-
Notifications
You must be signed in to change notification settings - Fork 78
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Allow loading secrets from a separate config file
Currently all config is in a kubernetes secret because some of the config keys the helm chart renders might be secrets. This is a problem, as a lot of people don't want to, or don't have the option to manage secrets with helm (eg. secret management is fully decoupled from helm deployments). To fix this, utilize go viper's solution that allows deep-merging multiple config file contents. This allows for splitting out the potentially sensitive keys into a separate config file, and then having viper merge them back together. The helm chart was modified so it retains backward compatibility with the `existingTargetConfig` config option. If that key exists then it is assumed that it is a kubernetes secret (as before), and the separation of config values and secrets is not performed by the chart. This PR should be able fixes #454
- Loading branch information
Showing
6 changed files
with
137 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
--- | ||
loki: | ||
host: {{ .Values.target.loki.host | quote }} | ||
username: {{ .Values.target.loki.username | quote }} | ||
password: {{ .Values.target.loki.password | quote }} | ||
|
||
elasticsearch: | ||
host: {{ .Values.target.elasticsearch.host | quote }} | ||
username: {{ .Values.target.elasticsearch.username | quote }} | ||
password: {{ .Values.target.elasticsearch.password | quote }} | ||
apiKey: {{ .Values.target.elasticsearch.apiKey | quote }} | ||
typelessApi: {{ .Values.target.elasticsearch.typelessApi }} | ||
|
||
slack: | ||
webhook: {{ .Values.target.slack.webhook | quote }} | ||
channel: {{ .Values.target.slack.channel | quote }} | ||
|
||
discord: | ||
webhook: {{ .Values.target.discord.webhook | quote }} | ||
|
||
teams: | ||
webhook: {{ .Values.target.teams.webhook | quote }} | ||
|
||
webhook: | ||
host: {{ .Values.target.webhook.host | quote }} | ||
token: {{ .Values.target.webhook.token| quote }} | ||
|
||
telegram: | ||
token: {{ .Values.target.telegram.token | quote }} | ||
host: {{ .Values.target.telegram.host | quote }} | ||
|
||
googleChat: | ||
webhook: {{ .Values.target.googleChat.webhook | quote }} | ||
|
||
s3: | ||
accessKeyID: {{ .Values.target.s3.accessKeyID }} | ||
secretAccessKey: {{ .Values.target.s3.secretAccessKey }} | ||
kmsKeyId: {{ .Values.target.s3.kmsKeyId }} | ||
|
||
kinesis: | ||
accessKeyID: {{ .Values.target.kinesis.accessKeyID }} | ||
secretAccessKey: {{ .Values.target.kinesis.secretAccessKey }} | ||
|
||
securityHub: | ||
accountID: {{ .Values.target.securityHub.accountID }} | ||
accessKeyID: {{ .Values.target.securityHub.accessKeyID }} | ||
secretAccessKey: {{ .Values.target.securityHub.secretAccessKey }} | ||
|
||
gcs: | ||
credentials: {{ .Values.target.gcs.credentials }} | ||
|
||
api: | ||
basicAuth: | ||
username: {{ .Values.global.basicAuth.username }} | ||
password: {{ .Values.global.basicAuth.password }} | ||
|
||
database: | ||
username: {{ .Values.global.basicAuth.username }} | ||
password: {{ .Values.global.basicAuth.password }} | ||
|
||
redis: | ||
username: {{ .Values.redis.username }} | ||
password: {{ .Values.redis.password }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{{- if not .Values.existingTargetConfig.enabled }} | ||
apiVersion: v1 | ||
kind: ConfigMap | ||
metadata: | ||
name: {{ include "policyreporter.fullname" . }}-config | ||
namespace: {{ include "policyreporter.namespace" . }} | ||
{{- if .Values.annotations }} | ||
annotations: | ||
{{- toYaml .Values.annotations | nindent 4 }} | ||
{{- end }} | ||
labels: | ||
{{- include "policyreporter.labels" . | nindent 4 }} | ||
data: | ||
config.yaml: {{ tpl (.Files.Get "config.yaml") . }} | ||
{{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters