-
Notifications
You must be signed in to change notification settings - Fork 9
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Provide confidential values as secret (#71)
* WIP: Provide confidential values as secret * Fix parameter names in comment * Provide demo credentials as base64 * Add named secret in values.yaml with default content * Remove secret boilerplate in values.yaml * Configure secret creation via flag * Enhance secret configuration - Use existingSecretName to configure secret via external secret - rabbitmq uses its own naming syntax. We show them for convenience - fixing external database property Postgres secrets for external databases has to be added still * Fix yaml syntax * Fix yaml and property refs * Adds configurable secret to external database * Adjust minikube values * Resolve go template issues * Update documentation * Fix wording
- Loading branch information
Showing
16 changed files
with
216 additions
and
86 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| {{- if empty .Values.geonode.secret.existingSecretName }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: geonode-secret | ||
| namespace: {{ .Release.Namespace }} | ||
| type: Opaque | ||
| data: | ||
| # superuser credentials | ||
| ADMIN_USERNAME: {{ .Values.geonode.secret.superUser.username | b64enc }} | ||
| ADMIN_PASSWORD: {{ .Values.geonode.secret.superUser.password | b64enc }} | ||
| ADMIN_EMAIL: {{ .Values.geonode.secret.superUser.email | b64enc }} | ||
|
|
||
| # mail secrets | ||
| DJANGO_EMAIL_HOST_USER: {{ .Values.geonode.secret.mail.user | b64enc }} | ||
| DJANGO_EMAIL_HOST_PASSWORD: {{ .Values.geonode.secret.mail.password | b64enc }} | ||
| DEFAULT_FROM_EMAIL: {{ .Values.geonode.secret.mail.from | b64enc }} | ||
|
|
||
| # ldap secrets | ||
| LDAP_BIND_PASSWORD: {{ .Values.geonode.secret.ldap.bind_password | b64enc }} | ||
| {{ end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| {{- if empty .Values.geoserver.secret.existingSecretName }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: geoserver-secret | ||
| namespace: {{ .Release.Namespace }} | ||
| type: Opaque | ||
| data: | ||
| # geoserver admin credentials | ||
| GEOSERVER_ADMIN_USER: {{ .Values.geoserver.secret.admin_username | b64enc }} | ||
| GEOSERVER_ADMIN_PASSWORD: {{ .Values.geoserver.secret.admin_password | b64enc }} | ||
| {{ end }} |
7 changes: 4 additions & 3 deletions
7
charts/geonode/templates/postgres/postgres-external-geodata-secrets.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,11 @@ | ||
| {{ if .Values.postgres.external_postgres.enabled }} | ||
| {{ if and .Values.postgres.external_postgres.enabled (not .Values.postgres.external_postgres.secret.existingSecretName )}} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: {{ .Release.Name }}-geodata-external-secrets | ||
| namespace: {{ .Release.Namespace }} | ||
| type: Opaque | ||
| data: | ||
| username: {{ .Values.postgres.geodatabasename_and_username | quote }} | ||
| password: {{ .Values.postgres.external_postgres.geodata_password | b64enc }} | ||
| username: {{ .Values.postgres.geodata_databasename_and_username | b64enc }} | ||
| password: {{ .Values.postgres.external_postgres.secret.geodata_password | b64enc }} | ||
| {{ end }} |
7 changes: 4 additions & 3 deletions
7
charts/geonode/templates/postgres/postgres-external-geonode-secrets.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,11 @@ | ||
| {{ if .Values.postgres.external_postgres.enabled }} | ||
| {{ if and .Values.postgres.external_postgres.enabled (not .Values.postgres.external_postgres.secret.existingSecretName )}} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: {{ .Release.Name }}-geonode-external-secrets | ||
| namespace: {{ .Release.Namespace }} | ||
| type: Opaque | ||
| data: | ||
| username: {{ .Values.postgres.username | quote }} | ||
