From 389fca1b6613b63203b865044540c0228c7b813e Mon Sep 17 00:00:00 2001
From: Dominik Mizyn <d.mizyn@samsung.com>
Date: Thu, 9 Apr 2020 22:37:00 +0200
Subject: [Policy] Remove hardcoded credentials from pap

This patch remove hardcoded healthcheck credentials from pap.

Issue-ID: OOM-2342
Change-Id: I8dc2a1b0a84a18215403aabc8ae9b2a25387c3d7
Signed-off-by: Dominik Mizyn <d.mizyn@samsung.com>
---
 .../policy/charts/pap/resources/config/config.json | 12 +++++-----
 .../policy/charts/pap/templates/deployment.yaml    | 12 ++++++++++
 kubernetes/policy/charts/pap/values.yaml           | 28 ++++++++++++++++++++++
 3 files changed, 46 insertions(+), 6 deletions(-)

(limited to 'kubernetes/policy/charts/pap')

diff --git a/kubernetes/policy/charts/pap/resources/config/config.json b/kubernetes/policy/charts/pap/resources/config/config.json
index 544ecdfc32..5c02ce0f12 100644
--- a/kubernetes/policy/charts/pap/resources/config/config.json
+++ b/kubernetes/policy/charts/pap/resources/config/config.json
@@ -20,8 +20,8 @@
     "restServerParameters":{
         "host":"0.0.0.0",
         "port":6969,
-        "userName":"healthcheck",
-        "password":"zb!XztG34",
+        "userName":"${RESTSERVER_USER}",
+        "password":"${RESTSERVER_PASSWORD}",
         "https": true,
         "aaf": false
     },
@@ -69,8 +69,8 @@
         "clientName": "api",
         "hostname": "policy-api",
         "port": 6969,
-        "userName": "healthcheck",
-        "password": "zb!XztG34",
+        "userName": "${API_USER}",
+        "password": "${API_PASSWORD}",
         "useHttps": true,
         "basePath": "policy/api/v1/healthcheck"
     },
@@ -78,8 +78,8 @@
         "clientName": "distribution",
         "hostname": "policy-distribution",
         "port": 6969,
-        "userName": "healthcheck",
-        "password": "zb!XztG34",
+        "userName": "${DISTRIBUTION_USER}",
+        "password": "${DISTRIBUTION_PASSWORD}",
         "useHttps": true,
         "basePath": "healthcheck"
     }]
diff --git a/kubernetes/policy/charts/pap/templates/deployment.yaml b/kubernetes/policy/charts/pap/templates/deployment.yaml
index 85ca9c1486..39ac8a81ec 100644
--- a/kubernetes/policy/charts/pap/templates/deployment.yaml
+++ b/kubernetes/policy/charts/pap/templates/deployment.yaml
@@ -42,6 +42,18 @@ spec:
           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 10 }}
         - name: SQL_PASSWORD
           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 10 }}
+        - name: RESTSERVER_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-secret" "key" "login") | indent 10 }}
+        - name: RESTSERVER_PASSWORD
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-secret" "key" "password") | indent 10 }}
+        - name: API_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "api-secret" "key" "login") | indent 10 }}
+        - name: API_PASSWORD
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "api-secret" "key" "password") | indent 10 }}
+        - name: DISTRIBUTION_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "distribution-secret" "key" "login") | indent 10 }}
+        - name: DISTRIBUTION_PASSWORD
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "distribution-secret" "key" "password") | indent 10 }}
         volumeMounts:
         - mountPath: /config-input
           name: papconfig
diff --git a/kubernetes/policy/charts/pap/values.yaml b/kubernetes/policy/charts/pap/values.yaml
index ad7cf96306..ca0c84f3c9 100644
--- a/kubernetes/policy/charts/pap/values.yaml
+++ b/kubernetes/policy/charts/pap/values.yaml
@@ -34,6 +34,24 @@ secrets:
     login: '{{ .Values.db.user }}'
     password: '{{ .Values.db.password }}'
     passwordPolicy: required
+  - uid: restserver-secret
+    type: basicAuth
+    externalSecret: '{{ tpl (default "" .Values.restServer.credsExternalSecret) . }}'
+    login: '{{ .Values.restServer.user }}'
+    password: '{{ .Values.restServer.password }}'
+    passwordPolicy: required
+  - uid: api-secret
+    type: basicAuth
+    externalSecret: '{{ tpl (default "" .Values.healthCheckRestClient.api.credsExternalSecret) . }}'
+    login: '{{ .Values.healthCheckRestClient.api.user }}'
+    password: '{{ .Values.healthCheckRestClient.api.password }}'
+    passwordPolicy: required
+  - uid: distribution-secret
+    type: basicAuth
+    externalSecret: '{{ tpl (default "" .Values.healthCheckRestClient.distribution.credsExternalSecret) . }}'
+    login: '{{ .Values.healthCheckRestClient.distribution.user }}'
+    password: '{{ .Values.healthCheckRestClient.distribution.password }}'
+    passwordPolicy: required
 
 #################################################################
 # Application configuration defaults.
@@ -51,6 +69,16 @@ debugEnabled: false
 db:
   user: policy_user
   password: policy_user
+restServer:
+  user: healthcheck
+  password: zb!XztG34
+healthCheckRestClient:
+  api:
+    user: healthcheck
+    password: zb!XztG34
+  distribution:
+    user: healthcheck
+    password: zb!XztG34
 
 # default number of instances
 replicaCount: 1
-- 
cgit 1.2.3-korg