- /tmp/bootstrap-admin-user.sh
|
- /tmp/bootstrap-admin-user.sh
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
|
|
|
@ -71,7 +71,10 @@ spec:
|
||||||
- name: SECRET_NAMESPACE
|
- name: SECRET_NAMESPACE
|
||||||
value: {{ .Values.conf.maas.credentials.secret.namespace }}
|
value: {{ .Values.conf.maas.credentials.secret.namespace }}
|
||||||
- name: ADMIN_USERNAME
|
- name: ADMIN_USERNAME
|
||||||
value: {{ .Values.conf.maas.credentials.admin_username }}
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.secrets.maas_users.admin }}
|
||||||
|
key: USERNAME
|
||||||
- name: SECRET_NAME
|
- name: SECRET_NAME
|
||||||
value: {{ .Values.conf.maas.credentials.secret.name }}
|
value: {{ .Values.conf.maas.credentials.secret.name }}
|
||||||
command:
|
command:
|
||||||
|
|
|
@ -45,7 +45,10 @@ spec:
|
||||||
- name: JOB_TIMEOUT
|
- name: JOB_TIMEOUT
|
||||||
value: {{ .Values.jobs.import_boot_resources.timeout | quote }}
|
value: {{ .Values.jobs.import_boot_resources.timeout | quote }}
|
||||||
- name: ADMIN_USERNAME
|
- name: ADMIN_USERNAME
|
||||||
value: {{ .Values.conf.maas.credentials.admin_username }}
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.secrets.maas_users.admin }}
|
||||||
|
key: USERNAME
|
||||||
- name: RETRY_TIMER
|
- name: RETRY_TIMER
|
||||||
value: {{ .Values.jobs.import_boot_resources.retry_timer | quote }}
|
value: {{ .Values.jobs.import_boot_resources.retry_timer | quote }}
|
||||||
- name: MAAS_ENDPOINT
|
- name: MAAS_ENDPOINT
|
||||||
|
|
|
@ -0,0 +1,31 @@
|
||||||
|
{{/*
|
||||||
|
Copyright 2017 AT&T Intellectual Property. All other rights reserved.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- $envAll := . }}
|
||||||
|
{{- range $key1, $userClass := tuple "admin" }}
|
||||||
|
{{- $secretName := index $envAll.Values.secrets.maas_users $userClass }}
|
||||||
|
{{- $auth := index $envAll.Values.endpoints.maas_region_ui.auth $userClass }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ $secretName }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
USERNAME: {{ $auth.username | b64enc }}
|
||||||
|
PASSWORD: {{ $auth.password | b64enc }}
|
||||||
|
EMAIL: {{ $auth.email | b64enc }}
|
||||||
|
{{ end }}
|
|
@ -27,6 +27,8 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
serviceName: maas-region-ui
|
serviceName: maas-region-ui
|
||||||
replicas: {{ .Values.pod.replicas.region }}
|
replicas: {{ .Values.pod.replicas.region }}
|
||||||
|
updateStrategy:
|
||||||
|
type: 'RollingUpdate'
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
|
|
|
@ -147,9 +147,6 @@ conf:
|
||||||
database_user: maas
|
database_user: maas
|
||||||
database_password: password
|
database_password: password
|
||||||
credentials:
|
credentials:
|
||||||
admin_username: admin
|
|
||||||
admin_password: admin
|
|
||||||
admin_email: support@nowhere.com
|
|
||||||
secret:
|
secret:
|
||||||
namespace: maas
|
namespace: maas
|
||||||
name: maas-api-key
|
name: maas-api-key
|
||||||
|
@ -158,6 +155,8 @@ secrets:
|
||||||
maas_db:
|
maas_db:
|
||||||
admin: maas-db-admin
|
admin: maas-db-admin
|
||||||
user: maas-db-user
|
user: maas-db-user
|
||||||
|
maas_users:
|
||||||
|
admin: maas-admin
|
||||||
maas_region:
|
maas_region:
|
||||||
name: maas-region-secret
|
name: maas-region-secret
|
||||||
value: 3858f62230ac3c915f300c664312c63f
|
value: 3858f62230ac3c915f300c664312c63f
|
||||||
|
@ -262,6 +261,11 @@ endpoints:
|
||||||
default: null
|
default: null
|
||||||
maas_region_ui:
|
maas_region_ui:
|
||||||
name: maas-region-ui
|
name: maas-region-ui
|
||||||
|
auth:
|
||||||
|
admin:
|
||||||
|
username: admin
|
||||||
|
password: admin
|
||||||
|
email: none@none
|
||||||
hosts:
|
hosts:
|
||||||
default: maas-region-ui
|
default: maas-region-ui
|
||||||
public: maas
|
public: maas
|
||||||
|
|
Loading…
Reference in New Issue