feat(secrets): enable user-supplied storage and authproxy secrets (#189)

cryostatio · Sep 18, 2024 · 9734a59 · 9734a59
1 parent 8cb9660
commit 9734a59
Show file tree

Hide file tree

Showing 16 changed files with 112 additions and 48 deletions.
diff --git a/charts/cryostat/README.md b/charts/cryostat/README.md
diff --git a/charts/cryostat/templates/_helpers.tpl b/charts/cryostat/templates/_helpers.tpl
@@ -101,12 +101,12 @@ Get or generate a default encryption key for database.
 Get or generate a default secret key for object storage.
 */}}
 {{- define "cryostat.objectStorageSecretKey" -}}
-{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-storage" .Release.Name)) -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-storage-secret" .Release.Name)) -}}
 {{- if $secret -}}
 {{/*
    Use current secret. Do not regenerate.
 */}}
-{{- $secret.data.SECRET_KEY -}}
+{{- $secret.data.STORAGE_ACCESS_KEY -}}
 {{- else -}}
 {{/*
     Generate new secret

diff --git a/charts/cryostat/templates/_oauth2Proxy.tpl b/charts/cryostat/templates/_oauth2Proxy.tpl
@@ -15,7 +15,7 @@ Create OAuth2 Proxy container. Configurations defined in alpha_config.yaml
     - name: OAUTH2_PROXY_COOKIE_SECRET
       valueFrom:
         secretKeyRef:
-          name: {{ .Release.Name }}-cookie-secret
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
           key: COOKIE_SECRET
           optional: false
     - name: OAUTH2_PROXY_EMAIL_DOMAINS

diff --git a/charts/cryostat/templates/_openshiftOauthProxy.tpl b/charts/cryostat/templates/_openshiftOauthProxy.tpl
@@ -10,7 +10,7 @@ Create OpenShift OAuth Proxy container.
     - name: COOKIE_SECRET
       valueFrom:
         secretKeyRef:
-          name: {{ .Release.Name }}-cookie-secret
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
           key: COOKIE_SECRET
           optional: false
   args:

diff --git a/charts/cryostat/templates/cookie_secret.yaml b/charts/cryostat/templates/cookie_secret.yaml
@@ -1,7 +1,11 @@
+{{- if empty .Values.authentication.cookieSecretName -}}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ .Release.Name }}-cookie-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
 type: Opaque
 data:
   COOKIE_SECRET: {{ include "cryostat.cookieSecret" . }}
+{{- end -}}
diff --git a/charts/cryostat/templates/cryostat_deployment.yaml b/charts/cryostat/templates/cryostat_deployment.yaml
@@ -84,8 +84,8 @@ spec:
           - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY
             valueFrom:
               secretKeyRef:
-                name: {{ printf "%s-storage" .Release.Name }}
-                key: SECRET_KEY
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
                 optional: false
           - name: AWS_SECRET_ACCESS_KEY
             value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)

diff --git a/charts/cryostat/templates/db_secret.yaml b/charts/cryostat/templates/db_secret.yaml
@@ -3,6 +3,8 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ .Release.Name }}-db
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
 type: Opaque
 immutable: true
 data:

diff --git a/charts/cryostat/templates/storage_deployment.yaml b/charts/cryostat/templates/storage_deployment.yaml
@@ -43,8 +43,8 @@ spec:
           - name: CRYOSTAT_SECRET_KEY
             valueFrom:
               secretKeyRef:
-                name: {{ printf "%s-storage" .Release.Name }}
-                key: SECRET_KEY
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
                 optional: false
           - name: DATA_DIR
             value: /data

diff --git a/charts/cryostat/templates/storage_secret.yaml b/charts/cryostat/templates/storage_secret.yaml
@@ -1,7 +1,11 @@
+{{- if empty .Values.storage.storageSecretName -}}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Release.Name }}-storage
+  name: {{ .Release.Name }}-storage-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
 type: Opaque
 data:
-  SECRET_KEY: {{ include "cryostat.objectStorageSecretKey" . }}
+  STORAGE_ACCESS_KEY: {{ include "cryostat.objectStorageSecretKey" . }}
+{{- end -}}
diff --git a/charts/cryostat/tests/cookie_secret_test.yaml b/charts/cryostat/tests/cookie_secret_test.yaml
@@ -18,3 +18,18 @@ tests:
           value: Opaque
       - exists:
           path: data.COOKIE_SECRET
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.0-dev
+            helm.sh/chart: cryostat-2.0.0-dev
+
+  - it: should not create a cookie secret if authentication.cookieSecretName is set
+    set:
+      authentication.cookieSecretName: "custom-cookie-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/cryostat/tests/cryostat_deployment_test.yaml b/charts/cryostat/tests/cryostat_deployment_test.yaml
@@ -115,8 +115,8 @@ tests:
       - equal:
           path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY')].valueFrom.secretKeyRef
           value:
-              key: "SECRET_KEY"
-              name: "RELEASE-NAME-storage"
+              key: "STORAGE_ACCESS_KEY"
+              name: "RELEASE-NAME-storage-secret"
               optional: false
       - equal:
           path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='AWS_SECRET_ACCESS_KEY')].value

diff --git a/charts/cryostat/tests/db_secret_test.yaml b/charts/cryostat/tests/db_secret_test.yaml
@@ -22,6 +22,14 @@ tests:
           path: data.ENCRYPTION_KEY
       - exists:
           path: data.CONNECTION_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.0-dev
+            helm.sh/chart: cryostat-2.0.0-dev
 
