Skip to content

Commit 73c0e19

Browse files
thenav56thenav56
authored
Merge pull request #3 from IFRCGo/feature/setup-secret-vault
2 parents 03e2baa + 8bd63d1 commit 73c0e19

13 files changed

Lines changed: 410 additions & 65 deletions

‎helm/snapshots/alpha-1.yaml‎

Lines changed: 11 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ metadata:
1515
apiVersion: v1
1616
kind: Secret
1717
metadata:
18-
name: release-name-cacheppuccino-helm
18+
name: release-name-cacheppuccino-helm-vault-secret
1919
labels:
2020
helm.sh/chart: cacheppuccino-helm-0.1.0
2121
app.kubernetes.io/name: cacheppuccino-helm
@@ -24,7 +24,7 @@ metadata:
2424
app.kubernetes.io/managed-by: Helm
2525
type: Opaque
2626
stringData:
27-
TRANSLATION_API_KEY: "test"
27+
TRANSLATION_API_KEY: "dummy"
2828
---
2929
# Source: cacheppuccino-helm/templates/configmap.yaml
3030
apiVersion: v1
@@ -38,17 +38,14 @@ metadata:
3838
app.kubernetes.io/version: "0.1.0"
3939
app.kubernetes.io/managed-by: Helm
4040
data:
41+
SQLITE_PATH: "/data/cacheppuccino.db"
42+
HTTP_TIMEOUT: "1m"
43+
INITIAL_PULL_DEADLINE: "2m"
4144
LISTEN_ADDR: ":8080"
4245
LOG_LEVEL: "info"
43-
44-
TRANSLATION_BASE_URL: "https://ifrc-translationapi.azurewebsites.net"
45-
TRANSLATION_APPLICATION_ID: "18"
46-
4746
PULL_INTERVAL: "10m"
48-
HTTP_TIMEOUT: "1m"
49-
INITIAL_PULL_DEADLINE: "2m"
50-
51-
SQLITE_PATH: "/data/cacheppuccino.db"
47+
TRANSLATION_APPLICATION_ID: "18"
48+
TRANSLATION_BASE_URL: "https://ifrc-translationapi.azurewebsites.net"
5249
---
5350
# Source: cacheppuccino-helm/templates/pvc.yaml
5451
apiVersion: v1
@@ -96,6 +93,8 @@ apiVersion: apps/v1
9693
kind: Deployment
9794
metadata:
9895
name: release-name-cacheppuccino-helm
96+
annotations:
97+
reloader.stakater.com/auto: "true"
9998
labels:
10099
helm.sh/chart: cacheppuccino-helm-0.1.0
101100
app.kubernetes.io/name: cacheppuccino-helm
@@ -126,12 +125,8 @@ spec:
126125
envFrom:
127126
- configMapRef:
128127
name: release-name-cacheppuccino-helm
129-
env:
130-
- name: TRANSLATION_API_KEY
131-
valueFrom:
132-
secretKeyRef:
133-
name: release-name-cacheppuccino-helm
134-
key: "TRANSLATION_API_KEY"
128+
- secretRef:
129+
name: release-name-cacheppuccino-helm-vault-secret
135130
securityContext:
136131
allowPrivilegeEscalation: false
137132
readOnlyRootFilesystem: true

