Merge pull request #466 from kube-tarian/business-secret-store

create app role token and cluster secret store for business cluster

capten/common-pkg/k8s/external_secret.go

@@ -57,8 +57,9 @@ type SecretStoreSpec struct {
 }
 
 type SecretKeySelector struct {
- Name string `yaml:"name,omitempty"`
- Key string `yaml:"key,omitempty"`
+ Namespace string `yaml:"namespace,omitempty"`
+ Name string `yaml:"name,omitempty"`
+ Key string `yaml:"key,omitempty"`
 }
 
 type VaultAuth struct {
@@ -88,10 +89,9 @@ func (k *K8SClient) CreateOrUpdateSecretStore(ctx context.Context, secretStoreNa
  tokenSecretName, tokenSecretKey string) (err error) {
  secretStore := SecretStore{
  APIVersion: "external-secrets.io/v1beta1",
- Kind: "SecretStore",
+ Kind: "ClusterSecretStore",
  Metadata: ObjectMeta{
- Name: secretStoreName,
- Namespace: namespace,
+ Name: secretStoreName,
  },
  Spec: SecretStoreSpec{
  RefreshInterval: 10,
@@ -102,8 +102,9 @@ func (k *K8SClient) CreateOrUpdateSecretStore(ctx context.Context, secretStoreNa
  Version: "v2",
  Auth: VaultAuth{
  TokenSecretRef: &SecretKeySelector{
- Key: tokenSecretKey,
- Name: tokenSecretName,
+ Key: tokenSecretKey,
+ Name: tokenSecretName,
+ Namespace: namespace,
  },
  },
  },
@@ -152,7 +153,7 @@ func (k *K8SClient) CreateOrUpdateExternalSecret(ctx context.Context, externalSe
  Template: ExternalSecretTargetTemplate{Type: secretType}},
  SecretStoreRef: SecretStoreRef{
  Name: secretStoreRefName,
- Kind: "SecretStore",
+ Kind: "ClusterSecretStore",
  },
  Data: secretKeysData,
  },

capten/config-worker/internal/crossplane/config_cluster_secrets.go

@@ -13,21 +13,15 @@ var (
  vaultAppRoleTokenSecret = "approle-vault-token"
  vaultAddress = "http://vault.%s"
  cluserAppRoleName = "capten-approle-%s"
- secretStoreName = "approle-vault-store"
+ secretStoreName = "capten-vault-store"
 )
 
 func (cp *CrossPlaneApp) configureExternalSecretsOnCluster(ctx context.Context,
- clusterName, clusterID string, extSecrets []clusterExternalSecret) error {
+ clusterName, clusterID string, appRoleTokenPaths []string, extSecrets []clusterExternalSecret) error {
  logger.Infof("configure external secrets for cluster %s/%s", clusterName, clusterID)
 
- credentialPaths, namespaces := getUniqueSecretPathsAndNamespaces(extSecrets)
- if len(namespaces) == 0 {
- logger.Infof("no external secrets defined for cluster %s/%s", clusterName, clusterID)
- return nil
- }
-
  cluserAppRoleNameStr := fmt.Sprintf(cluserAppRoleName, clusterName)
- token, err := vaultcred.GetAppRoleToken(cluserAppRoleNameStr, credentialPaths)
+ token, err := vaultcred.GetAppRoleToken(cluserAppRoleNameStr, appRoleTokenPaths)
  if err != nil {
  return err
  }
@@ -38,24 +32,27 @@ func (cp *CrossPlaneApp) configureExternalSecretsOnCluster(ctx context.Context,
  return fmt.Errorf("failed to initalize k8s client, %v", err)
  }
 
+ namespace := "capten"
  vaultAddressStr := fmt.Sprintf(vaultAddress, cp.cfg.DomainName)
+ err = k8sclient.CreateNamespace(ctx, namespace)
+ if err != nil {
+ logger.Infof("failed to create namespace %s, %v", namespace, err)
+ }
 
