blob: 9f41906c9ed36a97ed3fcdc7a63a5265a460030e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
|
{{/*
# Copyright © 2019 AT&T, Samsung Electronics
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
*/}}
{{/*
For internal use only!
Generates a secret header with given name and desired labels.
The template takes two arguments:
- .global: environment (.)
- .name: name of the secret
- .annotations: annotations which should be used
Example call:
{{ include "common.secret._header" (dict "global" . "name" "myFancyName") }}
*/}}
{{- define "common.secret._header" -}}
{{- $global := .global }}
{{- $name := .name }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $name }}
namespace: {{ include "common.namespace" $global }}
labels:
app: {{ include "common.name" $global }}
chart: {{ $global.Chart.Name }}-{{ $global.Chart.Version | replace "+" "_" }}
release: {{ include "common.release" $global }}
heritage: {{ $global.Release.Service }}
{{- if .annotations }}
annotations: {{- include "common.tplValue" (dict "value" .annotations "context" $global) | nindent 4 }}
{{- end }}
type: Opaque
{{- end -}}
{{/*
For internal use only!
Pick a value based on "user input" and generation policy.
The template takes below arguments:
- .global: environment (.)
- .secretName: name of the secret where the value will be placed
- .secretEnv: map of values which configures this secret. This can contain below keys:
- value: Value of secret key provided by user (can be a template inside a string)
- policy: What to do if value is missing or empty. Possible options are:
- generate: Generate a new password deriving it from master password
- required: Fail the deployment if value has not been provided
Defaults to generate.
- name: Name of the key to which this value should be assigned
*/}}
{{- define "common.secret._value" -}}
{{- $global := .global }}
{{- $name := .secretName }}
{{- $secretEnv := .secretEnv }}
{{- $value := tpl $secretEnv.value $global }}
{{- $policy := default "generate" $secretEnv.policy }}
{{- if $value }}
{{- $value | quote }}
{{- else if eq $policy "generate" }}
{{- include "common.createPassword" (dict "dot" $global "uid" $name) | quote }}
{{- else }}
{{- fail (printf "Value for %s secret %s key not provided" $name $secretEnv.name) }}
{{- end }}
{{- end -}}
{{/*
Generate a secret name based on provided name or UID.
If UID is provided then the name is generated by appending this UID right after
the chart name. If name is provided, it overrides the name generation algorith
and is used right away. Both name and uid strings may contain a template to be
resolved.
The template takes below arguments:
- .global: environment (.)
- .uid: string that uniquely identifies this secret within a helm chart
- .name: string that can be used to override default name generation algorithm
and provide a custom name for the secret
*/}}
{{- define "common.secret.genName" -}}
{{- $global := .global }}
{{- $uid := tpl (default "" .uid) $global }}
{{- $name := tpl (default "" .name) $global }}
{{- $fullname := ne (default "" .chartName) "" | ternary (include "common.fullnameExplicit" (dict "dot" $global "chartName" .chartName)) (include "common.fullname" $global) }}
{{- default (printf "%s-%s" $fullname $uid) $name }}
{{- end -}}
{{/*
Get the real secret name by UID or name, based on the configuration provided by user.
User may decide to not create a new secret but reuse existing one for this deployment
(aka externalSecret). In this case the real name of secret to be used is different
than the one declared in secret definition. This easily retrieve current secret real
name based on declared name or UID even if it has been overrided by the user using
externalSecret option. You should use this template always when you need to reference
a secret created using common.secret template by name.
The template takes below arguments:
- .global: environment (.)
- .uid: string that uniquely identifies this secret within a helm chart
(can be omitted if name has been provided)
- .name: name which was used to declare a secret
(can be omitted if uid has been provided)
*/}}
{{- define "common.secret.getSecretName" -}}
{{- $global := .global }}
{{- $name := tpl (default "" .name) $global }}
{{- $uid := tpl (default "" .uid) $global }}
{{- $targetName := default (include "common.secret.genName" (dict "global" $global "uid" $uid "name" .name)) $name}}
{{- range $secret := $global.Values.secrets }}
{{- $givenName := tpl (default "" $secret.name) $global }}
{{- $currUID := tpl (default "" $secret.uid) $global }}
{{- $currName := default (include "common.secret.genName" (dict "global" $global "uid" $currUID "name" $secret.name)) $givenName }}
{{- if or (eq $uid $currUID) (eq $currName $targetName) }}
{{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
{{- default $currName $externalSecret }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Convenience template which can be used to easily set the value of environment variable
to the value of a key in a secret.
It takes care of all name mangling, usage of external secrets etc.
The template takes below arguments:
- .global: environment (.)
- .uid: string that uniquely identifies this secret within a helm chart
(can be omitted if name has been provided)
- .name: name which was used to declare a secret
(can be omitted if uid has been provided)
- .key: Key within this secret which value should be assigned to this variable
Example usage:
env:
- name: SECRET_PASSWORD
{{- include "common.secret.envFromSecret" (dict "global" . "uid" "secret" "key" "password") | indent 8}}
*/}}
{{- define "common.secret.envFromSecret" -}}
{{- $key := .key }}
valueFrom:
secretKeyRef:
name: {{ include "common.secret.getSecretName" . }}
key: {{ $key }}
{{- end -}}
{{/*
Define secrets to be used by chart.
Every secret has a type which is one of:
- generic:
Generic secret template that allows to input some raw data (from files).
File Input can be passed as list of files (filePaths) or as a single string
(filePath)
- genericKV:
Type of secret which allows you to define a list of key value pairs.
The list is assiged to envs value. Every item may define below items:
- name:
Identifier of this value within secret
- value:
String that defines a value associated with given key.
This can be a simple string or a template.
- policy:
Defines what to do if value is not provided by the user.
Available options are:
- generate:
Generate a value by derriving it from master password
- required:
Fail the deployment
- password:
Type of secret that holds only the password.
Only two items can be defined for this type:
- password:
Equivalent of value field from genericKV
- policy:
The same meaning as for genericKV policy field
- basicAuth:
Type of secret that holds both username and password.
Below fields are available:
- login:
The value for login key.
This can be a simple string or a template.
Providing a value for login is always required.
- password:
The value for password key.
This can be a simple string or a template.
- passwordPolicy:
The same meaning as the policy field in genericKV.
Only the policy for password can be set.
Every secret can be identified using:
- uid:
A string to be appended to the chart fullname to generate a secret name.
- name:
Overrides default secret name generation and allows to set immutable
and globaly unique name
- annotations:
List of annotations to be used while defining a secret
To allow sharing a secret between the components and allow to pre-deploy secrets
before ONAP deployment it is possible to use already existing secret instead of
creating a new one. For this purpose externalSecret field can be used. If value of
this field is evaluated to true no new secret is created, only the name of the
secret is aliased to the external one.
Example usage:
secrets.yaml:
{{ include "common.secret" . }}
values.yaml:
mysqlLogin: "root"
mysqlExternalSecret: "some-other-secret-name"
secrets:
- uid: "mysql"
externalSecret: '{{ tpl .Values.passExternalSecret . }}'
type: basicAuth
login: '{{ .Values.mysqlLogin }}'
mysqlPassword: '{{ .Values.mysqlPassword }}'
passwordPolicy: generate
In the above example new secret is not going to be created.
Already existing one (some-other-secret-name) is going to be used.
To force creating a new one, just make sure that mysqlExternalSecret
is not set.
*/}}
{{- define "common.secret" -}}
{{- $global := . }}
{{- range $secret := .Values.secrets }}
{{- $uid := tpl (default "" $secret.uid) $global }}
{{- $name := include "common.secret.genName" (dict "global" $global "uid" $uid "name" $secret.name) }}
{{- $annotations := default "" $secret.annotations }}
{{- $type := default "generic" $secret.type }}
{{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
{{- if not $externalSecret }}
---
{{ include "common.secret._header" (dict "global" $global "name" $name "annotations" $annotations) }}
{{- if eq $type "generic" }}
data:
{{- range $curFilePath := $secret.filePaths }}
{{ tpl ($global.Files.Glob $curFilePath).AsSecrets $global | indent 2 }}
{{- end }}
{{- if $secret.filePath }}
{{ tpl ($global.Files.Glob $secret.filePath).AsSecrets $global | indent 2 }}
{{- end }}
{{- else if eq $type "genericKV" }}
stringData:
{{- if $secret.envs }}
{{- range $secretEnv := $secret.envs }}
{{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
{{ $secretEnv.name }}: {{ include "common.secret._value" $valueDesc }}
{{- end }}
{{- end }}
{{- else if eq $type "password" }}
{{- $secretEnv := (dict "policy" (default "generate" $secret.policy) "name" "password" "value" $secret.password) }}
{{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
stringData:
password: {{ include "common.secret._value" $valueDesc }}
{{- else if eq $type "basicAuth" }}
stringData:
{{- $secretEnv := (dict "policy" "required" "name" "login" "value" $secret.login) }}
{{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
login: {{ include "common.secret._value" $valueDesc }}
{{- $secretEnv := (dict "policy" (default "generate" $secret.passwordPolicy) "name" "password" "value" $secret.password) }}
{{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
password: {{ include "common.secret._value" $valueDesc }}
{{- end }}
{{- end }}
{{- end }}
{{- end -}}
|