Merge pull request #698 from lsst-sqre/tickets/DM-34317

[DM-34317] Sherlock auth and push secret
lsst-sqre · Apr 7, 2022 · 252388a · 252388a
2 parents 45de35c + 5e63f94
commit 252388a
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 3 deletions.
diff --git a/charts/sherlock/Chart.yaml b/charts/sherlock/Chart.yaml
@@ -3,6 +3,6 @@ appVersion: 0.1.4
 description: A Helm chart for Kubernetes
 name: sherlock
 type: application
-version: 0.1.7
+version: 0.1.8
 maintainers:
   - name: cbanek
diff --git a/charts/sherlock/templates/deployment.yaml b/charts/sherlock/templates/deployment.yaml
@@ -43,6 +43,13 @@ spec:
           env:
             - name: "PUBLISH_URL"
               value: {{ .Values.publish_url }}
+            {{- if .Values.publish_url }}
+            - name: "PUBLISH_KEY"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "sherlock.fullname" . }}-secret
+                  key: "publish_key"
+            {{- end }}
           ports:
             - name: http
               containerPort: 8080

diff --git a/charts/sherlock/templates/ingress.yaml b/charts/sherlock/templates/ingress.yaml
@@ -8,7 +8,7 @@ metadata:
     {{- include "sherlock.labels" . | nindent 4 }}
   annotations:
     kubernetes.io/ingress.class: "nginx"
-    {{- if .Values.ingress.gafaelfawrAuthQuery -}}
+    {{- if .Values.ingress.gafaelfawrAuthQuery }}
     nginx.ingress.kubernetes.io/auth-method: GET
     nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Token
     nginx.ingress.kubernetes.io/auth-signin: "https://{{ .Values.ingress.host }}/login"

diff --git a/charts/sherlock/templates/vault-secret.yaml b/charts/sherlock/templates/vault-secret.yaml
@@ -0,0 +1,9 @@
+apiVersion: ricoberger.de/v1alpha1
+kind: VaultSecret
+metadata:
+  name: {{ include "sherlock.fullname" . }}-secret
+  labels:
+    {{- include "sherlock.labels" . | nindent 4 }}
+spec:
+  path: {{ required "vaultSecretsPath must be set" .Values.vaultSecretsPath | quote }}
+  type: Opaque
diff --git a/charts/sherlock/values.yaml b/charts/sherlock/values.yaml
@@ -42,7 +42,7 @@ ingress:
   host: ""
 
   # -- Gafaelfawr auth query string (default, unauthenticated)
-  gafaelfawrAuthQuery: ""
+  gafaelfawrAuthQuery: "scope=exec:admin"
 
   # -- Additional annotations for the ingress rule
   annotations: {}
@@ -84,3 +84,5 @@ serviceAccount:
 
 # -- URL to push status to via HTTP PUTs.
 publish_url: ""
+
+vaultSecretsPath: ""