Skip to content

Commit 6f98a8f

Browse files
charlie-haleycharlie-haley
committed
update helm chart; add key generation
1 parent ee2797e commit 6f98a8f

19 files changed

Lines changed: 781 additions & 98 deletions

File tree

‎charts/marmot/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: marmot
33
description: Marmot is an open-source data catalog that helps teams discover, understand, and govern their data assets. It's designed for modern data ecosystems where data flows through multiple systems, formats, and teams.
44
type: application
5-
version: 0.2.0
6-
appVersion: "0.2.0"
5+
version: 0.4.1
6+
appVersion: "0.4.1"
77
home: https://github.com/marmotdata/marmot
88
sources:
99
- https://github.com/marmotdata/marmot

‎charts/marmot/templates/NOTES.txt‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,69 @@
1-
{{- if .Values.postgresql.enabled }}
2-
⚠️ WARNING: You are using the embedded PostgreSQL database.
3-
⚠️ This is NOT recommended for production use!
4-
⚠️ For production deployments, please use an external PostgreSQL instance.
1+
Thank you for installing {{ .Chart.Name }}!
2+
3+
Your release is named {{ .Release.Name }}.
4+
5+
To access Marmot:
6+
7+
{{- if .Values.ingress.enabled }}
8+
{{- range .Values.ingress.hosts }}
9+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
510
{{- end }}
11+
{{- else if contains "NodePort" .Values.service.type }}
12+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "marmot.fullname" . }})
13+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
14+
echo http://$NODE_IP:$NODE_PORT
15+
{{- else if contains "LoadBalancer" .Values.service.type }}
16+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "marmot.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
17+
echo http://$SERVICE_IP:{{ .Values.service.port }}
18+
{{- else if contains "ClusterIP" .Values.service.type }}
19+
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "marmot.fullname" . }} 8080:{{ .Values.service.port }}
20+
echo http://127.0.0.1:8080
21+
{{- end }}
22+
23+
Default credentials: admin / admin
24+
25+
{{- if and (not .Values.config.server.encryptionKey) (not .Values.config.server.encryptionKeySecretRef) .Values.config.server.autoGenerateEncryptionKey }}
26+
27+
═══════════════════════════════════════════════════════════════
28+
⚠️ ENCRYPTION KEY AUTO-GENERATED
29+
═══════════════════════════════════════════════════════════════
30+
31+
An encryption key was automatically generated and stored in:
32+
Secret: {{ include "marmot.fullname" . }}-encryption-key
33+
Namespace: {{ .Release.Namespace }}
34+
35+
BACK UP THIS KEY IMMEDIATELY:
36+
37+
kubectl get secret {{ include "marmot.fullname" . }}-encryption-key \
38+
-n {{ .Release.Namespace }} \
39+
-o jsonpath='{.data.encryption-key}' | base64 -d
40+
41+
Store this key securely! Loss of this key means:
42+
• Permanent loss of encrypted pipeline credentials
43+
• Inability to decrypt existing pipeline configurations
44+
45+
The secret will persist even if you uninstall this release.
46+
47+
═══════════════════════════════════════════════════════════════
48+
{{- end }}
49+
50+
{{- if .Values.config.server.allowUnencrypted }}
51+
52+
═══════════════════════════════════════════════════════════════
53+
⚠️ WARNING: ENCRYPTION DISABLED
54+
═══════════════════════════════════════════════════════════════
55+
56+
Pipeline credentials will be stored in PLAINTEXT in the database.
57+
This is a SECURITY RISK and should only be used for development.
58+
59+
To enable encryption:
60+
1. Generate a key: marmot generate-encryption-key
61+
2. Store in a secret and update your values.yaml
62+
3. Upgrade this release
63+
64+
═══════════════════════════════════════════════════════════════
65+
{{- end }}
66+
67+
For more information:
68+
Docs: https://docs.marmotdata.io
69+
Support: https://github.com/marmotdata/marmot/issues

