Skip to content

Commit 63078f9

Browse files
buraksekilikomalsukhani
buraksekili
and
komalsukhani
authored
[TT-9735] Allow confidential fields to be set via k8s secrets (#103)
* Add an option to specify remoteControlPlane configurations via k8s secret Signed-off-by: Burak Sekili <[email protected]> * remove duplicated comment Signed-off-by: Burak Sekili <[email protected]> * Add an option to specify enterprise portal configurations via k8s secret Signed-off-by: Burak Sekili <[email protected]> * Add an option to specify admin user configurations via k8s secret Signed-off-by: Burak Sekili <[email protected]> * Move the secret fields for admin user credentials to the new section Signed-off-by: Burak Sekili <[email protected]> * Add a documentation about secret usage in oss Signed-off-by: Burak Sekili <[email protected]> * Add a documentation about secret usage in mdcb-data-plane Signed-off-by: Burak Sekili <[email protected]> * Add a documentation about secret usage in single-dc Signed-off-by: Burak Sekili <[email protected]> * Add adminUser info Signed-off-by: Burak Sekili <[email protected]> * Refactor namings Signed-off-by: Burak Sekili <[email protected]> * Update tyk-oss/README.md Co-authored-by: Komal Sukhani <[email protected]> * Create dashboard secret if adminUser.useSecret is not in use Signed-off-by: Burak Sekili <[email protected]> * Update statefulset-enterprise-portal.yaml * Fix pre-hook * Set latest enterprise portal tag in component chart --------- Signed-off-by: Burak Sekili <[email protected]> Co-authored-by: Komal Sukhani <[email protected]>
1 parent 46e1f01 commit 63078f9

File tree

17 files changed

+435
-38
lines changed

17 files changed

+435
-38
lines changed

‎components/tyk-bootstrap/templates/bootstrap-post-install.yaml

+33-3
Original file line numberDiff line numberDiff line change
@@ -29,23 +29,44 @@ spec:
2929
serviceAccountName: k8s-bootstrap-role
3030
containers:
3131
- name: bootstrap-tyk-post-install
32-
image: tykio/tyk-k8s-bootstrap-post:latest
32+
image: tykio/tyk-k8s-bootstrap-post:v1.5.0
3333
command: [ './app/bin/bootstrap-app-post' ]
3434
imagePullPolicy: IfNotPresent
3535
env:
3636
- name: TYK_DB_OMITCONFIGFILE
3737
value: "true"
3838
- name: TYK_ADMIN_FIRST_NAME
39+
{{ if .Values.global.adminUser.useSecretName }}
40+
valueFrom:
41+
secretKeyRef:
42+
name: {{ .Values.global.adminUser.useSecretName }}
43+
key: adminUserFirstName
44+
{{ else }}
3945
value: {{ .Values.global.adminUser.firstName | quote }}
46+
{{ end }}
4047
- name: TYK_ADMIN_LAST_NAME
48+
{{ if .Values.global.adminUser.useSecretName }}
49+
valueFrom:
50+
secretKeyRef:
51+
name: {{ .Values.global.adminUser.useSecretName }}
52+
key: adminUserLastName
53+
{{ else }}
4154
value: {{ .Values.global.adminUser.lastName | quote }}
55+
{{ end }}
4256
- name: TYK_ADMIN_EMAIL
57+
{{ if .Values.global.adminUser.useSecretName }}
58+
valueFrom:
59+
secretKeyRef:
60+
name: {{ .Values.global.adminUser.useSecretName }}
61+
key: adminUserEmail
62+
{{ else }}
4363
value: {{ .Values.global.adminUser.email | quote }}
64+
{{ end }}
4465
- name: TYK_ADMIN_PASSWORD
4566
valueFrom:
4667
secretKeyRef:
47-
name: tyk-dashboard-login-details
48-
key: TYK_PASS
68+
name: {{ if .Values.global.adminUser.useSecretName }} {{ .Values.global.adminUser.useSecretName }} {{ else }} tyk-dashboard-login-details {{ end }}
69+
key: adminUserPassword
4970
- name: TYK_POD_NAMESPACE
5071
valueFrom:
5172
fieldRef:
@@ -62,6 +83,15 @@ spec:
6283
{{- end }}
6384
- name: TYK_DB_LISTENPORT
6485
value: "{{ .Values.global.servicePorts.dashboard }}"
86+
- name: TYK_DB_LICENSEKEY
87+
{{ if .Values.global.secrets.useSecretName }}
88+
valueFrom:
89+
secretKeyRef:
90+
key: DashLicense
91+
name: {{ .Values.global.secrets.useSecretName }}
92+
{{ else }}
93+
value: {{ .Values.global.license.dashboard | quote }}
94+
{{ end }}
6595
- name: TYK_ADMIN_SECRET
6696
{{- if not .Values.global.secrets.useSecretName }}
6797
value: {{ .Values.global.secrets.AdminSecret | quote }}

