Merge changes I78e22429,Ic101f384,I8dd4128b

* changes:
  Use common secret template in mariadb-galera
  Improve common secret template
  Add secret template to common templates

8 files changed, 307 insertions, 38 deletions

diff --git a/kubernetes/common/common/templates/_mariadb.tpl b/kubernetes/common/common/templates/_mariadb.tpl
index cd7142fd73..15fb5a4225 100644
--- a/kubernetes/common/common/templates/_mariadb.tpl
+++ b/kubernetes/common/common/templates/_mariadb.tpl
@@ -41,7 +41,7 @@
 */}}
 {{- define "common.mariadbSecret" -}}
   {{- if .Values.global.mariadbGalera.localCluster -}}
-    {{ printf "%s-%s" (include "common.fullname" .) (index .Values "mariadb-galera" "nameOverride") -}}
+    {{ printf "%s-%s-db-user-credentials" (include "common.fullname" .) (index .Values "mariadb-galera" "nameOverride") -}}
   {{- else -}}
     {{ printf "%s-%s" (.Release.Name) (index .Values "mariadb-init" "nameOverride") -}}
   {{- end -}}
@@ -52,7 +52,7 @@
 */}}
 {{- define "common.mariadbSecretParam" -}}
   {{- if .Values.global.mariadbGalera.localCluster -}}
-    {{ printf "user-password" -}}
+    {{ printf "password" -}}
   {{- else -}}
     {{ printf "db-user-password" -}}
   {{- end -}}
diff --git a/kubernetes/common/common/templates/_secret.yaml b/kubernetes/common/common/templates/_secret.yaml
new file mode 100644
index 0000000000..523d7880f0
--- /dev/null
+++ b/kubernetes/common/common/templates/_secret.yaml
@@ -0,0 +1,276 @@
+{{/*
+# Copyright © 2019 AT&T, Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{/*
+  For internal use only!
+
+  Generates a secret header with given name and desired labels.
+
+  The template takes two arguments:
+    - .global: environment (.)
+    - .name: name of the secret
+
+  Example call:
+    {{ include "common.secret._header" (dict "global" . "name" "myFancyName") }}
+*/}}
+{{- define "common.secret._header" -}}
+{{- $global := .global }}
+{{- $name := .name }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ include "common.namespace" $global }}
+  labels:
+    app: {{ include "common.name" $global }}
+    chart: {{ $global.Chart.Name }}-{{ $global.Chart.Version | replace "+" "_" }}
+    release: {{ $global.Release.Name }}
+    heritage: {{ $global.Release.Service }}
+type: Opaque
+{{- end -}}
+
+{{/*
+  For internal use only!
+
+  Pick a value based on "user input" and generation policy.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .secretName: name of the secret where the value will be placed
+    - .secretEnv: map of values which configures this secret. This can contain below keys:
+        - value: Value of secret key provided by user (can be a template inside a string)
+        - policy: What to do if value is missing or empty. Possible options are:
+            - generate: Generate a new password deriving it from master password
+            - required: Fail the deployment if value has not been provided
+          Defaults to generate.
+        - name: Name of the key to which this value should be assigned
+*/}}
+{{- define "common.secret._value" -}}
+  {{- $global := .global }}
+  {{- $name := .secretName }}
+  {{- $secretEnv := .secretEnv }}
+  {{- $value := tpl $secretEnv.value $global }}
+  {{- $policy := default "generate" $secretEnv.policy }}
+
+  {{- if $value }}
+    {{- $value | quote }}
+  {{- else if eq $policy "generate" }}
+    {{- include "common.createPassword" (dict "dot" $global "uid" $name) | quote }}
+  {{- else }}
+    {{- fail (printf "Value for %s secret %s key not provided" $name $secretEnv.name) }}
+  {{- end }}
+{{- end -}}
+
+
+{{/*
+  For internal use only!
+
+  Generate a secret name based on provided name or UID.