| password: {{ .Values.postgres.external_postgres.geonode_password | b64enc }} | ||
| username: {{ .Values.postgres.username | b64enc }} | ||
| password: {{ .Values.postgres.external_postgres.secret.geonode_password | b64enc }} | ||
| {{ end }} |
7 changes: 4 additions & 3 deletions
7
charts/geonode/templates/postgres/postgres-external-postgres-secrets.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,11 @@ | ||
| {{ if .Values.postgres.external_postgres.enabled }} | ||
| {{ if and .Values.postgres.external_postgres.enabled (not .Values.postgres.external_postgres.secret.existingSecretName )}} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: {{ .Release.Name }}-postgres-external-secrets | ||
| namespace: {{ .Release.Namespace }} | ||
| type: Opaque | ||
| data: | ||
| username: {{ .Values.postgres.username | quote }} | ||
| password: {{ .Values.postgres.external_postgres.postgres_password | b64enc }} | ||
| username: {{ .Values.postgres.username | b64enc }} | ||
| password: {{ .Values.postgres.external_postgres.secret.postgres_password | b64enc }} | ||
| {{ end }} |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,10 @@ | ||
|
|
||
| global: | ||
| # -- storageClass used by helm dependencies pvc | ||
| storageClass: | ||
| # -- storage access mode used by helm dependency pvc | ||
| accessMode: ReadWriteMany | ||
|
|
||
|
|
||
| # geonode configuration | ||
| geonode: | ||
| # -- pod name | ||
|
|
@@ -31,6 +31,28 @@ geonode: | |
| tasks_post_script: | | ||
| print("tasks_post_script not defined ...") | ||
| secret: | ||
| # -- name of an existing Secret to use. Set, if you want to separately maintain the Secret. | ||
| existingSecretName: "" | ||
| superUser: | ||
| # -- admin username | ||
| username: admin | ||
| # -- admin panel password | ||
| password: geonode | ||
| # -- admin user password | ||
| email: [email protected] | ||
| mail: | ||
| # -- define mail user to send mails from | ||
| user: "changeme" | ||
| # -- set password for mailuser in geonode | ||
| password: "changeme" | ||
| # -- define from mail-addr | ||
| from: "[email protected]" | ||
| ldap: | ||
| # -- ldap password | ||
| bind_password: password | ||
|
|
||
|
|
||
| resources: | ||
| requests: | ||
| # -- requested memory as in resource.requests.memory (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | ||
|
|
@@ -109,6 +131,7 @@ geonode: | |
| cheaper_busyness_backlog_step: 2 | ||
|
|
||
| general: | ||
|
|
||
| # -- external ingress schema. If set to 'https', make sure to configure TLS either by | ||
| # configuring tls certificate or using cert-manager. Available options: (http|https) | ||
| externalScheme: http | ||
|
|
@@ -139,14 +162,6 @@ geonode: | |
| # -- OGC_REQUEST_POOL_CONNECTIONS | ||
| ogc_request_pool_connections: 10 | ||
|
|
||
| superUser: | ||
| # -- admin username | ||
| username: admin | ||
| # -- admin panel password | ||
| password: geonode | ||
| # -- admin user password | ||
| email: [email protected] | ||
|
|
||
| publishing: | ||
| # -- RESOURCE_PUBLISHING By default, the GeoNode application allows GeoNode staff members to publish/unpublish resources. | ||
| # By default, resources are published when created. When this setting is set to True the staff members will be able to unpublish | ||
|
|
@@ -183,12 +198,6 @@ geonode: | |
| tls: true | ||
| # -- enable ssl for geonode mail (only tls or ssl can be true not both) | ||
| use_ssl: False | ||
| # -- define mail user to send mails from | ||
| user: "changeme" | ||
| # -- set password for mailuser in geonode | ||
| password: "changeme" | ||
| # -- define from mail-addr | ||
| from: "[email protected]" | ||
|
|
||
| ldap: | ||
| # -- enable ldap AUTHENTICATION_BACKENDS in DJANGO Geonode | ||
|
|
@@ -197,8 +206,6 @@ geonode: | |
| uri: ldap://example.com | ||
| # -- ldap user bind dn | ||
| bind_dn: "CN=Users,DC=ad,DC=example,DC=com" | ||
| # -- ldap password | ||
| bind_password: password | ||
