Skip to content

Commit c0c8d21

Browse files
paulparkinsonpaulparkinson
authored
k8s vs vault secret option (#18)
* k8s vs vault secret option * k8s vs vault secret option * k8s vs vault secret option
1 parent a86f4a6 commit c0c8d21

File tree

15 files changed

+157
-32
lines changed

15 files changed

+157
-32
lines changed

‎grabdish/atp-secrets-setup/deleteAll.sh

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33
## Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
44

55

6-
echo deleting all secrets in msdataworkshop namespace...
7-
kubectl delete --all secrets --namespace=msdataworkshop
6+
echo deleting secrets in msdataworkshop namespace...
7+
kubectl delete secret atp-demo-binding-inventory --namespace=msdataworkshop
8+
kubectl delete secret atp-demo-binding-order --namespace=msdataworkshop
9+
810

911
echo deleting generated-yaml dir...
1012
rm -rf generated-yaml
1113

12-
echo deleting wallet dirs...
13-
rm -rf orderdbwallet
14-
rm -rf inventorydbwallet
15-
rm -rf tls
14+
echo deleting wallet dir...
15+
rm -rf wallet

‎grabdish/atpaqadmin/atpaqadmin-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ spec:
5454
value: "%OCI_REGION%"
5555
- name: VAULT_SECRET_OCID
5656
value: "%VAULT_SECRET_OCID%"
57+
- name: dbpassword
58+
valueFrom:
59+
secretKeyRef:
60+
name: dbuser
61+
key: dbpassword
62+
optional: true #not needed/used if using VAULT_SECRET_OCID exists
5763
- name: cwalletobjecturi
5864
value: "%cwalletobjecturi%"
5965
- name: orderhostname

‎grabdish/atpaqadmin/src/main/java/oracle/db/microservices/ATPAQAdminResource.java

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import javax.enterprise.event.Observes;
1616
import javax.inject.Inject;
1717
import javax.inject.Named;
18-
import javax.sql.DataSource;
1918
import javax.ws.rs.*;
2019
import javax.ws.rs.core.MediaType;
2120
import javax.ws.rs.core.Response;
@@ -27,6 +26,7 @@ public class ATPAQAdminResource {
2726
PropagationSetup propagationSetup;
2827
static String regionId = System.getenv("OCI_REGION").trim();
2928
static String pwSecretOcid = System.getenv("VAULT_SECRET_OCID").trim();
29+
static String pwSecretFromK8s = System.getenv("dbpassword");
3030
static String orderuser = "ORDERUSER";
3131
static String orderpw;
3232
static String inventoryuser = "INVENTORYUSER";
@@ -61,8 +61,14 @@ public class ATPAQAdminResource {
6161
private PoolDataSource inventorypdbDataSource;
6262

6363
public void init(@Observes @Initialized(ApplicationScoped.class) Object init) throws SQLException {
64-
System.out.println("ATPAQAdminResource.init " + init);
65-
orderpw = inventorypw = OCISDKUtility.getSecreteFromVault(true, regionId, pwSecretOcid);
64+
String pw;
65+
if(!"".equals(pwSecretOcid.trim())) {
66+
System.out.println("Using OCI Vault secret");
67+
pw = OCISDKUtility.getSecreteFromVault(true, regionId, pwSecretOcid);
68+
} else {
69+
pw = pwSecretFromK8s;
70+
}
71+
orderpw = inventorypw = pw;
6672
orderpdbDataSource.setUser("ADMIN");
6773
orderpdbDataSource.setPassword(orderpw);
6874
inventorypdbDataSource.setUser("ADMIN");

‎grabdish/createATPPDBs.sh

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,13 @@ then
2828
echo Usage example : ./createATPPDBs.sh ocid1.vaultsecret.oc1.phx.DBADMINSECRETOCIDd3ejhlewv3wieyd5q ocid1.vaultsecret.oc1.phx.FRONTENDAUTHSECRETOCIDd3ejhlewv3wieyd5q
2929
exit
3030
fi
31-
echo $1 > $WORKINGDIR/msdataworkshopvaultsecretocid.txt
3231