‎charts/marmot/templates/deployment.yaml‎

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,34 @@ spec:
5959
- name: MARMOT_SERVER_ROOT_URL
6060
value: {{ .Values.config.server.rootUrl | quote }}
6161
{{- end }}
62-
62+
{{- if or .Values.config.server.encryptionKey .Values.config.server.encryptionKeySecretRef .Values.config.server.autoGenerateEncryptionKey }}
63+
- name: MARMOT_SERVER_ENCRYPTION_KEY
64+
{{- if .Values.config.server.encryptionKeySecretRef }}
65+
{{- if and .Values.config.server.encryptionKey .Values.config.server.encryptionKeySecretRef }}
66+
{{- fail "Cannot specify both config.server.encryptionKey and config.server.encryptionKeySecretRef" }}
67+
{{- end }}
68+
{{- if .Values.config.server.autoGenerateEncryptionKey }}
69+
{{- fail "Cannot specify both config.server.autoGenerateEncryptionKey and config.server.encryptionKeySecretRef" }}
70+
{{- end }}
71+
valueFrom:
72+
secretKeyRef:
73+
name: {{ .Values.config.server.encryptionKeySecretRef.name }}
74+
key: {{ .Values.config.server.encryptionKeySecretRef.key }}
75+
{{- else if .Values.config.server.encryptionKey }}
76+
{{- if .Values.config.server.autoGenerateEncryptionKey }}
77+
{{- fail "Cannot specify both config.server.autoGenerateEncryptionKey and config.server.encryptionKey" }}
78+
{{- end }}
79+
value: {{ .Values.config.server.encryptionKey | quote }}
80+
{{- else if .Values.config.server.autoGenerateEncryptionKey }}
81+
valueFrom:
82+
secretKeyRef:
83+
name: {{ include "marmot.fullname" . }}-encryption-key
84+
key: encryption-key
85+
{{- end }}
86+
{{- end }}
87+
- name: MARMOT_SERVER_ALLOW_UNENCRYPTED
88+
value: {{ .Values.config.server.allowUnencrypted | quote }}
89+
6390
# Database configuration - use subchart values if enabled
6491
- name: MARMOT_DATABASE_HOST
6592
{{- if .Values.postgresql.enabled }}
@@ -126,6 +153,8 @@ spec:
126153
{{- end }}
127154

128155
# Auth configuration
156+
- name: MARMOT_AUTH_OPENLINEAGE_ENABLED
157+
value: {{ .Values.config.auth.openlineage.enabled | quote }}
129158
- name: MARMOT_AUTH_ANONYMOUS_ENABLED
130159
value: {{ .Values.config.auth.anonymous.enabled | quote }}
131160
- name: MARMOT_AUTH_ANONYMOUS_ROLE
@@ -162,7 +191,35 @@ spec:
162191
value: {{ .Values.config.auth.providers.okta.clientSecret | quote }}
163192
{{- end }}
164193
{{- end }}
165-
194+
195+
# Rate limit configuration
196+
- name: MARMOT_RATE_LIMIT_ENABLED
197+
value: {{ .Values.config.rateLimit.enabled | quote }}
198+
199+
# UI configuration
200+
- name: MARMOT_UI_BANNER_ENABLED
201+
value: {{ .Values.config.ui.banner.enabled | quote }}
202+
{{- if .Values.config.ui.banner.enabled }}
203+
- name: MARMOT_UI_BANNER_DISMISSIBLE
204+
value: {{ .Values.config.ui.banner.dismissible | quote }}
205+
- name: MARMOT_UI_BANNER_VARIANT
206+
value: {{ .Values.config.ui.banner.variant | quote }}
207+
- name: MARMOT_UI_BANNER_MESSAGE
208+
value: {{ .Values.config.ui.banner.message | quote }}
209+
- name: MARMOT_UI_BANNER_ID
210+
value: {{ .Values.config.ui.banner.id | quote }}
211+
{{- end }}
212+
213+
# Pipelines configuration
214+
- name: MARMOT_PIPELINES_MAX_WORKERS
215+
value: {{ .Values.config.pipelines.maxWorkers | quote }}
216+
- name: MARMOT_PIPELINES_SCHEDULER_INTERVAL
217+
value: {{ .Values.config.pipelines.schedulerInterval | quote }}
218+
- name: MARMOT_PIPELINES_LEASE_EXPIRY
219+
value: {{ .Values.config.pipelines.leaseExpiry | quote }}
220+
- name: MARMOT_PIPELINES_CLAIM_EXPIRY
221+
value: {{ .Values.config.pipelines.claimExpiry | quote }}
222+
166223
# Additional environment variables
167224
{{- range $key, $value := .Values.env }}
168225
- name: {{ $key }}