‎helm/snapshots/staging.yaml‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
---
2+
# Source: cacheppuccino-helm/templates/serviceaccount.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: ifrcgo-cacheppuccino
7+
labels:
8+
helm.sh/chart: cacheppuccino-helm-0.1.0
9+
app.kubernetes.io/name: cacheppuccino-helm
10+
app.kubernetes.io/instance: release-name
11+
app.kubernetes.io/version: "0.1.0"
12+
app.kubernetes.io/managed-by: Helm
13+
annotations:
14+
azure.workload.identity/client-id: test_id
15+
---
16+
# Source: cacheppuccino-helm/templates/configmap.yaml
17+
apiVersion: v1
18+
kind: ConfigMap
19+
metadata:
20+
name: ifrcgo-cacheppuccino
21+
labels:
22+
helm.sh/chart: cacheppuccino-helm-0.1.0
23+
app.kubernetes.io/name: cacheppuccino-helm
24+
app.kubernetes.io/instance: release-name
25+
app.kubernetes.io/version: "0.1.0"
26+
app.kubernetes.io/managed-by: Helm
27+
data:
28+
SQLITE_PATH: "/data/cacheppuccino.db"
29+
HTTP_TIMEOUT: "30s"
30+
INITIAL_PULL_DEADLINE: "45s"
31+
LISTEN_ADDR: ":8080"
32+
LOG_LEVEL: "info"
33+
PULL_INTERVAL: "10m"
34+
TRANSLATION_APPLICATION_ID: "18"
35+
TRANSLATION_BASE_URL: "https://ifrc-test-translationapi.azurewebsites.net"
36+
---
37+
# Source: cacheppuccino-helm/templates/pvc.yaml
38+
apiVersion: v1
39+
kind: PersistentVolumeClaim
40+
metadata:
41+
name: ifrcgo-cacheppuccino
42+
labels:
43+
helm.sh/chart: cacheppuccino-helm-0.1.0
44+
app.kubernetes.io/name: cacheppuccino-helm
45+
app.kubernetes.io/instance: release-name
46+
app.kubernetes.io/version: "0.1.0"
47+
app.kubernetes.io/managed-by: Helm
48+
spec:
49+
accessModes:
50+
- ReadWriteOnce
51+
resources:
52+
requests:
53+
storage: "512Mi"
54+
---
55+
# Source: cacheppuccino-helm/templates/service.yaml
56+
apiVersion: v1
57+
kind: Service
58+
metadata:
59+
name: ifrcgo-cacheppuccino
60+
labels:
61+
helm.sh/chart: cacheppuccino-helm-0.1.0
62+
app.kubernetes.io/name: cacheppuccino-helm
63+
app.kubernetes.io/instance: release-name
64+
app.kubernetes.io/version: "0.1.0"
65+
app.kubernetes.io/managed-by: Helm
66+
spec:
67+
type: ClusterIP
68+
ports:
69+
- name: http
70+
port: 8080
71+
targetPort: http
72+
protocol: TCP
73+
selector:
74+
app.kubernetes.io/name: cacheppuccino-helm
75+
app.kubernetes.io/instance: release-name
76+
---
77+
# Source: cacheppuccino-helm/templates/deployment.yaml
78+
apiVersion: apps/v1
79+
kind: Deployment
80+
metadata:
81+
name: ifrcgo-cacheppuccino
82+
annotations:
83+
reloader.stakater.com/auto: "true"
84+
labels:
85+
helm.sh/chart: cacheppuccino-helm-0.1.0
86+
app.kubernetes.io/name: cacheppuccino-helm
87+
app.kubernetes.io/instance: release-name
88+
app.kubernetes.io/version: "0.1.0"
89+
app.kubernetes.io/managed-by: Helm
90+
spec:
91+
replicas: 1
92+
selector:
93+
matchLabels:
94+
app.kubernetes.io/name: cacheppuccino-helm
95+
app.kubernetes.io/instance: release-name
96+
template:
97+
metadata:
98+
labels:
99+
app.kubernetes.io/name: cacheppuccino-helm
100+
app.kubernetes.io/instance: release-name
101+
azure.workload.identity/use: "true"
102+
spec:
103+
serviceAccountName: ifrcgo-cacheppuccino