33-
PASSWORD=`oci secrets secret-bundle get --secret-id $1 --query "data.\"secret-bundle-content\".content" --raw-output | base64 --decode`
32+
33+
echo "" > $WORKINGDIR/msdataworkshopvaultsecretocid.txt
34+
# todo if(!greenbutton) echo $1 > $WORKINGDIR/msdataworkshopvaultsecretocid.txt
35+
36+
PASSWORDENCODED=`oci secrets secret-bundle get --secret-id $1 --query "data.\"secret-bundle-content\".content" --raw-output`
37+
PASSWORD=`echo -n Welcome12345 | base64`
3438
umask 177
3539
cat >pw <<!
3640
{ "adminPassword": "$PASSWORD" }
@@ -39,11 +43,25 @@ echo create order PDB...
3943
oci db autonomous-database create --compartment-id $MSDATAWORKSHOP_COMPARTMENT_ID --cpu-core-count 1 --data-storage-size-in-tbs 1 --db-name ORDERDB --display-name ORDERDB --from-json file://pw | jq --raw-output '.data | .["id"] '> $WORKINGDIR/msdataworkshoporderdbid.txt
4044
echo create inventory PDB...
4145
oci db autonomous-database create --compartment-id $MSDATAWORKSHOP_COMPARTMENT_ID --cpu-core-count 1 --data-storage-size-in-tbs 1 --db-name INVENTORYDB --display-name INVENTORYDB --from-json file://pw | jq --raw-output '.data | .["id"] '> $WORKINGDIR/msdataworkshopinventorydbid.txt
42-
rm pw
4346

4447
echo create msdataworkshop namespace
4548
kubectl create namespace msdataworkshop
4649

50+
echo create db pw secret...
51+
kubectl create -n msdataworkshop -f - <<!
52+
{
53+
"apiVersion": "v1",
54+
"kind": "Secret",
55+
"metadata": {
56+
"name": "dbuser"
57+
},
58+
"data": {
59+
"dbpassword": "${PASSWORDENCODED}"
60+
}
61+
}
62+
!
63+
rm pw
64+
4765
echo create frontendadmin auth secret...
4866
AUTHPASSWORD=`oci secrets secret-bundle get --secret-id $2 --query "data.\"secret-bundle-content\".content" --raw-output`
4967
kubectl create -n msdataworkshop -f - <<!
@@ -58,3 +76,4 @@ kubectl create -n msdataworkshop -f - <<!
5876
}
5977
}
6078
!
79+

‎grabdish/frontend-helidon/frontend-helidon-deployment-2021-04-01_13:20:41.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
##
3+
## Copyright (c) 2021 Oracle and/or its affiliates.
4+
## Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
5+
apiVersion: apps/v1
6+
kind: Deployment
7+
metadata:
8+
name: frontend-helidon
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
app: frontend
14+
template:
15+
metadata:
16+
labels:
17+
app: frontend
18+
version: helidon-mp
19+
spec:
20+
containers:
21+
- name: frontend
22+
image: %DOCKER_REGISTRY%/frontend-helidon:0.1
23+
imagePullPolicy: Always
24+
env:
25+
- name: SECRETS_PASSWORD
26+
valueFrom:
27+
secretKeyRef:
28+
name: frontendadmin
29+
key: password
30+
ports:
31+
- containerPort: 8080

‎grabdish/inventory-helidon-se/dependency-reduced-pom.xml

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,3 @@
1-
<!--
2-
3-
4-
##
5-
## Copyright (c) 2021 Oracle and/or its affiliates.
6-
## Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
7-
8-
9-
-->
101
<?xml version="1.0" encoding="UTF-8"?>
112
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
123
<modelVersion>4.0.0</modelVersion>
@@ -113,7 +104,7 @@
113104
<dependency>
114105
<groupId>junit</groupId>
115106
<artifactId>junit</artifactId>
116-
<version>4.13</version>
107+
<version>4.13.1</version>
117108
<scope>test</scope>
118109
<exclusions>
119110
<exclusion>
@@ -125,7 +116,7 @@
125116
<dependency>
126117
<groupId>com.fasterxml.jackson.core</groupId>
127118
<artifactId>jackson-databind</artifactId>
128-
<version>2.10.2</version>
119+
<version>2.10.5.1</version>
129120
<scope>provided</scope>
130121
</dependency>
131122
<dependency>
@@ -188,21 +179,39 @@
188179
<version>1.4.3</version>
189180
<scope>provided</scope>
190181
</dependency>
182+
<dependency>
183+
<groupId>com.oracle.oci.sdk</groupId>
184+
<artifactId>oci-java-sdk-vault</artifactId>
185+
<version>1.32.2</version>
186+
<scope>provided</scope>
187+
</dependency>
188+
<dependency>
189+
<groupId>com.oracle.oci.sdk</groupId>
190+
<artifactId>oci-java-sdk-common</artifactId>
191+
<version>1.32.2</version>
192+
<scope>provided</scope>
193+
</dependency>
194+
<dependency>
195+
<groupId>com.oracle.oci.sdk</groupId>
196+
<artifactId>oci-java-sdk-secrets</artifactId>
197+
<version>1.32.2</version>
198+
<scope>provided</scope>
199+
</dependency>
191200
</dependencies>
192201
<properties>
193202
<project.build.targetEncoding>UTF-8</project.build.targetEncoding>
194203
<java.version>1.8</java.version>
195204
<docker.image.prefix>${env.DOCKER_REGISTRY}</docker.image.prefix>
196205
<docker.image.version>${env.IMAGE_VERSION}</docker.image.version>
197-
<jackson.version>2.10.2</jackson.version>
206+
<jackson.version>2.10.5.1</jackson.version>
198207
<compiler-plugin.version>3.8.1</compiler-plugin.version>
199208
<jar-plugin.version>3.2.0</jar-plugin.version>
200209
<lombok.version>1.18.2</lombok.version>
201210
<docker.image.name>${env.IMAGE_NAME}</docker.image.name>
202211
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
203212
<jar.main.class>com.helidon.se.Main</jar.main.class>
204213
<skipTests>true</skipTests>
205-
<junit.version>4.13</junit.version>
214+
<junit.version>4.13.1</junit.version>
206215
<ojdbc10.version>19.3.0.0</ojdbc10.version>
207216
<helidon.version>1.4.3</helidon.version>
208217
<shade-plugin.version>3.2.1</shade-plugin.version>

