From e383b3255e8c26f76d97dc33214c1e4f25c6aa6f Mon Sep 17 00:00:00 2001
From: Krzysztof Opasiak <k.opasiak@samsung.com>
Date: Fri, 7 Feb 2020 15:49:54 +0100
Subject: [NBI] Don't hardcode mariadb-galera password

Let's use common secret template to generate user credentials for NBI
DB and depend on mariadb-galera to generate secure enough root
password.

BTW.
Don't be surprised for now mariadb-galera has a hardcoded root
password but as soon as we move all charts that use it to common
secret template it will be auto generated.

Issue-ID: OOM-2291
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Change-Id: I5d16f6c26aa63a46db98ba3dab3a76267b4049f1
---
 kubernetes/nbi/values.yaml | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

(limited to 'kubernetes/nbi/values.yaml')

diff --git a/kubernetes/nbi/values.yaml b/kubernetes/nbi/values.yaml
index 30f7d2d18e..ba13e3d2f7 100644
--- a/kubernetes/nbi/values.yaml
+++ b/kubernetes/nbi/values.yaml
@@ -29,6 +29,17 @@ global:
     internalPort: 3306
     nameOverride: mariadb-galera
 
+#################################################################
+# Secrets metaconfig
+#################################################################
+secrets:
+  - uid: nbi-db-secret
+    name: '{{ include "common.release" . }}-nbi-db-secret'
+    type: basicAuth
+    externalSecret: '{{ tpl (default "" .Values.config.db.userCredentialsExternalSecret) . }}'
+    login: '{{ .Values.config.db.userName }}'
+    password: '{{ .Values.config.db.userPassword }}'
+
 subChartsOnly:
   enabled: true
 
@@ -49,15 +60,17 @@ config:
   ecompInstanceId: OOM
   openStackRegion: RegionOne
   openStackVNFTenantId: 31047205ce114b60833b23e400d6a535
+  db:
+    userName: rene
+    # userPassword: password
+    # userCredentialsExternalSecret: some-secret
 
 mariadb-galera:
   # '&mariadbConfig' means we "store" the values for  later use in the file
   # with '*mariadbConfig' pointer.
   config: &mariadbConfig
-      userName: rene
-      userPassword: lkjgklqsdareyhjujlnnbvfvdttuiukgpiokqbfsjdhfigquosegombvjfqhb
-      mariadbRootPassword: dhqjdshjdsguryebvcnbvcvdsqghyjqgktgjjfhjfghbfs
-      mysqlDatabase: nbi
+    mysqlExternalSecret: '{{ include "common.release" . }}-nbi-db-secret'
+    mysqlDatabase: nbi
   nameOverride: nbi-galera
   service:
     name: nbi-galera
-- 
cgit 1.2.3-korg