104+
containers:
105+
- name: cacheppuccino
106+
image: "ghcr.io/ifrcgo/cacheppuccino:SET-BY-CICD-TAG"
107+
imagePullPolicy: IfNotPresent
108+
ports:
109+
- name: http
110+
containerPort: 8080
111+
protocol: TCP
112+
envFrom:
113+
- configMapRef:
114+
name: ifrcgo-cacheppuccino
115+
- secretRef:
116+
name: ifrcgo-cacheppuccino-vault-secret
117+
securityContext:
118+
allowPrivilegeEscalation: false
119+
readOnlyRootFilesystem: true
120+
runAsGroup: 0
121+
runAsUser: 0
122+
livenessProbe:
123+
httpGet:
124+
path: /healthz
125+
port: http
126+
initialDelaySeconds: 5
127+
periodSeconds: 10
128+
timeoutSeconds: 2
129+
failureThreshold: 3
130+
readinessProbe:
131+
httpGet:
132+
path: /readyz
133+
port: http
134+
initialDelaySeconds: 5
135+
periodSeconds: 10
136+
timeoutSeconds: 2
137+
failureThreshold: 6
138+
resources:
139+
limits:
140+
cpu: 500m
141+
memory: 512Mi
142+
requests:
143+
cpu: 100m
144+
memory: 128Mi
145+
volumeMounts:
146+
- name: sqlite
147+
mountPath: "/data"
148+
- name: secrets-store
149+
mountPath: "/mnt/secrets-store"
150+
readOnly: true
151+
volumes:
152+
- name: sqlite
153+
persistentVolumeClaim:
154+
claimName: ifrcgo-cacheppuccino
155+
- name: secrets-store
156+
csi:
157+
driver: secrets-store.csi.k8s.io
158+
readOnly: true
159+
volumeAttributes:
160+
secretProviderClass: ifrcgo-cacheppuccino-secret-provider
161+
---
162+
# Source: cacheppuccino-helm/templates/ingress.yaml
163+
apiVersion: networking.k8s.io/v1
164+
kind: Ingress
165+
metadata:
166+
name: ifrcgo-cacheppuccino
167+
labels:
168+
helm.sh/chart: cacheppuccino-helm-0.1.0
169+
app.kubernetes.io/name: cacheppuccino-helm
170+
app.kubernetes.io/instance: release-name
171+
app.kubernetes.io/version: "0.1.0"
172+
app.kubernetes.io/managed-by: Helm
173+
spec:
174+
ingressClassName: nginx
175+
rules:
176+
- host: "cacheppuccino-test-stage.ifrc.org"
177+
http:
178+
paths:
179+
- path: /
180+
pathType: Prefix
181+
backend:
182+
service:
183+
name: ifrcgo-cacheppuccino
184+
port:
185+
number: 8080
186+
tls:
187+
- secretName: cacheppuccino-helm-secret-cert-test
188+
hosts:
189+
- "cacheppuccino-test-stage.ifrc.org"
190+
---
191+
# Source: cacheppuccino-helm/templates/secret-provider-class.yaml
192+
apiVersion: secrets-store.csi.x-k8s.io/v1
193+
kind: SecretProviderClass
194+
metadata:
195+
name: ifrcgo-cacheppuccino-secret-provider
196+
labels:
197+
helm.sh/chart: cacheppuccino-helm-0.1.0
198+
app.kubernetes.io/name: cacheppuccino-helm
199+
app.kubernetes.io/instance: release-name
200+
app.kubernetes.io/version: "0.1.0"
201+
app.kubernetes.io/managed-by: Helm
202+
spec:
203+
provider: azure
204+
parameters:
205+
clientID: test_client_id
206+
keyvaultName: test_key_vault_name
207+
tenantId: test_tenant_id
208+
usePodIdentity: "false"
209+
useVMManagedIdentity: "false"
210+
objects: |
211+
array:
212+
- |
213+
objectName: TRANSLATION-API-KEY
214+
objectType: secret
215+
secretObjects:
216+
- secretName: ifrcgo-cacheppuccino-vault-secret
217+
type: Opaque
218+
data:
219+
- objectName: TRANSLATION-API-KEY
220+
key: TRANSLATION_API_KEY

