Skip to content

Commit f18b95c

Browse files
lsubashlsubash
authored
Dev/subash/passrand (#7)
* [Verifier] Password randomization with charts deployment This patch removes - Password in values.yaml file - Passwords are randomized using helm functionality - K8S Secret is create for global admin credentials. - trustagent aas json secret is created for usage in Trustagent charts - Conditions are taken care to create password only once for user Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com> * [Trustagent] Use json secret created for trustagent with verifier deploymnet Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com> * [AM] Use global admin creds secret for generating bearer token Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com> --------- Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
1 parent 1e9f7d7 commit f18b95c

24 files changed

Lines changed: 257 additions & 104 deletions

File tree

‎helm/attestation-manager/templates/deployment.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,13 +83,13 @@ spec:
8383
- name: AAS_USERNAME
8484
valueFrom:
8585
secretKeyRef:
86-
name: am-aas-credentials
87-
key: username
86+
name: global-admin-generator-credentials
87+
key: GLOBAL_ADMIN_USERNAME
8888
- name: AAS_PASSWORD
8989
valueFrom:
9090
secretKeyRef:
91-
name: am-aas-credentials
92-
key: password
91+
name: global-admin-generator-credentials
92+
key: GLOBAL_ADMIN_PASSWORD
9393
- name: NODE_NAME
9494
valueFrom:
9595
fieldRef:

‎helm/attestation-manager/templates/secrets.yaml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎helm/attestation-verifier/charts/aas/templates/db-secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ metadata:
88
namespace: {{ .Release.Namespace }}
99
stringData:
1010
AAS_DB_USERNAME: {{ .Values.secret.dbUsername }}
11-
AAS_DB_PASSWORD: {{ .Values.secret.dbPassword }}
11+
AAS_DB_PASSWORD: {{ randAlphaNum 16 }}

‎helm/attestation-verifier/charts/aas/templates/secrets.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,14 @@ metadata:
99
stringData:
1010
{{- if .Values.global }}
1111
AAS_ADMIN_USERNAME: {{ .Values.global.aas.secret.adminUsername }}
12+
{{- if not .Values.global.aas.secret.adminPassword }}
13+
{{- $password := randAlphaNum 16 }}
14+
{{- $_ := set .Values.global.aas.secret "adminPassword" $password }}
1215
AAS_ADMIN_PASSWORD: {{ .Values.global.aas.secret.adminPassword }}
1316
{{- else }}
17+
AAS_ADMIN_PASSWORD: {{ .Values.global.aas.secret.adminPassword }}
18+
{{- end }}
19+
{{- else }}
1420
AAS_ADMIN_USERNAME: {{ .Values.secret.adminUsername }}
15-
AAS_ADMIN_PASSWORD: {{ .Values.secret.adminPassword }}
21+
AAS_ADMIN_PASSWORD: {{ .Values.secret.adminPassword | default (randAlphaNum 16) }}
1622
{{- end}}

‎helm/attestation-verifier/charts/global-admin-generator/aas-manager.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@
66
{{- end }}
77
{{- if .Values.global }}
88
"aas_admin_username": "{{ required "A valid admin username is required!" .Values.global.aas.secret.adminUsername }}",
9-
"aas_admin_password": "{{ required "A valid admin password is required!" .Values.global.aas.secret.adminPassword }}",
9+
"aas_admin_password": "{{- if .Values.global.aas.secret.adminPassword -}}{{ .Values.global.aas.secret.adminPassword }}{{- else -}}{{ $aas_admin_password := randAlphaNum 16 }}{{ $aas_admin_password }}{{- $_ := set .Values.global.aas.secret "adminPassword" $aas_admin_password }}{{- end -}}",
1010
{{- else }}
1111
"aas_admin_username": "{{ required "A valid admin username is required!" .Values.aas.secret.adminUsername }}",
12-
"aas_admin_password": "{{ required "A valid admin password is required!" .Values.aas.secret.adminPassword }}",
12+
"aas_admin_password": "{{- if .Values.aas.secret.adminPassword -}}{{ .Values.aas.secret.adminPassword }}{{- else -}}{{ $aas_admin_password := randAlphaNum 16 }}{{ $aas_admin_password }}{{- $_ := set .Values.aas.secret "adminPassword" $aas_admin_password }}{{- end -}}",
1313
{{- end }}
1414
"users_and_roles":[
1515
{
1616
"username": "{{ .Values.secret.globalAdminUsername }}",
17-
"password": "{{ .Values.secret.globalAdminPassword }}",
17+
"password": "{{- if .Values.secret.globalAdminPassword -}}{{ .Values.secret.globalAdminPassword }}{{- else -}}{{ $password := randAlphaNum 16 }}{{ $password }}{{- $_ := set .Values.aas.secret "globalAdminPassword" $password}}{{- end -}}",
1818
"print_bearer_token": true,
1919
"roles": [
2020
{{- $size := len .Values.services_list }}

