-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #19 from rackerlabs/openstack-secrets
feat: load secrets for OpenStack Helm via a values file
- Loading branch information
Showing
7 changed files
with
137 additions
and
77 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| # The purpose of this file is to serve as a template for OpenStack Helm | ||
| # based secrets values that are necessary for OpenStack Helm to populate | ||
| # it's configmap-etc, which is really a secret with connection strings | ||
| --- | ||
|
|
||
| endpoints: | ||
|
|
||
| # 'identity' endpoints are for keystone access | ||
| identity: | ||
| auth: | ||
| # this is the 'admin' user created in keystone by the initial start | ||
| # and used by the other services to create their service accounts | ||
| # and endpoint in the service catalog. | ||
| admin: | ||
| password: "${KEYSTONE_ADMIN_PASSWORD}" | ||
| # this user is the service account that ironic uses | ||
| ironic: | ||
| password: "${IRONIC_KEYSTONE_PASSWORD}" | ||
|
|
||
| # 'oslo_db' is for MariaDB | ||
| oslo_db: | ||
| auth: | ||
| # this is what the keystone service uses to connect to MariaDB | ||
| keystone: | ||
| password: "${KEYSTONE_DB_PASSWORD}" | ||
| # this is what the ironic service uses to connect to MariaDB | ||
| ironic: | ||
| password: "${IRONIC_DB_PASSWORD}" | ||
|
|
||
| # 'oslo_messaging' is for RabbitMQ | ||
| oslo_messaging: | ||
| auth: | ||
| # this is what the keystone service uses to connect to RabbitMQ | ||
| keystone: | ||
| password: "${KEYSTONE_RABBITMQ_PASSWORD}" | ||
| # this is what the ironic service uses to connect to RabbitMQ | ||
| ironic: | ||
| password: "${IRONIC_RABBITMQ_PASSWORD}" | ||
| ... |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| #!/bin/sh | ||
|
|
||
| if [ $# -ne 1 ]; then | ||
| echo "$(basename "$0") <output-file>" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| set -o pipefail | ||
|
|
||
| if ! type -p yq > /dev/null; then | ||
| echo "You must have yq installed to use this script" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! type -p kubectl > /dev/null; then | ||
| echo "You must have kubectl installed to use this script" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| KUSTOMIZE_VERSION=$(kubectl version --client -o yaml | yq .kustomizeVersion) | ||
| if ! (echo -e "v5.0.0\n$KUSTOMIZE_VERSION" | sort -V -C); then | ||
| echo "kustomize needs to be at version 5.0.0 or newer (comes with kubectl 1.27+)" | ||
| exit 1 | ||
| fi | ||
|
|
||
| SCRIPTS_DIR="$(dirname "$0")" | ||
|
|
||
| echo "This script will attempt to look up the existing values this repo used" | ||
| echo "or will generate new values. The output below will be related to that." | ||
|
|
||
| # keystone admin | ||
| export KEYSTONE_ADMIN_PASSWORD=$(kubectl -n openstack get secret keystone-admin -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
| # keystone mariadb | ||
| export KEYSTONE_DB_PASSWORD=$(kubectl -n openstack get secret keystone-db-password -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
| # keystone rabbitmq | ||
| export KEYSTONE_RABBITMQ_PASSWORD=$(kubectl -n openstack get secret keystone-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
|
|
||
| # ironic keystone service account | ||
| export IRONIC_KEYSTONE_PASSWORD=$(kubectl -n openstack get secret ironic-keystone-password -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
| # ironic mariadb | ||
| export IRONIC_DB_PASSWORD=$(kubectl -n openstack get secret ironic-db-password -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
| # ironic rabbitmq | ||
| export IRONIC_RABBITMQ_PASSWORD=$(kubectl -n openstack get secret ironic-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d || "${SCRIPTS_DIR}/pwgen.sh") | ||
|
|
||
| yq '(.. | select(tag == "!!str")) |= envsubst' \ | ||
| "${SCRIPTS_DIR}/../components/openstack-secrets.tpl.yaml" \ | ||
| > "$1" |