+  If UID is provided then the name is generated by appending this UID right after
+  the chart name. If name is provided, it overrides the name generation algorith
+  and is used right away. Both name and uid strings may contain a template to be
+  resolved.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+    - .name: string that can be used to override default name generation algorithm
+        and provide a custom name for the secret
+*/}}
+{{- define "common.secret._genName" -}}
+  {{- $global := .global }}
+  {{- $uid := tpl (default "" .uid) $global }}
+  {{- $name := tpl (default "" .name) $global }}
+  {{- default (printf "%s-%s" (include "common.fullname" $global) $uid) $name }}
+{{- end -}}
+
+{{/*
+  Get the real secret name by UID or name, based on the configuration provided by user.
+  User may decide to not create a new secret but reuse existing one for this deployment
+  (aka externalSecret). In this case the real name of secret to be used is different
+  than the one declared in secret definition. This easily retrieve current secret real
+  name based on declared name or UID even if it has been overrided by the user using
+  externalSecret option. You should use this template always when you need to reference
+  a secret created using common.secret template by name.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+        (can be omitted if name has been provided)
+    - .name: name which was used to declare a secret
+        (can be omitted if uid has been provided)
+*/}}
+{{- define "common.secret.getSecretName" -}}
+  {{- $global := .global }}
+  {{- $targetName := include "common.secret._genName" (dict "global" $global "uid" .uid "name" .name) }}
+  {{- range $secret := $global.Values.secrets }}
+    {{- $currName := include "common.secret._genName" (dict "global" $global "uid" $secret.uid "name" $secret.name) }}
+    {{- if eq $currName $targetName }}
+      {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
+      {{- default $currName $externalSecret }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+  Convenience template which can be used to easily set the value of environment variable
+  to the value of a key in a secret.
+
+  It takes care of all name mangling, usage of external secrets etc.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+        (can be omitted if name has been provided)
+    - .name: name which was used to declare a secret
+        (can be omitted if uid has been provided)
+    - .key: Key within this secret which value should be assigned to this variable
+
+  Example usage:
+  env:
+    - name: SECRET_PASSWORD
+      {{- include "common.secret.envFromSecret" (dict "global" . "uid" "secret" "key" "password") | indent 8}}
+*/}}
+{{- define "common.secret.envFromSecret" -}}
+  {{- $key := .key }}
+valueFrom:
+  secretKeyRef:
+    name: {{ include "common.secret.getSecretName" . }}
+    key: {{ $key }}
+{{- end -}}
+
+{{/*
+  Define secrets to be used by chart.
+  Every secret has a type which is one of:
+    - generic:
+        Generic secret template that allows to input some raw data (from files).
+        File Input can be passed as list of files (filePaths) or as a single string
+        (filePath)
+    - genericKV:
+        Type of secret which allows you to define a list of key value pairs.
+        The list is assiged to envs value. Every item may define below items:
+          - name:
+              Identifier of this value within secret
+          - value:
+              String that defines a value associated with given key.
+              This can be a simple string or a template.
+          - policy:
+              Defines what to do if value is not provided by the user.
+              Available options are:
+                - generate:
+                    Generate a value by derriving it from master password
+                - required:
+                    Fail the deployment
+    - password:
+        Type of secret that holds only the password.
+        Only two items can be defined for this type:
+          - password:
+              Equivalent of value field from genericKV
+          - policy:
+              The same meaning as for genericKV policy field
+    - basicAuth:
+        Type of secret that holds both username and password.
+        Below fields are available:
+          - login:
+              The value for login key.
+              This can be a simple string or a template.
+              Providing a value for login is always required.
+          - password:
+              The value for password key.
+              This can be a simple string or a template.
+          - passwordPolicy:
+              The same meaning as the policy field in genericKV.
+              Only the policy for password can be set.
+
+  Every secret can be identified using:
+    - uid:
+        A string to be appended to the chart fullname to generate a secret name.
+    - name:
+        Overrides default secret name generation and allows to set immutable
+        and globaly unique name
+
+  To allow sharing a secret between the components and allow to pre-deploy secrets
+  before ONAP deployment it is possible to use already existing secret instead of
+  creating a new one. For this purpose externalSecret field can be used. If value of
+  this field is evaluated to true no new secret is created, only the name of the
+  secret is aliased to the external one.