| # -- ldap user search dn | ||
| user_search_dn: "OU=User,DC=ad,DC=example,DC=com" | ||
| # -- ldap user filterstr | ||
|
|
@@ -244,7 +251,7 @@ geonode: | |
| # -- If True, new user accounts will be created as inactive. The user must use the activation link to activate his account. | ||
| conformation_required: True | ||
| # -- Specifies the login method to use – whether the user logs in by entering their username, e-mail address, or either one of both. Setting this to “email” requires email_required=True | ||
| authentication_method: "user_email" | ||
| authentication_method: "username_email" | ||
| # -- group name to add new registered users to, requires auto_assign_registered_members_to_registered: True. | ||
| registered_members_group_name: | ||
| # -- if set to True new registered user will be add to defined group in registered_members_group_name | ||
|
|
@@ -309,10 +316,14 @@ geoserver: | |
| tag: '2.23.0' | ||
| # -- geoserver port | ||
| port: 8080 | ||
| # -- geoserver admin username | ||
| admin_username: admin | ||
| # -- geoserver admin password | ||
| admin_password: "geoserver" | ||
|
|
||
| secret: | ||
| # -- name of an existing Secret to use. Set, if you want to separately maintain the Secret. | ||
| existingSecretName: "" | ||
| # -- geoserver admin username | ||
| admin_username: admin | ||
| # -- geoserver admin password | ||
| admin_password: "geoserver" | ||
|
|
||
| # -- geoserver kube resources | ||
| resources: | ||
|
|
@@ -356,7 +367,7 @@ nginx: | |
| # -- limit cpu as in resource.requests.cpu (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | ||
| cpu: "800m" | ||
|
|
||
| # -- pycsw integration is based on https://github.com/geopython/pycsw/blob/master/docker/kubernetes | ||
| # pycsw integration is based on https://github.com/geopython/pycsw/blob/master/docker/kubernetes | ||
| pycsw: | ||
| # -- enable single pycsw pod | ||
| enabled: True | ||
|
|
@@ -386,8 +397,8 @@ pycsw: | |
| memory: "1Gi" | ||
| # -- limit cpu as in resource.requests.cpu (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | ||
| cpu: "500m" | ||
| # copied from 4.1.x: https://github.com/GeoNode/geonode/blob/master/geonode/catalogue/backends/pycsw_local_mappings.py | ||
| # -- pycsw config file parameters, see docs: https://docs.pycsw.org/_/downloads/en/latest/pdf/ | ||
| # -- pycsw local mappings, copied from 4.1.x: https://github.com/GeoNode/geonode/blob/master/geonode/catalogue/backends/pycsw_local_mappings.py | ||
| # @default -- MD_CORE_MODEL = { ... } | ||
| mappings: |- | ||
| MD_CORE_MODEL = { | ||
| "typename": "pycsw:CoreMetadata", | ||
|
|
@@ -452,7 +463,9 @@ pycsw: | |
| "pycsw:Links": "download_links", | ||
| }, | ||
| } | ||
| config: |- | ||
| # -- pycsw config file parameters, see docs: https://docs.pycsw.org/_/downloads/en/latest/pdf/ | ||
| # @default -- [server] ... | ||
| config: | | ||
| [server] | ||
| home=/home/pycsw | ||
| url=$(PYCSW_SERVER_URL) | ||
|
|
@@ -532,6 +545,8 @@ rabbitmq: | |
| username: rabbituser | ||
| password: rabbitpassword | ||
| erlangCookie: jixYBsiZ9RivaLXC02pTwGjvIo0nHtVu | ||
| existingPasswordSecret: "" | ||
| existingErlangSecret: "" | ||
| persistence: | ||
| enabled: False | ||
|
|
||
|
|
@@ -574,9 +589,12 @@ postgres: | |
| enabled: False | ||
| hostname: my-external-postgres.com | ||
| port: 5432 | ||
| postgres_password: postgres | ||
| geonode_password: geonode | ||
| geodata_password: geogeonode | ||
| secret: | ||
| # -- name of an existing Secret to use. Set, if you want to separately maintain the Secret. | ||
| existingSecretName: "" | ||
| postgres_password: postgres | ||
| geonode_password: geonode | ||
| geodata_password: geogeonode | ||
|
|
||
| # VALUES DEFINITION: https://github.com/zalando/postgres-operator/blob/master/charts/postgres-operator/values.yaml | ||
| postgres-operator: | ||
|
|
||
Oops, something went wrong.