- for _, namespace := range namespaces {
- cred := map[string][]byte{"token": []byte(token)}
- err = k8sclient.CreateOrUpdateSecret(ctx, namespace, vaultAppRoleTokenSecret, v1.SecretTypeOpaque, cred, nil)
- if err != nil {
- logger.Infof("failed to create cluter vault token secret %s/%s, %v", namespace, vaultAppRoleTokenSecret, err)
- continue
- }
+ cred := map[string][]byte{"token": []byte(token)}
+ err = k8sclient.CreateOrUpdateSecret(ctx, namespace, vaultAppRoleTokenSecret, v1.SecretTypeOpaque, cred, nil)
+ if err != nil {
+ logger.Infof("failed to create cluter vault token secret %s/%s, %v", namespace, vaultAppRoleTokenSecret, err)
+ }
 
- err := k8sclient.CreateOrUpdateSecretStore(ctx, secretStoreName, namespace,
- vaultAddressStr, vaultAppRoleTokenSecret, "token")
- if err != nil {
- return fmt.Errorf("failed to create cluter vault token secret, %v", err)
- }
- logger.Infof("created %s/%s on cluster cluster %s", namespace, secretStoreName, clusterName)
+ err = k8sclient.CreateOrUpdateSecretStore(ctx, secretStoreName, namespace,
+ vaultAddressStr, vaultAppRoleTokenSecret, "token")
+ if err != nil {
+ return fmt.Errorf("failed to create cluter vault token secret, %v", err)
  }
 
+ logger.Infof("created %s on cluster cluster %s", secretStoreName, secretStoreName, clusterName)
+
  for _, extSecret := range extSecrets {
  externalSecretName := "external-" + extSecret.SecretName
  vaultSecretData := map[string]string{}
@@ -72,25 +69,3 @@ func (cp *CrossPlaneApp) configureExternalSecretsOnCluster(ctx context.Context,
  }
  return nil
 }
-
-func getUniqueSecretPathsAndNamespaces(extSecrets []clusterExternalSecret) ([]string, []string) {
- credentialPaths := map[string]bool{}
- namspaces := map[string]bool{}
- for _, extSecret := range extSecrets {
- for _, secretData := range extSecret.VaultSecrets {
- credentialPaths[secretData.SecretPath] = true
- }
- namspaces[extSecret.Namespace] = true
- }
- return getKeysFromBoolMap(credentialPaths), getKeysFromBoolMap(namspaces)
-}
-
-func getKeysFromBoolMap(inputMap map[string]bool) []string {
- var keys []string
-
- for key := range inputMap {
- keys = append(keys, key)
- }
-
- return keys
-}

capten/config-worker/internal/crossplane/config_cluster_updates.go

@@ -123,6 +123,7 @@ func (cp *CrossPlaneApp) configureClusterUpdate(ctx context.Context, req *model.
  }
 
  err = cp.configureExternalSecretsOnCluster(ctx, req.ManagedClusterName, req.ManagedClusterId,
+ cp.pluginConfig.ClusterEndpointUpdates.AppRoleTokenVaultPaths,
  cp.pluginConfig.ClusterEndpointUpdates.ExternalSecrets)
  if err != nil {
  logger.Errorf("%v", errors.WithMessage(err, "failed to create cluster secrets"))

capten/config-worker/internal/crossplane/types.go

@@ -12,6 +12,7 @@ type clusterUpdateConfig struct {
  DefaultAppListFile string `json:"defaultAppListFile"`
  DefaultAppValuesPath string `json:"defaultAppValuesPath"`
  ClusterDefaultAppValuesPath string `json:"clusterDefaultAppValuesPath"`
+ AppRoleTokenVaultPaths []string `json:"appRoleTokenVaultPaths"`
  ExternalSecrets []clusterExternalSecret `json:"externalSecrets"`
 }
 

charts/kad/Chart.yaml

@@ -15,10 +15,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.20
+version: 0.2.21
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.28.2"
+appVersion: "1.28.3"

charts/kad/crossplane_plugin_config.json

@@ -13,6 +13,11 @@
  "defaultAppListFile": "default-apps-templates/app_list.yaml",
  "defaultAppValuesPath": "default-apps-templates/values",
  "clusterDefaultAppValuesPath": "infra/clusters/app-configs",
+ "appRoleTokenVaultPaths":[
+ "generic/cosign/signer",
+ "generic/nats/auth-token",
+ "generic/container-registry/*"
+ ],
  "externalSecrets": [
  {
  "namespace": "observability",
@@ -33,8 +38,7 @@
  "secretPath": "generic/cosign/signer"
  }
  ]
- },
-
+ }, 
  {
  "namespace": "ml-server",
  "secretName": "regcred-ghcr",