+
+  Example usage:
+    secrets.yaml:
+      {{ include "common.secret" . }}
+
+    values.yaml:
+      mysqlLogin: "root"
+
+      mysqlExternalSecret: "some-other-secret-name"
+
+      secrets:
+        - uid: "mysql"
+          externalSecret: '{{ tpl .Values.passExternalSecret . }}'
+          type: basicAuth
+          login: '{{ .Values.mysqlLogin }}'
+          mysqlPassword: '{{ .Values.mysqlPassword }}'
+          passwordPolicy: generate
+
+    In the above example new secret is not going to be created.
+    Already existing one (some-other-secret-name) is going to be used.
+    To force creating a new one, just make sure that mysqlExternalSecret
+    is not set.
+
+*/}}
+{{- define "common.secret" -}}
+  {{- $global := . }}
+  {{- range $secret := .Values.secrets }}
+    {{- $name := include "common.secret._genName" (dict "global" $global "uid" $secret.uid "name" $secret.name) }}
+    {{- $type := default "generic" $secret.type }}
+    {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
+    {{- if not $externalSecret }}
+---
+      {{ include "common.secret._header" (dict "global" $global "name" $name) }}
+
+      {{- if eq $type "generic" }}
+data:
+        {{- range $curFilePath := $secret.filePaths }}
+          {{ tpl ($global.Files.Glob $curFilePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+        {{- if $secret.filePath }}
+          {{ tpl ($global.Files.Glob $secret.filePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+      {{- else if eq $type "genericKV" }}
+stringData:
+        {{- if $secret.envs }}
+          {{- range $secretEnv := $secret.envs }}
+            {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+    {{ $secretEnv.name }}: {{ include "common.secret._value" $valueDesc }}
+          {{- end }}
+        {{- end }}
+      {{- else if eq $type "password" }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.policy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+stringData:
+  password: {{ include "common.secret._value" $valueDesc }}
+      {{- else if eq $type "basicAuth" }}
+stringData:
+        {{- $secretEnv := (dict "policy" "required" "name" "login" "value" $secret.login) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  login: {{ include "common.secret._value" $valueDesc }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.passwordPolicy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  password: {{ include "common.secret._value" $valueDesc }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
diff --git a/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml b/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
index a5f1578159..408bd1814c 100644
--- a/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
+++ b/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
@@ -1,5 +1,5 @@
 {{/*
-# Copyright © 2019 Amdocs, Bell Canada
+# Copyright © 2019 Amdocs, Bell Canada, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -86,10 +86,7 @@ spec:
               echo "Backup Successful!!!"
             env:
             - name: DB_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "common.fullname" . }}
-                  key: db-root-password
+              {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-root-password" "key" "password") | indent 14}}
             volumeMounts:
             - name: backup-dir
               mountPath: /backup
@@ -99,10 +96,7 @@ spec:
             imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
             env:
             - name: MYSQL_ROOT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "common.fullname" . }}
-                  key: db-root-password
+              {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-root-password" "key" "password") | indent 14}}
             command:
             - /bin/bash
             - -c
diff --git a/kubernetes/common/mariadb-galera/templates/secrets.yaml b/kubernetes/common/mariadb-galera/templates/secrets.yaml
index 233158f791..3f8eb0b6de 100644
--- a/kubernetes/common/mariadb-galera/templates/secrets.yaml
+++ b/kubernetes/common/mariadb-galera/templates/secrets.yaml
@@ -1,4 +1,5 @@
 # Copyright © 2018 Amdocs, Bell Canada
+# Copyright © 2019 Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,18 +12,4 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "common.fullname" . }}
-  namespace: {{ include "common.namespace" . }}
-  labels:
-    app: {{ include "common.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-type: Opaque
-data:
-  db-root-password: {{ .Values.config.mariadbRootPassword | b64enc | quote }}
