Skip to content

Commit b034d99

Browse files
dervoetinightkr
dervoeti
and
nightkr
authored
feat: migrate CA secret to new namespace (#476)
* feat: migrate CA secret to new namespace * fix: add helm hook annotations to prevent race condition * fix: separated secret migration RBAC * fix: added shebang to fix shellcheck complaint * Update deploy/helm/secret-operator/templates/secret_migration_job.yaml Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se> * Update deploy/helm/secret-operator/templates/secret_migration_job.yaml Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se> * Update deploy/helm/secret-operator/templates/secret_migration_job.yaml Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se> * Update deploy/helm/secret-operator/templates/secret_migration_job.yaml Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se> * Update deploy/helm/secret-operator/templates/secret_migration_job.yaml Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se> * fix: copy paste error * fix: merged migration resoures into one file * fix: unmerged resources / added hook weights instead to guarantee order --------- Co-authored-by: Natalie Klestrup Röijezon <teo@nullable.se>
1 parent b1a615e commit b034d99

File tree

3 files changed

+123
-0
lines changed

3 files changed

+123
-0
lines changed

‎deploy/helm/secret-operator/templates/secret_migration_job.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
# Migrates the TLS CA keypair from the hard-coded default namespace to the operator namespace
3+
# See https://github.com/stackabletech/secret-operator/issues/453
4+
apiVersion: batch/v1
5+
kind: Job
6+
metadata:
7+
name: {{ include "operator.fullname" . }}-secret-migration
8+
annotations:
9+
"helm.sh/hook": pre-install
10+
"helm.sh/hook-delete-policy": hook-succeeded
11+
"helm.sh/hook-weight": "-5"
12+
labels:
13+
{{- include "operator.labels" . | nindent 4 }}
14+
spec:
15+
template:
16+
metadata:
17+
{{- with .Values.podAnnotations }}
18+
annotations:
19+
{{- toYaml . | nindent 8 }}
20+
{{- end }}
21+
labels:
22+
{{- include "operator.selectorLabels" . | nindent 8 }}
23+
spec:
24+
{{- with .Values.image.pullSecrets }}
25+
imagePullSecrets:
26+
{{- toYaml . | nindent 8 }}
27+
{{- end }}
28+
serviceAccountName: {{ include "operator.fullname" . }}-secret-migration-serviceaccount
29+
securityContext:
30+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
31+
containers:
32+
- name: migrate-secret
33+
image: "{{ .Values.secretMigrationJob.image.repository }}:1.0.0-stackable{{ .Chart.AppVersion }}"
34+
imagePullPolicy: {{ .Values.secretMigrationJob.image.pullPolicy }}
35+
resources:
36+
{{ .Values.secretMigrationJob.resources | toYaml | nindent 12 }}
37+
command: ["bash", "-c"]
38+
args:
39+
- |
40+
#!/bin/bash
41+
set -euo pipefail
42+
SOURCE_NAMESPACE=default
43+
TARGET_NAMESPACE={{ .Values.secretClasses.tls.caSecretNamespace | default .Release.Namespace }}
44+
45+
# only continue if secret exists
46+
if source_ca_secret="$(kubectl get secret -n $SOURCE_NAMESPACE secret-provisioner-tls-ca -o json)"; then
47+
echo "secret exists in namespace $SOURCE_NAMESPACE"
48+
# only continue if secret in target namespace does NOT exist
49+
if ! kubectl get secret -n $TARGET_NAMESPACE secret-provisioner-tls-ca; then
50+
echo "secret does not exist in namespace $TARGET_NAMESPACE"
51+
# copy secret from default to {{ .Values.secretClasses.tls.caSecretNamespace | default .Release.Namespace }}
52+
echo "$source_ca_secret" | jq 'del(.metadata["namespace","creationTimestamp","resourceVersion","selfLink","uid"])' | kubectl apply -n $TARGET_NAMESPACE -f -
53+
fi
54+
fi
55+
restartPolicy: Never

‎deploy/helm/secret-operator/templates/secret_migration_rbac.yaml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "operator.fullname" . }}-secret-migration-serviceaccount
6+
labels:
7+
{{- include "operator.labels" . | nindent 4 }}
8+
annotations:
9+
"helm.sh/hook": pre-install
10+
"helm.sh/hook-delete-policy": hook-succeeded
11+
"helm.sh/hook-weight": "-10"
12+
{{- with .Values.serviceAccount.annotations }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
---
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRoleBinding
18+
metadata:
19+
name: {{ include "operator.fullname" . }}-secret-migration-clusterrolebinding
20+
annotations:
21+
"helm.sh/hook": pre-install
22+
"helm.sh/hook-delete-policy": hook-succeeded
23+
"helm.sh/hook-weight": "-10"
24+
labels:
25+
{{- include "operator.labels" . | nindent 4 }}
26+
subjects:
27+
- kind: ServiceAccount
28+
name: {{ include "operator.fullname" . }}-secret-migration-serviceaccount
29+
namespace: {{ .Release.Namespace }}
30+
roleRef:
31+
kind: ClusterRole
32+
name: {{ include "operator.fullname" . }}-secret-migration-clusterrole
33+
apiGroup: rbac.authorization.k8s.io
34+
---
35+
apiVersion: rbac.authorization.k8s.io/v1
36+
kind: ClusterRole
37+
metadata:
38+
name: {{ include "operator.fullname" . }}-secret-migration-clusterrole
39+
annotations:
40+
"helm.sh/hook": pre-install
41+
"helm.sh/hook-delete-policy": hook-succeeded
42+
"helm.sh/hook-weight": "-10"
43+
labels:
44+
{{- include "operator.labels" . | nindent 4 }}
45+
rules:
46+
- apiGroups:
47+
- ""
48+
resources:
49+
- secrets
50+
verbs:
51+
- get
52+
- list
53+
- watch
54+
- create
55+
- patch
56+
- update

‎deploy/helm/secret-operator/values.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,18 @@ image:
55
pullPolicy: IfNotPresent
66
pullSecrets: []
77

8+
secretMigrationJob:
9+
image:
10+
repository: docker.stackable.tech/stackable/tools
11+
pullPolicy: IfNotPresent
12+
resources:
13+
requests:
14+
cpu: 100m
15+
memory: 128Mi
16+
limits:
17+
cpu: 100m
18+
memory: 128Mi
19+
820
csiProvisioner:
921
image:
1022
repository: docker.stackable.tech/k8s/sig-storage/csi-provisioner

0 commit comments

Comments
 (0)