Skip to content

Commit f007f82

Browse files
MeNsaaHMeNsaaH
authored
feat(eyaml) Use secrets for eyaml keys (#103)
* Use secrets for eyaml keys * fix secret names * fix include in eyaml secret names * fix indentation on secret * Add existingMap for backwards compat * Add changes to deployment * Generated changelog and added self to contributors * Bump chart Version * Generated changelog from old changeLog using github-changelog-generator * Update Changelog
1 parent cc91772 commit f007f82

9 files changed

Lines changed: 51 additions & 30 deletions

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ numbering uses [semantic versioning](http://semver.org).
55

66
NOTE: The change log until version `v0.2.4` is auto-generated.
77

8+
## [v5.15.0](https://github.com/puppetlabs/puppetserver-helm-chart/tree/v5.15.0) (2022-04-20)
9+
10+
- feat: use k8s secrets instead of configmaps for eyaml secrets
11+
812
## [v5.14.0](https://github.com/puppetlabs/puppetserver-helm-chart/tree/v5.14.0) (2021-12-01)
913

1014
- feat: bump Puppetserver to `v7.4.2`.

‎Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v1
22
name: puppetserver
3-
version: 5.14.0
3+
version: 5.15.0
44
appVersion: 7.4.2
55
description: Puppet automates the delivery and operation of software.
66
keywords: ["puppet", "puppetserver", "automation", "iac", "infrastructure", "cm", "ci", "cd"]

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -347,3 +347,4 @@ kill %[job_numbers_above]
347347
* [John Stewart](https://github.com/jstewart612), Contributor
348348
* [Erlon Pinheiro](https://github.com/erlonpinheiro), Contributor
349349
* [Reinier Schoof](https://github.com/skoef), Contributor
350+
* [Manasseh MMadu](https://github.com/mensaah), Contributor

‎templates/_helpers.tpl‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -363,15 +363,24 @@ Create the name for the hiera eyaml key configMap (private/public keys combined)
363363
{{- end -}}
364364

365365
{{/*
366-
Create the name for the hiera eyaml private key configMap.
366+
Create the name for the hiera eyaml key secret (private/public keys combined).
367367
*/}}
368-
{{- define "puppetserver.hiera.privateMap" -}}
369-
eyamlpriv-config
368+
{{- define "puppetserver.hiera.existingSecret" -}}
369+
{{- if .Values.hiera.eyaml.existingSecret -}}
370+
{{- .Values.hiera.eyaml.existingSecret -}}
371+
{{- end -}}
372+
{{- end -}}
373+
374+
{{/*
375+
Create the name for the hiera eyaml private key Secrets.
376+
*/}}
377+
{{- define "puppetserver.hiera.privateSecret" -}}
378+
eyamlpriv-secret
370379
{{- end -}}
371380

372381
{{/*
373-
Create the name for the hiera eyaml public cert configMap.
382+
Create the name for the hiera eyaml public cert Secrets.
374383
*/}}
375-
{{- define "puppetserver.hiera.publicMap" -}}
376-
eyamlpub-config
384+
{{- define "puppetserver.hiera.publicSecret" -}}
385+
eyamlpub-secret
377386
{{- end -}}

‎templates/private_key.pkcs7.pem.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
{{- if and (.Values.hiera.eyaml.private_key) (not .Values.r10k.hiera.viaSsh.credentials.existingSecret) }}
22
apiVersion: v1
3-
kind: ConfigMap
3+
kind: Secret
44
metadata:
5-
name: eyamlpriv-config
5+
name: {{ include "puppetserver.hiera.privateSecret" . }}
66
labels:
77
{{- include "puppetserver.hiera.labels" . | nindent 4 }}
88
data:
9-
private_key.pkcs7.pem: |-
10-
{{ .Values.hiera.eyaml.private_key | nindent 4 }}
9+
private_key.pkcs7.pem: {{ .Values.hiera.eyaml.private_key | nindent 4 | b64enc }}
1110
{{- end }}

‎templates/public_key.pkcs7.pem.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
{{- if and (.Values.hiera.eyaml.public_key) (not .Values.r10k.hiera.viaSsh.credentials.existingSecret) }}
22
apiVersion: v1
3-
kind: ConfigMap
3+
kind: Secret
44
metadata:
5-
name: eyamlpub-config
5+
name: {{ include "puppetserver.hiera.publicSecret" . }}
66
labels:
77
{{- include "puppetserver.hiera.labels" . | nindent 4 }}
88
data:
9-
public_key.pkcs7.pem: |-
10-
{{ .Values.hiera.eyaml.public_key | nindent 4 }}
9+
public_key.pkcs7.pem: {{ .Values.hiera.eyaml.public_key | nindent 4 | b64enc }}
1110
{{- end }}