-  user-password: {{ default "" .Values.config.userPassword | b64enc | quote }}
\ No newline at end of file
+{{ include "common.secret" . }}
diff --git a/kubernetes/common/mariadb-galera/templates/statefulset.yaml b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
index c3cb4aaaf4..a9f1fb37b7 100644
--- a/kubernetes/common/mariadb-galera/templates/statefulset.yaml
+++ b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
@@ -1,4 +1,4 @@
-# Copyright © 2019 Amdocs, Bell Canada, Orange
+# Copyright © 2019 Amdocs, Bell Canada, Orange, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -61,19 +61,13 @@ spec:
                   apiVersion: v1
                   fieldPath: metadata.namespace
             - name: MYSQL_USER
-              value: {{ default "" .Values.config.userName | quote }}
+              {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-user-credentials" "key" "login") | indent 14}}
             - name: MYSQL_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ template "common.fullname" . }}
-                  key: user-password
+              {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-user-credentials" "key" "password") | indent 14}}
             - name: MYSQL_DATABASE
               value: {{ default "" .Values.config.mysqlDatabase | quote }}
             - name: MYSQL_ROOT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ template "common.fullname" . }}
-                  key: db-root-password
+              {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-root-password" "key" "password") | indent 14}}
           ports:
           - containerPort: {{ .Values.service.internalPort }}
             name: {{ .Values.service.portName }}
diff --git a/kubernetes/common/mariadb-galera/values.yaml b/kubernetes/common/mariadb-galera/values.yaml
index 14215e46de..a6dd1ca359 100644
--- a/kubernetes/common/mariadb-galera/values.yaml
+++ b/kubernetes/common/mariadb-galera/values.yaml
@@ -1,4 +1,5 @@
 # Copyright © 2018 Amdocs, Bell Canada
+# Copyright © 2019 Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,21 @@
 # limitations under the License.
 
 #################################################################
+# Secrets metaconfig
+#################################################################
+secrets:
+  - uid: "db-root-password"
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.config.mariadbRootPasswordExternalSecret) . }}'
+    password: '{{ .Values.config.mariadbRootPassword }}'
+  - uid: "db-user-credentials"
+    type: basicAuth
+    externalSecret: '{{ tpl (default "" .Values.config.userCredentialsExternalSecret) . }}'
+    login: '{{ .Values.config.userName }}'
+    password: '{{ .Values.config.userPassword }}'
+
+
+#################################################################
 # Global configuration defaults.
 #################################################################
 global:
@@ -41,7 +57,9 @@ pullPolicy: IfNotPresent
 
 # application configuration
 config:
+  # .mariadbRootPasswordExternalSecret: 'some-external-secret'
   mariadbRootPassword: secretpassword
+  # .userCredentialsExternalSecret: 'some-external-secret'
   userName: my-user
   userPassword: my-password
   mysqlDatabase: my-database
diff --git a/kubernetes/common/mariadb-init/templates/_mariadb.tpl b/kubernetes/common/mariadb-init/templates/_mariadb.tpl
index 4f111a5f40..fb3f7974b9 100644
--- a/kubernetes/common/mariadb-init/templates/_mariadb.tpl
+++ b/kubernetes/common/mariadb-init/templates/_mariadb.tpl
@@ -19,7 +19,7 @@
 */}}
 {{- define "mariadbInit.mariadbClusterSecret" -}}
   {{- if (eq "default" .Values.global.mariadbGalera.userRootSecret) -}}
-    {{- printf "%s-mariadb-galera-%s" (include "common.release" .) .Values.global.mariadbGalera.nameOverride -}}
+    {{- printf "%s-mariadb-galera-%s-db-root-password" (include "common.release" .) .Values.global.mariadbGalera.nameOverride -}}
   {{- else -}}
     {{- .Values.global.mariadbGalera.userRootSecret -}}
   {{- end -}}
diff --git a/kubernetes/common/mariadb-init/values.yaml b/kubernetes/common/mariadb-init/values.yaml
index 095ff62ddf..d148ba6888 100644
--- a/kubernetes/common/mariadb-init/values.yaml
+++ b/kubernetes/common/mariadb-init/values.yaml
@@ -24,7 +24,7 @@ global:
     servicePort: 3306
     # set these two values if you want to access an 'out of ONAP' mariadb
     userRootSecret: default
-    userRootSecretKey: db-root-password
+    userRootSecretKey: password
 
 #################################################################
 # Application configuration defaults.