Skip to content

Commit aa7fa4c

Browse files
armabarmab
authored
Merge pull request #45 from StackStorm/feature/st2apikey-load
Add new Helm value setting 'st2.apikeys' to import ST2 API keys
2 parents 18d1968 + 286cf71 commit aa7fa4c

File tree

5 files changed

+130
-1
lines changed

5 files changed

+130
-1
lines changed

‎CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
## In Development
44

5+
## v0.9.0
6+
* Add new Helm value setting `st2.apikeys` to allow importing predefined ST2 API keys (#36)
7+
58
## v0.8.4
69
* Pin st2 version to `v3.0dev` as a new latest development version (#41)
710

‎Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v1
22
# Update StackStorm version here to rely on other Docker images tags
33
appVersion: 3.0dev
44
name: stackstorm-ha
5-
version: 0.8.4
5+
version: 0.9.0
66
description: StackStorm K8s Helm Chart, optimized for running StackStorm in HA environment.
77
home: https://stackstorm.com/#product
88
icon: https://avatars1.githubusercontent.com/u/4969009

‎templates/jobs.yaml

+99
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,102 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ .Release.Name }}-job-st2-apikey-load
6+
labels:
7+
app: st2
8+
tier: backend
9+
vendor: stackstorm
10+
support: {{ template "supportMethod" . }}
11+
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
12+
release: {{ .Release.Name }}
13+
heritage: {{ .Release.Service }}
14+
annotations:
15+
helm.sh/hook: post-install, post-upgrade, post-rollback
16+
helm.sh/hook-delete-policy: before-hook-creation
17+
helm.sh/hook-weight: "5"
18+
spec:
19+
template:
20+
metadata:
21+
name: job-st2-apikey-load
22+
labels:
23+
app: st2
24+
tier: backend
25+
vendor: stackstorm
26+
support: {{ template "supportMethod" . }}
27+
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
28+
release: {{ .Release.Name }}
29+
heritage: {{ .Release.Service }}
30+
annotations:
31+
# TODO: Investigate/propose running Helm hook only on condition when ConfigMap or Secret has changed
32+
checksum/urls: {{ include (print $.Template.BasePath "/configmaps_st2-urls.yaml") . | sha256sum }}
33+
checksum/apikeys: {{ include (print $.Template.BasePath "/secrets_st2apikeys.yaml") . | sha256sum }}
34+
spec:
35+
{{- if .Values.enterprise.enabled }}
36+
imagePullSecrets:
37+
- name: {{ .Release.Name }}-st2-license
38+
{{- end }}
39+
initContainers:
40+
# Sidecar container for generating st2client config with st2 username & password pair and sharing produced file with the main container
41+
- name: generate-st2client-config
42+
image: "{{ template "imageRepository" . }}/st2actionrunner{{ template "enterpriseSuffix" . }}:{{ .Chart.AppVersion }}"
43+
imagePullPolicy: {{ .Values.image.pullPolicy }}
44+
envFrom:
45+
- configMapRef:
46+
name: {{ .Release.Name }}-st2-urls
47+
env:
48+
- name: ST2_AUTH_USERNAME
49+
valueFrom:
50+
secretKeyRef:
51+
name: {{ .Release.Name }}-st2-auth
52+
key: username
53+
- name: ST2_AUTH_PASSWORD
54+
valueFrom:
55+
secretKeyRef:
56+
name: {{ .Release.Name }}-st2-auth
57+
key: password
58+
volumeMounts:
59+
- name: st2client-config-vol
60+
mountPath: /root/.st2/
61+
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
62+
command:
63+
- 'sh'
64+
- '-ec'
65+
- |
66+
cat <<EOT > /root/.st2/config
67+
[credentials]
68+
username = ${ST2_AUTH_USERNAME}
69+
password = ${ST2_AUTH_PASSWORD}
70+
EOT
71+
containers:
72+
- name: st2-apikey-load
73+
image: "{{ template "imageRepository" . }}/st2actionrunner{{ template "enterpriseSuffix" . }}:{{ .Chart.AppVersion }}"
74+
imagePullPolicy: {{ .Values.image.pullPolicy }}
75+
command:
76+
- st2
77+
- apikey
78+
- load
79+
- /etc/st2/apikeys.yaml
80+
envFrom:
81+
- configMapRef:
82+
name: {{ .Release.Name }}-st2-urls
83+
volumeMounts:
84+
- name: st2client-config-vol
85+
mountPath: /root/.st2/
86+
- name: st2-apikeys-vol
87+
mountPath: /etc/st2/apikeys.yaml
88+
subPath: apikeys.yaml
89+
# TODO: Find out default resource limits for this specific service (#5)
90+
#resources:
91+
volumes:
92+
- name: st2client-config-vol
93+
emptyDir:
94+
medium: Memory
95+
- name: st2-apikeys-vol
96+
secret:
97+
secretName: {{ .Release.Name }}-st2-apikeys
98+
restartPolicy: OnFailure
99+
1100
---
2101
apiVersion: batch/v1
3102
kind: Job

‎templates/secrets_st2apikeys.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ .Release.Name }}-st2-apikeys
6+
annotations:
7+
description: A list of StackStorm API keys with metadata that will be imported into the system
8+
labels:
9+
app: st2
10+
tier: backend
11+
vendor: stackstorm
12+
support: {{ template "supportMethod" . }}
13+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
14+
release: "{{ .Release.Name }}"
15+
heritage: "{{ .Release.Service }}"
16+
type: Opaque
17+
data:
18+
apikeys.yaml: {{ toYaml .Values.st2.apikeys | b64enc | quote }}

‎values.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,15 @@ st2:
9292
# secret: false
9393
# encrypted: false
9494
# value: "2.9"
95+
# Import a list of ST2 API Keys (https://docs.stackstorm.com/authentication.html#api-key-migration)
96+
apikeys:
97+
#- created_at: '2018-12-15T00:21:48.507388Z'
98+
# enabled: true
99+
# id: 5c14491c6cb8de1a9207e3a2
100+
# key_hash: 56928c2d9637ce44338e9564d4b939df8b258410db23b5a80f8ad69d58e648b574f35f9293c3a76bde263738be9aa8379a81553cd55513ad672540b7b0ec0cac
101+
# metadata: {"comment": "Example unsecure ST2 API key from K8s HA Helm values.yaml"}
102+
# uid: api_key:56928c2d9637ce44338e9564d4b939df8b258410db23b5a80f8ad69d58e648b574f35f9293c3a76bde263738be9aa8379a81553cd55513ad672540b7b0ec0cac
103+
# user: st2admin
95104

96105
##
97106
## StackStorm HA Cluster Secrets. All fields are required!

0 commit comments

Comments
 (0)