‎helm/attestation-verifier/charts/global-admin-generator/templates/secrets.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- include "factory.headers" . }}
2+
---
3+
apiVersion: v1
4+
kind: Secret
5+
type: Opaque
6+
metadata:
7+
name: {{ include "factory.name" . }}-credentials
8+
namespace: {{ .Release.Namespace }}
9+
stringData:
10+
GLOBAL_ADMIN_USERNAME: {{ .Values.secret.globalAdminUsername }}
11+
{{- if not .Values.secret.globalAdminPassword }}
12+
{{- $password := randAlphaNum 16 }}
13+
{{- $_ := set .Values.secret "globalAdminPassword" $password }}
14+
GLOBAL_ADMIN_PASSWORD: {{ .Values.secret.globalAdminPassword }}
15+
{{- else }}
16+
GLOBAL_ADMIN_PASSWORD: {{ .Values.secret.globalAdminPassword }}
17+
{{- end }}
18+

‎helm/attestation-verifier/charts/hvs/aas-manager.json‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@
66
{{- end }}
77
{{- if .Values.global }}
88
"aas_admin_username": "{{ required "A valid admin username is required!" .Values.global.aas.secret.adminUsername }}",
9-
"aas_admin_password": "{{ required "A valid admin password is required!" .Values.global.aas.secret.adminPassword }}",
9+
"aas_admin_password": "{{- if .Values.global.aas.secret.adminPassword -}}{{ .Values.global.aas.secret.adminPassword }}{{- else -}}{{ $aas_admin_password := randAlphaNum 16 }}{{ $aas_admin_password }}{{- $_ := set .Values.global.aas.secret "adminPassword" $aas_admin_password }}{{- end -}}",
1010
{{- else }}
1111
"aas_admin_username": "{{ required "A valid admin username is required!" .Values.aas.secret.adminUsername }}",
12-
"aas_admin_password": "{{ required "A valid admin password is required!" .Values.aas.secret.adminPassword }}",
12+
"aas_admin_password": "{{- if .Values.aas.secret.adminPassword -}}{{ .Values.aas.secret.adminPassword }}{{- else -}}{{ $aas_admin_password := randAlphaNum 16 }}{{ $aas_admin_password }}{{- $_ := set .Values.aas.secret "adminPassword" $aas_admin_password }}{{- end -}}",
1313
{{- end }}
1414
"users_and_roles":[
1515
{
1616
"username": "{{ .Values.secret.installAdminUsername }}",
17-
"password": "{{ .Values.secret.installAdminPassword }}",
17+
"password": "{{ randAlphaNum 16 }}",
1818
"print_bearer_token":true,
1919
"roles":[
2020
{
@@ -45,20 +45,6 @@
4545
]
4646
}
4747
]
48-
},
49-
{
50-
"username": "{{ .Values.secret.serviceUsername }}",
51-
"password": "{{ .Values.secret.servicePassword }}",
52-
"print_bearer_token": false,
53-
"roles": [
54-
{
55-
"service": "TA",
56-
"name": "Administrator",
57-
"permissions": [
58-
"*:*:*"
59-
]
60-
}
61-
]
62-
}
48+
}
6349
]
6450
}

‎helm/attestation-verifier/charts/hvs/templates/db-secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ metadata:
88
namespace: {{ .Release.Namespace }}
99
stringData:
1010
HVS_DB_USERNAME: {{ .Values.secret.dbUsername }}
11-
HVS_DB_PASSWORD: {{ .Values.secret.dbPassword }}
11+
HVS_DB_PASSWORD: {{ randAlphaNum 16 }}

‎helm/attestation-verifier/charts/hvs/templates/secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ metadata:
88
namespace: {{ .Release.Namespace }}
99
stringData:
1010
HVS_SERVICE_USERNAME: {{ .Values.secret.serviceUsername }}
11-
HVS_SERVICE_PASSWORD: {{ .Values.secret.servicePassword }}
11+
HVS_SERVICE_PASSWORD: {{ randAlphaNum 16 }}

‎helm/attestation-verifier/charts/hvs/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,12 @@ image:
5555
pullPolicy: Always # The pull policy for pulling from container registry for PostgreSQL image
5656
dbVersionUpgradeImage: # The image name of PostgresDB version upgrade
5757
svc:
58-
name: registry-rs.edgeorchestration.intel.com/edge-orch/trusted-compute/attestation-verifier/hvs # The image name with which HVS image is pushed to registry<br> (**REQUIRED**)
58+
name: # The image name with which HVS image is pushed to registry<br> (**REQUIRED**)
5959
pullPolicy: Always # The pull policy for pulling from container registry for HVS<br> (Allowed values: `Always`/`IfNotPresent`)
6060
imagePullSecret: # The image pull secret for authenticating with image registry, can be left empty if image registry does not require authentication
61-
initName: registry-rs.edgeorchestration.intel.com/edge-orch/trusted-compute/attestation-verifier/init-wait
61+
initName:
6262
aasManager:
63-
name: registry-rs.edgeorchestration.intel.com/edge-orch/trusted-compute/attestation-verifier/aas-manager # The image registry where AAS Manager image is pushed<br> (**REQUIRED**)
63+
name: # The image registry where AAS Manager image is pushed<br> (**REQUIRED**)
6464
pullPolicy: Always # The pull policy for pulling from container registry for AAS Manager <br> (Allowed values: `Always`/`IfNotPresent`)
6565
imagePullSecret: # The image pull secret for authenticating with image registry, can be left empty if image registry does not require authentication
6666

0 commit comments

Comments
 (0)