   - it: should not create a database secret if core.databaseSecretName is set
     set:

diff --git a/charts/cryostat/tests/storage_deployment_test.yaml b/charts/cryostat/tests/storage_deployment_test.yaml
@@ -71,8 +71,8 @@ tests:
       - equal:
           path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_SECRET_KEY')].valueFrom.secretKeyRef
           value:
-              name: "RELEASE-NAME-storage"
-              key: "SECRET_KEY"
+              name: "RELEASE-NAME-storage-secret"
+              key: "STORAGE_ACCESS_KEY"
               optional: false
       - equal:
           path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='DATA_DIR')].value

diff --git a/charts/cryostat/tests/storage_secret_test.yaml b/charts/cryostat/tests/storage_secret_test.yaml
@@ -12,9 +12,24 @@ tests:
           value: Secret
       - equal:
           path: metadata.name
-          value: RELEASE-NAME-storage
+          value: RELEASE-NAME-storage-secret
       - equal:
           path: type
           value: Opaque
       - exists:
-          path: data.SECRET_KEY
+          path: data.STORAGE_ACCESS_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.0-dev
+            helm.sh/chart: cryostat-2.0.0-dev
+
+  - it: should not create a storage secret if storage.storageSecretName is set
+    set:
+      storage.storageSecretName: "custom-storage-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/cryostat/values.schema.json b/charts/cryostat/values.schema.json
@@ -154,7 +154,7 @@
                             "properties": {
                                 "cpu": {
                                     "type": "string",
-                                    "description": "CPU resource request for the Cryostat container.",
+                                    "description": "CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
                                     "default": "500m"
                                 },
                                 "memory": {
@@ -317,7 +317,7 @@
                             "properties": {
                                 "cpu": {
                                     "type": "string",
-                                    "description": "CPU resource request for the database container.",
+                                    "description": "CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
                                     "default": "25m"
                                 },
                                 "memory": {
@@ -334,6 +334,11 @@
         "storage": {
             "type": "object",
             "properties": {
+                "storageSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
                 "securityContext": {
                     "type": "object",
                     "properties": {
@@ -402,7 +407,7 @@
                             "properties": {
                                 "cpu": {
                                     "type": "string",
-                                    "description": "CPU resource request for the object storage container.",
+                                    "description": "CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
                                     "default": "50m"
                                 },
                                 "memory": {
@@ -487,7 +492,7 @@
                             "properties": {
                                 "cpu": {
                                     "type": "string",
-                                    "description": "CPU resource request for the Grafana container.",
+                                    "description": "CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
                                     "default": "25m"
                                 },
                                 "memory": {
@@ -557,7 +562,7 @@
                             "properties": {
                                 "cpu": {
                                     "type": "string",
-                                    "description": "CPU resource request for the JFR Data Source container.",
+                                    "description": "CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
                                     "default": "200m"
                                 },
                                 "memory": {
@@ -644,6 +649,11 @@
         "authentication": {
             "type": "object",
             "properties": {
+                "cookieSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
                 "openshift": {
                     "type": "object",
                     "properties": {

diff --git a/charts/cryostat/values.yaml b/charts/cryostat/values.yaml
@@ -50,7 +50,7 @@ core:
       destinationCACertificate: ""
   resources:
     requests:
-      ## @param core.resources.requests.cpu CPU resource request for the Cryostat container.
+      ## @param core.resources.requests.cpu CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
       cpu: 500m
       ## @param core.resources.requests.memory Memory resource request for the Cryostat container.
       memory: 384Mi
@@ -99,7 +99,7 @@ db:
     port: 5432
   resources:
     requests:
-      ## @param db.resources.requests.cpu CPU resource request for the database container.
+      ## @param db.resources.requests.cpu CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
       cpu: 25m
       ## @param db.resources.requests.memory Memory resource request for the database container.
       memory: 64Mi
@@ -115,6 +115,8 @@ db:
 ## @section Storage Container
 ## @extra storage Configuration for Cryostat's object storage provider
 storage:
+  ## @param storage.storageSecretName Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  storageSecretName: ""
   image:
     ## @param storage.image.repository Repository for the storage container image
     repository: "quay.io/cryostat/cryostat-storage"
@@ -129,7 +131,7 @@ storage:
     port: 8333
   resources:
     requests:
-      ## @param storage.resources.requests.cpu CPU resource request for the object storage container.
+      ## @param storage.resources.requests.cpu CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
       cpu: 50m
       ## @param storage.resources.requests.memory Memory resource request for the object storage container.
       memory: 256Mi
@@ -159,7 +161,7 @@ grafana:
     port: 3000
   resources:
     requests:
-      ## @param grafana.resources.requests.cpu CPU resource request for the Grafana container.
+      ## @param grafana.resources.requests.cpu CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
       cpu: 25m
       ## @param grafana.resources.requests.memory Memory resource request for the Grafana container.
       memory: 80Mi
@@ -184,7 +186,7 @@ datasource:
     tag: "latest"
   resources:
     requests:
-      ## @param datasource.resources.requests.cpu CPU resource request for the JFR Data Source container.
+      ## @param datasource.resources.requests.cpu CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
       cpu: 200m
       ## @param datasource.resources.requests.memory Memory resource request for the JFR Data Source container.
       memory: 200Mi
@@ -200,6 +202,8 @@ datasource:
 ## @section Authentication
 
 authentication:
+  ## @param authentication.cookieSecretName Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  cookieSecretName: ""
   openshift:
     ## @param authentication.openshift.enabled Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.
     enabled: false