‎helm/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,19 @@ app.kubernetes.io/instance: {{ .Release.Name }}
3131
{{- default "default" .Values.serviceAccount.name -}}
3232
{{- end -}}
3333
{{- end -}}
34+
35+
{{- define "cacheppuccino.secretProviderName" -}}
36+
{{- if .Values.secretsStoreCsiDriver.secretProviderClassName -}}
37+
{{- .Values.secretsStoreCsiDriver.secretProviderClassName -}}
38+
{{- else -}}
39+
{{- printf "%s-secret-provider" (include "cacheppuccino.fullname" .) -}}
40+
{{- end -}}
41+
{{- end -}}
42+
43+
{{- define "cacheppuccino.secretName" -}}
44+
{{- if .Values.secretsStoreCsiDriver.secretName -}}
45+
{{- .Values.secretsStoreCsiDriver.secretName -}}
46+
{{- else -}}
47+
{{- printf "%s-vault-secret" (include "cacheppuccino.fullname" .) -}}
48+
{{- end -}}
49+
{{- end -}}

‎helm/templates/configmap.yaml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,10 @@ metadata:
66
labels:
77
{{- include "cacheppuccino.labels" . | nindent 4 }}
88
data:
9-
LISTEN_ADDR: {{ .Values.app.listenAddr | quote }}
10-
LOG_LEVEL: {{ .Values.app.logLevel | quote }}
11-
12-
TRANSLATION_BASE_URL: {{ .Values.app.translation.baseUrl | quote }}
13-
TRANSLATION_APPLICATION_ID: {{ .Values.app.translation.applicationId | quote }}
14-
15-
PULL_INTERVAL: {{ .Values.app.pull.interval | quote }}
16-
HTTP_TIMEOUT: {{ .Values.app.pull.httpTimeout | quote }}
17-
INITIAL_PULL_DEADLINE: {{ .Values.app.pull.initialPullDeadline | quote }}
18-
9+
{{- if .Values.sqlite.enabled }}
1910
SQLITE_PATH: {{ printf "%s/%s" .Values.sqlite.mountPath .Values.sqlite.filename | quote }}
11+
{{- end }}
12+
{{- range $name, $value := .Values.env }}
13+
{{ $name }}: {{ tpl $value $ | quote }}
14+
{{- end }}
2015
{{- end }}

‎helm/templates/deployment.yaml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ apiVersion: apps/v1
33
kind: Deployment
44
metadata:
55
name: {{ include "cacheppuccino.fullname" . }}
6+
annotations:
7+
reloader.stakater.com/auto: "true"
68
labels:
79
{{- include "cacheppuccino.labels" . | nindent 4 }}
810
spec:
@@ -42,12 +44,8 @@ spec:
4244
envFrom:
4345
- configMapRef:
4446
name: {{ include "cacheppuccino.fullname" . }}
45-
env:
46-
- name: TRANSLATION_API_KEY
47-
valueFrom:
48-
secretKeyRef:
49-
name: {{ default (include "cacheppuccino.fullname" .) .Values.app.translation.existingSecret.name }}
50-
key: {{ .Values.app.translation.existingSecret.key | quote }}
47+
- secretRef:
48+
name: {{ include "cacheppuccino.secretName" . }}
5149
{{- with .Values.securityContext }}
5250
securityContext:
5351
{{- toYaml . | nindent 12 }}
@@ -75,12 +73,25 @@ spec:
7573
- name: sqlite
7674
mountPath: {{ .Values.sqlite.mountPath | quote }}
7775
{{- end }}
76+
{{- if .Values.secretsStoreCsiDriver.enabled }}
77+
- name: secrets-store
78+
mountPath: "/mnt/secrets-store"
79+
readOnly: true
80+
{{- end }}
7881
volumes:
7982
{{- if .Values.sqlite.enabled }}
8083
- name: sqlite
8184
persistentVolumeClaim:
8285
claimName: {{ default (include "cacheppuccino.fullname" .) .Values.sqlite.existingClaim }}
8386
{{- end }}
87+
{{- if .Values.secretsStoreCsiDriver.enabled }}
88+
- name: secrets-store
89+
csi:
90+
driver: secrets-store.csi.k8s.io
91+
readOnly: true
92+
volumeAttributes:
93+
secretProviderClass: {{ include "cacheppuccino.secretProviderName" . }}
94+
{{- end }}
8495
{{- with .Values.nodeSelector }}
8596
nodeSelector:
8697
{{- toYaml . | nindent 8 }}

0 commit comments

Comments
 (0)