‎templates/puppetserver-deployment-masters.yaml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -328,20 +328,24 @@ spec:
328328
- name: manifests-volume
329329
configMap:
330330
name: manifests-config
331-
{{- if .Values.hiera.eyaml.existingMap }}
331+
{{- if .Values.hiera.eyaml.existingSecret }}
332+
- name: eyaml-volume
333+
secret:
334+
secretName: {{ .Values.hiera.eyaml.existingSecret }}
335+
{{- else if .Values.hiera.eyaml.existingMap }}
332336
- name: eyaml-volume
333337
configMap:
334338
name: {{ .Values.hiera.eyaml.existingMap }}
335339
{{- end }}
336-
{{- if and (.Values.hiera.eyaml.public_key) (not .Values.hiera.eyaml.existingMap)}}
340+
{{- if and (.Values.hiera.eyaml.public_key) (not .Values.hiera.eyaml.existingMap) (not .Values.hiera.eyaml.existingSecret)}}
337341
- name: eyamlpub-volume
338-
configMap:
339-
name: {{ template "puppetserver.hiera.publicMap" . }}
342+
secret:
343+
secretName: {{ template "puppetserver.hiera.publicSecret" . }}
340344
{{- end }}
341-
{{- if and (.Values.hiera.eyaml.private_key) (not .Values.hiera.eyaml.existingMap)}}
345+
{{- if and (.Values.hiera.eyaml.private_key) (not .Values.hiera.eyaml.existingMap) (not .Values.hiera.eyaml.existingSecret)}}
342346
- name: eyamlpriv-volume
343-
configMap:
344-
name: {{ template "puppetserver.hiera.privateMap" . }}
347+
secret:
348+
secretName: {{ template "puppetserver.hiera.privateSecret" . }}
345349
{{- end }}
346350
{{- if or (.Values.r10k.code.viaSsh.credentials.existingSecret) (and (.Values.r10k.code.viaSsh.credentials.ssh.value) (.Values.r10k.code.viaSsh.credentials.known_hosts.value)) }}
347351
- name: r10k-code-ssh

‎templates/puppetserver-statefulset-compilers.yaml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -280,20 +280,24 @@ spec:
280280
- name: manifests-volume
281281
configMap:
282282
name: manifests-config
283-
{{- if .Values.hiera.eyaml.existingMap }}
283+
{{- if .Values.hiera.eyaml.existingSecret }}
284+
- name: eyaml-volume
285+
secret:
286+
secretName: {{ .Values.hiera.eyaml.existingSecret }}
287+
{{- else if .Values.hiera.eyaml.existingMap }}
284288
- name: eyaml-volume
285289
configMap:
286290
name: {{ .Values.hiera.eyaml.existingMap }}
287291
{{- end }}
288-
{{- if and (.Values.hiera.eyaml.public_key) (not .Values.hiera.eyaml.existingMap)}}
292+
{{- if and (.Values.hiera.eyaml.public_key) (not .Values.hiera.eyaml.existingMap) (not .Values.hiera.eyaml.existingSecret)}}
289293
- name: eyamlpub-volume
290-
configMap:
291-
name: {{ template "puppetserver.hiera.publicMap" . }}
294+
secret:
295+
secretName: {{ template "puppetserver.hiera.publicSecret" . }}
292296
{{- end }}
293-
{{- if and (.Values.hiera.eyaml.private_key) (not .Values.hiera.eyaml.existingMap)}}
297+
{{- if and (.Values.hiera.eyaml.private_key) (not .Values.hiera.eyaml.existingMap) (not .Values.hiera.eyaml.existingSecret)}}
294298
- name: eyamlpriv-volume
295-
configMap:
296-
name: {{ template "puppetserver.hiera.privateMap" . }}
299+
secret:
300+
secretName: {{ template "puppetserver.hiera.privateSecret" . }}
297301
{{- end }}
298302
{{- if or (.Values.r10k.code.viaSsh.credentials.existingSecret) (and (.Values.r10k.code.viaSsh.credentials.ssh.value) (.Values.r10k.code.viaSsh.credentials.known_hosts.value)) }}
299303
- name: r10k-code-ssh

‎values.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -566,9 +566,10 @@ hiera:
566566
# :pkcs7_private_key: /etc/puppetlabs/puppet/eyaml/keys/private_key.pkcs7.pem # keep unchanged
567567
# :pkcs7_public_key: /etc/puppetlabs/puppet/eyaml/keys/public_key.pkcs7.pem # keep unchanged
568568
eyaml:
569-
## Choose using either a pre-existing configMap containing keys, or the private_key/public_key set.
569+
## Choose using either a pre-existing secret/configMap containing keys, or the private_key/public_key set.
570570
##
571571
existingMap: ""
572+
existingSecret: ""
572573
## A multi-line string
573574
##
574575
private_key: # |

0 commit comments

Comments
 (0)