Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: read HCLOUD_TOKEN from file #652

Merged
merged 7 commits into from
Jun 6, 2024
Merged

feat: read HCLOUD_TOKEN from file #652

merged 7 commits into from
Jun 6, 2024

Conversation

simonostendorf
Copy link
Contributor

@simonostendorf simonostendorf commented May 29, 2024 •
edited by apricote
Loading

This allows the HCLOUD_TOKEN (and ROBOT_USER and ROBOT_PASSWORD) to be read from a file. This can be useful if the token is injected using secret injection (e.g. with the vault agent injector).

I tested the changes on my dev cluster. I cannot test the robot account changes, because I only use hcloud. But because they use the same function inside the code I think its working too :). If someone is interested in using this with the vault agent injector, I used the following helm values:

image:
  repository: <custom-image-because-changes-are-not-released>
  tag: <custom-image-because-changes-are-not-released>
podAnnotations:
  vault.hashicorp.com/agent-inject: "true"
  vault.hashicorp.com/log-format: json
  vault.hashicorp.com/role: <your-vault-role-name>
  vault.hashicorp.com/secret-volume-path-token: /vault/secrets
  vault.hashicorp.com/agent-inject-file-token: token
  vault.hashicorp.com/agent-inject-secret-token: <your-vault-mount>/data/<your-vault-path>
  vault.hashicorp.com/agent-inject-template-token: |
    {{ with secret "<your-vault-mount>/data/<your-vault-path>" -}}
     {{ .Data.data.token }}
    {{- end }}
env:
  HCLOUD_TOKEN_FILE:
    value: "/vault/secrets/token"
  HCLOUD_TOKEN: null # must be set because helm results in using value and valueFrom and that results in an error

This change is inspired from external-dns cloudflare provider. I requested the same change for the csi-driver to keep consistency in reading HCLOUD_TOKEN from file.

Closes #595

@simonostendorf simonostendorf requested a review from a team as a code owner May 29, 2024 07:00
@simonostendorf simonostendorf mentioned this pull request May 29, 2024
Merged
@codecov Codecov
Copy link

codecov bot commented May 29, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 76.81%. Comparing base (ed097ab) to head (12ee38b).
Report is 3 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #652      +/-   ##
==========================================
+ Coverage   76.23%   76.81%   +0.58%     
==========================================
  Files          21       20       -1     
  Lines        2264     2105     -159     
==========================================
- Hits         1726     1617     -109     
+ Misses        360      329      -31     
+ Partials      178      159      -19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

jooola
jooola reviewed Jun 3, 2024
View reviewed changes
Copy link
Member

@jooola jooola left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, the feature looks great, I only have a few nits.

We will have to wait for @apricote for the final merge decision.

internal/config/config.go Outdated Show resolved Hide resolved
internal/config/config_test.go Outdated Show resolved Hide resolved
jooola
jooola reviewed Jun 3, 2024
View reviewed changes
chart/values.yaml Outdated Show resolved Hide resolved
@simonostendorf @jooola
fix: use fmt.Errorf
c6ac014 
Co-authored-by: Jonas L. <[email protected]>
@apricote apricote self-requested a review June 4, 2024 14:08
@apricote
Copy link
Member

apricote commented Jun 5, 2024

Thanks for the PR @simonostendorf!

Dont worry about the e2e tests failing, they dont work for people outside of the hetznercloud organization on GitHub.

@simonostendorf
Copy link
Contributor Author

I forgot to update the helm chart and i pushed some of my private fixes, sorry. I will fix this as soon as possible :D

@simonostendorf simonostendorf force-pushed the feat/read-hcloud-token-from-file branch from 15a43f4 to 187a8b4 Compare June 5, 2024 14:51
apricote
apricote approved these changes Jun 6, 2024
View reviewed changes
Copy link
Member

@apricote apricote left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much @simonostendorf! I pushed a small commit with two style fixes. The e2e tests also were successful locally. Going to merge this now :)

@apricote apricote merged commit a4343b8 into hetznercloud:main Jun 6, 2024
3 of 8 checks passed
@hcloud-bot hcloud-bot mentioned this pull request May 31, 2024
Merged
apricote pushed a commit that referenced this pull request Jul 8, 2024
@hcloud-bot
chore(main): release 1.20.0 (#601)
dfef366 
🤖 I have created a release *beep* *boop*
---


##
[1.20.0](v1.19.0...v1.20.0)
(2024-07-08)


### Features

* add support & tests for Kubernetes 1.29
([#600](#600))
([e8fabda](e8fabda))
* add support & tests for Kubernetes 1.30
([#679](#679))
([0748b6e](0748b6e))
* drop tests for kubernetes v1.25
([#597](#597))
([58261ec](58261ec))
* drop tests for kubernetes v1.26
([#680](#680))
([9c4be01](9c4be01))
* emit Kubernetes events for error conditions
([#598](#598))
([e8f9199](e8f9199))
* **helm,manifests:** only specify container args instead of command
([#691](#691))
([2ba4058](2ba4058))
* **helm:** allow setting affinity for deployment
([#686](#686))
([1a8ea95](1a8ea95))
* read HCLOUD_TOKEN from file
([#652](#652))
([a4343b8](a4343b8))


### Bug Fixes

* **routes:** many requests for outdated routes by rate limiting
([#675](#675))
([e283b7d](e283b7d))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
@hegerdes hegerdes mentioned this pull request Sep 10, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jooola jooola jooola left review comments

@apricote apricote apricote approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support secret injection with HashiCorp Vault
3 participants
@simonostendorf @apricote @jooola