Skip to content

Commit a9aa048

Browse files
ferruhcihanferruhcihan
committed
feat: enhance templates to handle secrets
1 parent d64c4a0 commit a9aa048

12 files changed

Lines changed: 149 additions & 39 deletions

File tree

‎charts/prometheus-msteams/templates/deployment.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,10 @@ spec:
4141
configMap:
4242
name: {{ template "app.name" . }}-card-template
4343
{{- if .Values.extraConfigmapMounts }}
44-
{{ toYaml .Values.extraConfigmapMounts | nindent 8 }}
44+
{{- toYaml .Values.extraConfigmapMounts | nindent 8 }}
45+
{{- end }}
46+
{{- if .Values.extraVolumes }}
47+
{{- toYaml .Values.extraVolumes | nindent 8 }}
4548
{{- end }}
4649
containers:
4750
- name: {{ .Chart.Name }}
@@ -69,7 +72,7 @@ spec:
6972
{{ toYaml .Values.extraVolumeMounts | nindent 12 }}
7073
{{- end }}
7174
args:
72-
- -config-file=/etc/config/connectors.yaml
75+
- -config-file={{ .Values.configFile }}
7376
- -template-file={{ .Values.templateFile }}
7477
{{- if .Values.workflowWebhook }}
7578
- -workflow-webhook={{ .Values.workflowWebhook }}

‎charts/prometheus-msteams/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,17 @@ customCardTemplate: ""
6767

6868
templateFile: /etc/template/card.tmpl
6969

70+
configFile: /etc/config/connectors.yaml
71+
7072
extraConfigmapMounts: []
7173
# extraConfigmapMounts:
7274
# - name: customConfigMap
7375
# configMap:
7476
# name: customConfigMapName
7577

78+
## Additional Volumes
79+
extraVolumes: []
80+
7681
## Additional Volume mounts
7782
extraVolumeMounts: []
7883
# extraVolumeMounts:

‎helmfile.d/helmfile-10.monitoring.yaml.gotmpl‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,23 @@ releases:
3232
installed: {{ and ($a | get "loki.enabled") (not ($a | get "loki.enableOpenTelemetry")) }}
3333
namespace: monitoring
3434
<<: *default
35+
- name: prometheus-msteams-artifacts
36+
installed: {{ has "msteams" ($v | get "alerts.receivers") }}
37+
namespace: monitoring
38+
<<: *raw
3539
- name: prometheus-msteams
3640
installed: {{ has "msteams" ($v | get "alerts.receivers") }}
3741
namespace: monitoring
38-
<<: *default
42+
missingFileHandler: Debug
43+
chart: ../charts/prometheus-msteams
44+
values:
45+
- ../values/prometheus-msteams/prometheus-msteams.gotmpl
46+
- snippets/common.gotmpl
47+
- configFile: /etc/secret/connectors.yaml
48+
extraVolumes:
49+
- name: connectors-secret
50+
secret:
51+
secretName: prometheus-msteams-connectors
52+
extraVolumeMounts:
53+
- name: connectors-secret
54+
mountPath: /etc/secret

‎tests/fixtures/env/apps/kubeflow-pipelines.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,4 @@ spec:
77
persistence:
88
mysql:
99
size: 20Gi
10-
rootPassword: mysqlsomesecretvalue
1110
_rawValues: {}

‎tests/fixtures/env/settings/alerts.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,5 @@ spec:
66
receivers:
77
- slack
88
- msteams
9-
msteams:
10-
highPrio: https://xxxxxxx.com
11-
lowPrio: https://xxxxxxxx.com
9+
msteams: {}
1210
slack: {}

‎tests/fixtures/env/settings/obj.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ spec:
66
provider:
77
linode:
88
accessKeyId: someaccessKeyId
9-
secretAccessKey: somesecretvalue
109
buckets:
1110
cnpg: my-clusterid-cnpg
1211
gitea: my-clusterid-gitea

‎tests/fixtures/env/settings/otomi.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ metadata:
55
spec:
66
globalPullSecret:
77
username: otomi
8-
password: blablabla
98
hasExternalDNS: true
109
hasExternalIDP: false
1110
nodeSelector:

‎values/k8s/k8s-raw-teams.gotmpl‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{{- $v := .Values }}
22
{{- $cm := $v.apps | get "cert-manager" }}
3-
{{- $dockerConfigTpl := readFile "../../helmfile.d/snippets/dockercfg.gotmpl" }}
43
resources:
54
{{- range $id, $team := omit $v.teamConfig "admin"}}
65
{{- $ns := printf "team-%s" $id }}
@@ -17,14 +16,31 @@ resources:
1716
istio-injection: enabled
1817
{{- end }}
1918
{{- with $v.otomi | get "globalPullSecret" nil }}
20-
- apiVersion: v1
21-
kind: Secret
22-
type: kubernetes.io/dockerconfigjson
19+
{{- $gpsUsername := . | get "username" "" }}
20+
{{- $gpsServer := . | get "server" "docker.io" }}
21+
{{- $gpsEmail := . | get "email" "not@val.id" }}
22+
- apiVersion: external-secrets.io/v1beta1
23+
kind: ExternalSecret
2324
metadata:
2425
name: otomi-pullsecret-global
2526
namespace: {{ $ns }}
26-
data:
27-
.dockerconfigjson: {{ tpl $dockerConfigTpl . | b64enc }}
27+
spec:
28+
refreshInterval: 1h
29+
secretStoreRef:
30+
name: core-secrets-store
31+
kind: ClusterSecretStore
32+
target:
33+
name: otomi-pullsecret-global
34+
creationPolicy: Owner
35+
template:
36+
type: kubernetes.io/dockerconfigjson
37+
data:
38+
.dockerconfigjson: '{"auths":{"{{ $gpsServer }}":{"username":"{{ $gpsUsername }}","password":"{{ "{{ .password | toString }}" }}","email":"{{ $gpsEmail }}"}}}'
39+
data:
40+
- secretKey: password
41+
remoteRef:
42+
key: otomi-secrets
43+
property: globalPullSecret_password
2844
{{- end }}
2945
# patching service account here as helm does not recognize it as it's own
3046
- apiVersion: v1

‎values/k8s/k8s-raw.gotmpl‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{{- $v := .Values }}
22
{{- $cm := $v.apps | get "cert-manager" }}
3-
{{- $dockerConfigTpl := readFile "../../helmfile.d/snippets/dockercfg.gotmpl" }}
43
resources:
54
{{- if ( (hasKey $v "bootstrap"))}}
65
- {{- $v.bootstrap | toYaml | nindent 4 }}
@@ -21,14 +20,31 @@ resources:
2120
{{- end }}
2221
{{- with $ns | get "labels" nil }}{{ toYaml . | nindent 8 }}{{ end }}
2322
{{- with $v.otomi | get "globalPullSecret" nil }}
24-
- apiVersion: v1
25-
kind: Secret
26-
type: kubernetes.io/dockerconfigjson
23+
{{- $gpsUsername := . | get "username" "" }}
24+
{{- $gpsServer := . | get "server" "docker.io" }}
25+
{{- $gpsEmail := . | get "email" "not@val.id" }}
26+
- apiVersion: external-secrets.io/v1beta1
27+
kind: ExternalSecret
2728
metadata:
2829
name: otomi-pullsecret-global
2930
namespace: {{ $ns.name }}
30-
data:
31-
.dockerconfigjson: {{ tpl $dockerConfigTpl . | b64enc }}
31+
spec:
32+
refreshInterval: 1h
33+
secretStoreRef:
34+
name: core-secrets-store
35+
kind: ClusterSecretStore
36+
target:
37+
name: otomi-pullsecret-global
38+
creationPolicy: Owner
39+
template:
40+
type: kubernetes.io/dockerconfigjson
41+
data:
42+
.dockerconfigjson: '{"auths":{"{{ $gpsServer }}":{"username":"{{ $gpsUsername }}","password":"{{ "{{ .password | toString }}" }}","email":"{{ $gpsEmail }}"}}}'
43+
data:
44+
- secretKey: password
45+
remoteRef:
46+
key: otomi-secrets
47+
property: globalPullSecret_password
3248
{{- end }}
3349
- apiVersion: v1
3450
kind: ServiceAccount

‎values/kubeflow-pipelines/kubeflow-pipelines-raw.gotmpl‎

Lines changed: 46 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,60 @@
11
{{- $v := .Values }}
2-
{{- $kfp := index $v.apps "kubeflow-pipelines" }}
32
{{- $obj := $v.obj.provider }}
43
{{- $httpRoute := tpl (readFile "../../helmfile.d/snippets/routes.gotmpl") $v | fromYaml }}
54
{{- $hostname := print "kubeflow-pipelines." $v.cluster.domainSuffix }}
65
resources:
7-
- apiVersion: v1
8-
kind: Secret
6+
- apiVersion: external-secrets.io/v1beta1
7+
kind: ExternalSecret
98
metadata:
10-
labels:
11-
app: kubeflow-pipelines
129
name: kfp-mysql-secret
13-
data:
14-
password: "{{ $kfp.rootPassword | b64enc }}"
15-
username: "{{ "root" | b64enc }}"
10+
spec:
11+
refreshInterval: 1h
12+
secretStoreRef:
13+
name: core-secrets-store
14+
kind: ClusterSecretStore
15+
target:
16+
name: kfp-mysql-secret
17+
creationPolicy: Owner
18+
template:
19+
type: Opaque
20+
data:
21+
username: root
22+
password: '{{ "{{ .rootPassword | toString }}" }}'
23+
data:
24+
- secretKey: rootPassword
25+
remoteRef:
26+
key: kubeflow-pipelines-secrets
27+
property: rootPassword
28+
{{- if eq $obj.type "linode" }}
29+
- apiVersion: external-secrets.io/v1beta1
30+
kind: ExternalSecret
31+
metadata:
32+
name: mlpipeline-obj-artifact
33+
spec:
34+
refreshInterval: 1h
35+
secretStoreRef:
36+
name: core-secrets-store
37+
kind: ClusterSecretStore
38+
target:
39+
name: mlpipeline-obj-artifact
40+
creationPolicy: Owner
41+
template:
42+
type: Opaque
43+
data:
44+
accesskey: {{ $obj.linode.accessKeyId }}
45+
secretkey: '{{ "{{ .secretAccessKey | toString }}" }}'
46+
data:
47+
- secretKey: secretAccessKey
48+
remoteRef:
49+
key: obj-secrets
50+
property: provider_linode_secretAccessKey
51+
{{- else }}
1652
- apiVersion: v1
1753
kind: Secret
1854
metadata:
19-
labels:
20-
app: kubeflow-pipelines
2155
name: mlpipeline-obj-artifact
22-
data:
23-
{{- if eq $obj.type "linode" }}
24-
accesskey: "{{ $obj.linode.accessKeyId | b64enc }}"
25-
secretkey: "{{ $obj.linode.secretAccessKey | b64enc }}"
26-
{{- end }}
56+
data: {}
57+
{{- end }}
2758
- apiVersion: gateway.networking.k8s.io/v1
2859
kind: HTTPRoute
2960
metadata:

0 commit comments

Comments
 (0)