‎components/tyk-bootstrap/templates/bootstrap-pre-install.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,14 @@ spec:
3333
imagePullPolicy: IfNotPresent
3434
env:
3535
- name: TYK_DB_LICENSEKEY
36+
{{ if .Values.global.secrets.useSecretName }}
37+
valueFrom:
38+
secretKeyRef:
39+
key: DashLicense
40+
name: {{ .Values.global.secrets.useSecretName }}
41+
{{ else }}
3642
value: {{ .Values.global.license.dashboard | quote }}
43+
{{ end }}
3744
restartPolicy: Never
3845
terminationGracePeriodSeconds: 0
3946
{{- end }}

‎components/tyk-bootstrap/values.yaml

+8-4
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@ global:
66
# The license key needed for the Tyk Dashboard.
77
dashboard: ""
88
adminUser:
9+
# If you don't want to store plaintext secrets for admin user in the Helm value file and would
10+
# rather provide the k8s Secret externally please populate the value below
11+
# You can set following fields in the secret
12+
# adminUserFirstName - sets .global.adminUser.firstName
13+
# adminUserLastName - sets .global.adminUser.lastName
14+
# adminUserEmail - sets .global.adminUser.email
15+
useSecretName: ""
16+
917
firstName: admin
1018
lastName: user
1119
email: [email protected]
12-
# Set a password or a random one will be assigned. Admin user password must have at least 6 characters.
13-
password: "123456"
1420

1521
bootstrap:
1622
enterprisePortal: true
@@ -81,8 +87,6 @@ bootstrap:
8187
# Trigger to control if we want to create the tyk-operator secret
8288
operatorSecret: true
8389

84-
85-
8690
fullnameOverride: ""
8791
nameOverride: ""
8892

‎components/tyk-dashboard/templates/secret-dashboard.yaml

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{ if not .Values.global.adminUser.useSecretName }}
12
apiVersion: v1
23
kind: Secret
34
metadata:
@@ -10,7 +11,8 @@ metadata:
1011
type: Opaque
1112
data:
1213
{{ if .Values.global.adminUser.password }}
13-
TYK_PASS: {{ .Values.global.adminUser.password | b64enc | quote }}
14+
adminUserPassword: {{ .Values.global.adminUser.password | b64enc | quote }}
1415
{{ else }}
15-
TYK_PASS: {{ randAlphaNum 10 | b64enc | quote }}
16-
{{ end }}
16+
adminUserPassword: {{ randAlphaNum 10 | b64enc | quote }}
17+
{{ end }}
18+
{{ end }}

‎components/tyk-dashboard/values.yaml

+15-1
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,23 @@ fullnameOverride: ""
66