‎grabdish/inventory-helidon-se/inventory-helidon-se-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ spec:
7676
value: "%OCI_REGION%"
7777
- name: VAULT_SECRET_OCID
7878
value: "%VAULT_SECRET_OCID%"
79+
- name: dbpassword
80+
valueFrom:
81+
secretKeyRef:
82+
name: dbuser
83+
key: dbpassword
84+
optional: true #not needed/used if using VAULT_SECRET_OCID exists
7985
restartPolicy: Always
8086
volumes:
8187
- name: creds-raw

‎grabdish/inventory-helidon/inventory-helidon-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ spec:
4545
value: "%OCI_REGION%"
4646
- name: VAULT_SECRET_OCID
4747
value: "%VAULT_SECRET_OCID%"
48+
- name: dbpassword
49+
valueFrom:
50+
secretKeyRef:
51+
name: dbuser
52+
key: dbpassword
53+
optional: true #not needed/used if using VAULT_SECRET_OCID exists
4854
volumeMounts:
4955
- name: creds
5056
mountPath: /msdataworkshop/creds

‎grabdish/inventory-helidon/src/main/java/io/helidon/data/examples/InventoryResource.java

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ public class InventoryResource {
2929
PoolDataSource atpInventoryPDB;
3030
static String regionId = System.getenv("OCI_REGION").trim();
3131
static String pwSecretOcid = System.getenv("VAULT_SECRET_OCID").trim();
32+
static String pwSecretFromK8s = System.getenv("dbpassword").trim();
3233
static String inventoryuser = "INVENTORYUSER";
3334
static String inventorypw;
3435
static String inventoryQueueName = "inventoryqueue";
@@ -40,12 +41,16 @@ public class InventoryResource {
4041

4142
public void init(@Observes @Initialized(ApplicationScoped.class) Object init) throws SQLException {
4243
System.out.println("InventoryResource.init " + init);
43-
String secreteFromVault = OCISDKUtility.getSecreteFromVault(true, regionId, pwSecretOcid);
44-
inventorypw = secreteFromVault;
44+
String pw;
45+
if(!pwSecretOcid.trim().equals("")) {
46+
pw = OCISDKUtility.getSecreteFromVault(true, regionId, pwSecretOcid);
47+
} else {
48+
pw = pwSecretFromK8s;
49+
}
50+
inventorypw = pw;
4551
atpInventoryPDB.setUser(inventoryuser);
46-
atpInventoryPDB.setPassword(secreteFromVault);
52+
atpInventoryPDB.setPassword(pw);
4753
inventoryuser = atpInventoryPDB.getUser();
48-
System.out.println("InventoryResource.init inventoryuser:" + inventoryuser + " inventorypw:" + inventorypw);
4954
try (Connection connection = atpInventoryPDB.getConnection()) { //fail if connection is not successful rather than go into listening loop
5055
System.out.println("InventoryResource.init connection:" + connection);
5156
}

‎grabdish/inventory-nodejs/inventory-nodejs-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ spec:
5959
value: "%OCI_REGION%"
6060
- name: VAULT_SECRET_OCID
6161
value: "%VAULT_SECRET_OCID%"
62+
- name: dbpassword
63+
valueFrom:
64+
secretKeyRef:
65+
name: dbuser
66+
key: dbpassword
67+
optional: true #not needed/used if using VAULT_SECRET_OCID exists
6268
readinessProbe:
6369
exec:
6470
command:

0 commit comments

Comments
 (0)