-
Notifications
You must be signed in to change notification settings - Fork 786
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
simplify values + secret templating #4328
Labels
area/helm
kind/enhancement
An enhancement of an existing feature
priority/important-soon
Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
Comments
jstrachan
added a commit
to jstrachan/jx
that referenced
this issue
Jun 19, 2019
and add support for `vault:` for the vault client and `local:` for the local file system client Signed-off-by: James Strachan <james.strachan@gmail.com> jenkins-x#4328
jstrachan
added a commit
to jstrachan/jx
that referenced
this issue
Jun 19, 2019
and add support for `vault:` for the vault client and `local:` for the local file system client Signed-off-by: James Strachan <james.strachan@gmail.com> jenkins-x#4328
jstrachan
added a commit
to jstrachan/jx
that referenced
this issue
Jun 19, 2019
* also support referencing logical Parameters in a `parameters.yaml` file which can include a logical structure + schema (for nice install tooling) which then contains inline values for simple values or URLs to vault/local secret files for better secret management fixes jenkins-x#4328 Signed-off-by: James Strachan <james.strachan@gmail.com>
btw here's a test case showing
|
jstrachan
added a commit
to jstrachan/jx
that referenced
this issue
Jun 20, 2019
and add support for `vault:` for the vault client and `local:` for the local file system client Signed-off-by: James Strachan <james.strachan@gmail.com> jenkins-x#4328
jstrachan
added a commit
to jstrachan/jx
that referenced
this issue
Jun 20, 2019
* also support referencing logical Parameters in a `parameters.yaml` file which can include a logical structure + schema (for nice install tooling) which then contains inline values for simple values or URLs to vault/local secret files for better secret management fixes jenkins-x#4328 Signed-off-by: James Strachan <james.strachan@gmail.com>
pmuir
pushed a commit
to pmuir/jx
that referenced
this issue
Jun 20, 2019
…enkins-x#4330) * fix: refactor out a sub-interface from Vault for VaultURL injection * so we can support local file system vault-like behaviour or real Vault from a small simple interface (which is a small subset of Vault client) * same URL structure works for vault + local file system referencing Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: refactor vaulturl -> secreturl Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets move URL handling into the secreturl.Client and add support for `vault:` for the vault client and `local:` for the local file system client Signed-off-by: James Strachan <james.strachan@gmail.com> jenkins-x#4328 * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: allow `values.yaml` to include go template functions * also support referencing logical Parameters in a `parameters.yaml` file which can include a logical structure + schema (for nice install tooling) which then contains inline values for simple values or URLs to vault/local secret files for better secret management fixes jenkins-x#4328 Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix failing tests due to refactor Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix failing tests due to refactor Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: avoid failing when bootstrapping a cluster and we don't yet have the install config ConfigMap setup Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets populate the cluster information in the cluster/values.yaml Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix broken test Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets allow templating in the root `values.yaml` too added a test + fix for templating in the root dir as well as any nested `values.yaml` files Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: polished the code thanks for the great feedback @ccojocar * renamed `vaultClient` -> `secretURLClient` * fixed up mock generation * zapped the `GetClusterName` and reused the existing helper Signed-off-by: James Strachan <james.strachan@gmail.com>
This was referenced Jun 20, 2019
daveconde
pushed a commit
to daveconde/jx
that referenced
this issue
Apr 7, 2020
…enkins-x#4330) * fix: refactor out a sub-interface from Vault for VaultURL injection * so we can support local file system vault-like behaviour or real Vault from a small simple interface (which is a small subset of Vault client) * same URL structure works for vault + local file system referencing Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: refactor vaulturl -> secreturl Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets move URL handling into the secreturl.Client and add support for `vault:` for the vault client and `local:` for the local file system client Signed-off-by: James Strachan <james.strachan@gmail.com> jenkins-x#4328 * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: allow `values.yaml` to include go template functions * also support referencing logical Parameters in a `parameters.yaml` file which can include a logical structure + schema (for nice install tooling) which then contains inline values for simple values or URLs to vault/local secret files for better secret management fixes jenkins-x#4328 Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix hound warning Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix failing tests due to refactor Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix failing tests due to refactor Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: avoid failing when bootstrapping a cluster and we don't yet have the install config ConfigMap setup Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets populate the cluster information in the cluster/values.yaml Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: fix broken test Signed-off-by: James Strachan <james.strachan@gmail.com> * fix: lets allow templating in the root `values.yaml` too added a test + fix for templating in the root dir as well as any nested `values.yaml` files Signed-off-by: James Strachan <james.strachan@gmail.com> * chore: polished the code thanks for the great feedback @ccojocar * renamed `vaultClient` -> `secretURLClient` * fixed up mock generation * zapped the `GetClusterName` and reused the existing helper Signed-off-by: James Strachan <james.strachan@gmail.com>
This issue was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
area/helm
kind/enhancement
An enhancement of an existing feature
priority/important-soon
Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
we need to make it easier to populate the Secrets from a smaller set of actual values stored in vault (or locally on the file system if need be).
see an early iteration here: #4323
but after various discussions we're thinking of a simpler approach.
jx step helm apply
allowvalues.yaml
files to use go/helm templates liketemplates/foo.yaml
does inside helm charts so that we can generate value/secret strings which can use templating to compose things from smaller secret values. e.g. creating a mavensettings.xml
file or dockerconfig.json
which includes many user/passwords for different registriesvalues.yaml
file which does all of this composition and reference the actual secret values via URLs (or template functions) to access vault or local vault filesParameters
values.yaml
files. e.g. we use thepipelineUser.username
andpipelineUser.token
in many apps (prow, tekton, secret templates for jenkins x platform et al)Use go templating in
values.yaml
So that we can easily reuse value or secret parameters (from vault / local files) in any values.yaml value expression we enable go templating in
values.yaml
files. This lets us refer to a named parameter anywhere in any value in anyvalues.yaml
file in any chart.e.g. we can inject the login/pwd of a particular registry inside the maven
settings.xml
file in a values.yaml value - ditto for each user/pwd for each docker registry in the dockerconfig.json
secret.To do this we use
{{ .Parameter.pipelineUser.token }}
syntax somewhere in thevalues.yaml
file.In addition we can use
{{ secret "vault:/foo/bar" }}
syntax to inject URLs from physical locations or disk etcThe text was updated successfully, but these errors were encountered: