Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add option from datakey to be provided from existing secret #183

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add option from datakey to be provided from existing secret #183

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f98d274
Add option from datakey to be provided from existing secret
dan-transmit Jul 11, 2023
8e8f019
fix values.schema.json and documentation
dan-transmit Jul 12, 2023
2c70306
hide dataKeySecretRef key from values files and add inline comment
dan-transmit Jul 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.

## Unreleased

## [2.1.0] - 2023-07-11

### Added
- Support for using existing secrets for data key

## [2.0.6] - 2023-03-09

### Changed
Expand Down
2 changes: 1 addition & 1 deletion conjur-oss/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: v1
name: conjur-oss
home: https://www.conjur.org
version: 2.0.6
version: 2.1.0
description: A Helm chart for CyberArk Conjur
icon: https://www.cyberark.com/wp-content/uploads/2015/12/cybr-aim.jpg
keywords:
Expand Down
2 changes: 2 additions & 0 deletions conjur-oss/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ $ helm install \
https://github.com/cyberark/conjur-oss-helm-chart/releases/download/v$VERSION/conjur-oss-$VERSION.tgz
```

_Note: You can import conjur data key as a secret existing on your kubernetes cluster using `--set dataKeySecretRef=YOUR_SECRET_NAME` where the secret is contained within the key `key`. Note that it will overwrite usage of dataKey._

_Note: The configured data key will be used to encrypt sensitive information
in Conjur's database. This must be archived in a safe place._

Expand Down
2 changes: 1 addition & 1 deletion conjur-oss/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ spec:
- name: CONJUR_DATA_KEY
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-conjur-data-key
name: {{ .Values.dataKeySecretRef | default (printf "%s-conjur-data-key" .Release.Name) }}
key: key
- name: DATABASE_URL
valueFrom:
Expand Down
2 changes: 2 additions & 0 deletions conjur-oss/templates/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ type: Opaque
data:
key: "{{ .Values.authenticators | b64enc }}"
---
{{- if not .Values.dataKeySecretRef }}
apiVersion: v1
kind: Secret
metadata:
Expand All @@ -37,6 +38,7 @@ metadata:
type: Opaque
data:
key: {{ .Values.dataKey | b64enc }}
{{- end }}
---
{{- include "conjur-oss.database-password" . }}
apiVersion: v1
Expand Down
9 changes: 4 additions & 5 deletions conjur-oss/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,5 @@
{
"$schema": "http://json-schema.org/draft-07/schema",
"required": [
"dataKey"
],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be better to require exactly one of [dataKey, dataKeySecretRef]. This can be accomplished with syntax like this:

"oneOf": [
{
  "required": [
    "dataKey"
  ]
},
{
  "required": [
    "dataKeySecretRef"
   ]
},

See the JSON Schema reference for more details.

"properties": {
"account": {
"type": "object",
Expand Down Expand Up @@ -58,9 +55,11 @@
}
}
},
"dataKeySecretRef": {
"type": "string"
},
"dataKey": {
"type": "string",
"minLength": 1
"type": "string"
},
"deployment": {
"properties": {
Expand Down
2 changes: 1 addition & 1 deletion conjur-oss/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
# rather than setting these in a custom values YAML file. This avoids the
# risk of leaving around residual values files containing this sensitive
# information.

dataKeySecretRef:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The linter is failing here. I think this needs to default to an empty string instead of null.

account:
# Name of Conjur account to be created. Maps to CONJUR_ACCOUNT env variable
# for the Conjur container.
Expand Down
Loading