‎charts/marmot/templates/encryption-key-job.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{{- if and (not .Values.config.server.encryptionKey) (not .Values.config.server.encryptionKeySecretRef) .Values.config.server.autoGenerateEncryptionKey }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "marmot.fullname" . }}-encryption-key-generator
6+
labels:
7+
{{- include "marmot.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: encryption-key-generator
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-weight": "-5"
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
spec:
14+
template:
15+
metadata:
16+
name: {{ include "marmot.fullname" . }}-encryption-key-generator
17+
labels:
18+
{{- include "marmot.selectorLabels" . | nindent 8 }}
19+
app.kubernetes.io/component: encryption-key-generator
20+
spec:
21+
restartPolicy: Never
22+
serviceAccountName: {{ include "marmot.serviceAccountName" . }}
23+
securityContext:
24+
runAsNonRoot: true
25+
runAsUser: 65534
26+
fsGroup: 65534
27+
containers:
28+
- name: generate-key
29+
image: bitnami/kubectl:latest
30+
imagePullPolicy: IfNotPresent
31+
securityContext:
32+
allowPrivilegeEscalation: false
33+
capabilities:
34+
drop:
35+
- ALL
36+
readOnlyRootFilesystem: true
37+
command:
38+
- /bin/bash
39+
- -c
40+
- |
41+
set -e
42+
43+
SECRET_NAME="{{ include "marmot.fullname" . }}-encryption-key"
44+
NAMESPACE="{{ .Release.Namespace }}"
45+
46+
echo "Checking if encryption key secret exists..."
47+
48+
if kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" &>/dev/null; then
49+
echo "✅ Encryption key secret already exists: $SECRET_NAME"
50+
echo " Skipping key generation"
51+
exit 0
52+
fi
53+
54+
echo "Generating new encryption key..."
55+
# Generate a 32-byte random key and encode as base64
56+
ENCRYPTION_KEY=$(openssl rand -base64 32)
57+
58+
echo "Creating Kubernetes secret: $SECRET_NAME"
59+
kubectl create secret generic "$SECRET_NAME" \
60+
--namespace="$NAMESPACE" \
61+
--from-literal=encryption-key="$ENCRYPTION_KEY"
62+
63+
kubectl label secret "$SECRET_NAME" \
64+
--namespace="$NAMESPACE" \
65+
app.kubernetes.io/name={{ include "marmot.name" . }} \
66+
app.kubernetes.io/instance={{ .Release.Name }} \
67+
app.kubernetes.io/managed-by={{ .Release.Service }} \
68+
app.kubernetes.io/component=encryption-key
69+
70+
kubectl annotate secret "$SECRET_NAME" \
71+
--namespace="$NAMESPACE" \
72+
"helm.sh/resource-policy"="keep"
73+
74+
echo "✅ Encryption key generated and stored in secret: $SECRET_NAME"
75+
{{- end }}

‎charts/marmot/templates/role.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and (not .Values.config.server.encryptionKey) (not .Values.config.server.encryptionKeySecretRef) .Values.config.server.autoGenerateEncryptionKey }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "marmot.fullname" . }}-encryption-key-manager
6+
labels:
7+
{{- include "marmot.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: encryption-key-manager
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-weight": "-10"
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
rules:
14+
- apiGroups: [""]
15+
resources: ["secrets"]
16+
verbs: ["get", "list", "create", "update", "patch"]
17+
- apiGroups: [""]
18+
resources: ["secrets"]
19+
resourceNames: ["{{ include "marmot.fullname" . }}-encryption-key"]
20+
verbs: ["get", "update", "patch"]
21+
{{- end }}

‎charts/marmot/templates/rolebinding.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and (not .Values.config.server.encryptionKey) (not .Values.config.server.encryptionKeySecretRef) .Values.config.server.autoGenerateEncryptionKey }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "marmot.fullname" . }}-encryption-key-manager
6+
labels:
7+
{{- include "marmot.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: encryption-key-manager
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-weight": "-10"
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: Role
16+
name: {{ include "marmot.fullname" . }}-encryption-key-manager
17+
subjects:
18+
- kind: ServiceAccount
19+
name: {{ include "marmot.serviceAccountName" . }}
20+
namespace: {{ .Release.Namespace }}
21+
{{- end }}

0 commit comments

Comments
 (0)