77
global:
88
license:
9-
# The license key needed by Tyk Dashboard to work
9+
# The license key needed by Tyk Dashboard to work.
10+
#
11+
# NOTE: If you do not want to store license as a plain text in the file, you can use a Kubernetes secret
12+
# that stores the dashboard license. Please see `.global.secrets.useSecretName`.
1013
dashboard: ""
14+
1115
# Dashboard admin information.
1216
adminUser:
17+
# If you don't want to store plaintext secrets for admin user in the Helm value file and would
18+
# rather provide the k8s Secret externally please populate the value below
19+
# You can set following fields in the secret
20+
# adminUserFirstName - sets .global.adminUser.firstName
21+
# adminUserLastName - sets .global.adminUser.lastName
22+
# adminUserEmail - sets .global.adminUser.email
23+
# adminUserPassword - sets .global.adminUser.password
24+
useSecretName: ""
25+
1326
# First name of the admin user
1427
firstName: admin
1528
# Last name of the admin user
@@ -18,6 +31,7 @@ global:
1831
email: [email protected]
1932
# Set a password or a random one will be assigned.
2033
password: "123456"
34+
2135
servicePorts:
2236
# The port at which the dashboard service can be found
2337
dashboard: 3000

‎components/tyk-enterprise-portal/templates/secret.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ metadata:
1111
type: Opaque
1212
stringData:
1313
EnterprisePortalLicense: "{{ .Values.license }}"
14-
EnterprisePortalAdminPassword: "{{ .Values.global.adminUser.password }}"
14+
adminUserPassword: "{{ .Values.global.adminUser.password }}"
1515
EnterprisePortalStorageConnectionString: "{{ .Values.storage.database.connectionString }}"
1616
EnterprisePortalAwsAccessKeyId: "{{ .Values.storage.s3.awsAccessKeyid }}"
1717
EnterprisePortalAwsSecretAccessKey: "{{ .Values.storage.s3.awsSecretAccessKey }}"

‎components/tyk-enterprise-portal/templates/statefulset-enterprise-portal.yaml

+11-12
Original file line numberDiff line numberDiff line change
@@ -66,16 +66,23 @@ spec:
6666
- name: PORTAL_HOST_PORT
6767
value: "{{ .Values.containerPort }}"
6868
- name: ADMIN_EMAIL
69+
{{ if .Values.global.adminUser.useSecretName }}
70+
valueFrom:
71+
secretKeyRef:
72+
key: adminUserEmail
73+
name: {{ .Values.global.adminUser.useSecretName }}
74+
{{ else }}
6975
value: "{{ .Values.global.adminUser.email }}"
76+
{{ end }}
7077
- name: ADMIN_PASSWORD
7178
valueFrom:
7279
secretKeyRef:
73-
{{ if .Values.global.secrets.useSecretName }}
74-
name: {{ .Values.global.secrets.useSecretName }}
80+
{{ if .Values.global.adminUser.useSecretName }}
81+
name: {{ .Values.global.adminUser.useSecretName }}
7582
{{ else }}
7683
name: secrets-{{ include "tyk-enterprise-portal.fullname" . }}
7784
{{ end }}
78-
key: EnterprisePortalAdminPassword
85+
key: adminUserPassword
7986
- name: PORTAL_STORAGE
8087
value: "{{ .Values.storage.type }}"
8188
- name: PORTAL_DATABASE_DIALECT
@@ -145,20 +152,12 @@ spec:
145152
- name: TYK_AUTH
146153
valueFrom:
147154
secretKeyRef:
148-
{{ if .Values.global.secrets.useSecretName }}
149-
name: {{ .Values.global.secrets.useSecretName }}
150-
{{ else }}
151155
name: {{ .Values.global.secrets.enterprisePortal}}
152-
{{ end }}
153156
key: TYK_AUTH
154157
- name: TYK_ORG
155158
valueFrom:
156159
secretKeyRef:
157-
{{ if .Values.global.secrets.useSecretName }}
158-
name: {{ .Values.global.secrets.useSecretName }}
159-
{{ else }}
160160
name: {{ .Values.global.secrets.enterprisePortal}}
161-
{{ end }}
162161
key: TYK_ORG
163162
{{- if .Values.extraEnvs }}
164163
{{- range $env := .Values.extraEnvs }}
@@ -271,4 +270,4 @@ spec:
271270
{{ $key }}: {{ $value | quote }}
272271
{{- end }}
273272
{{- end }}
274-
{{- end }}
273+
{{- end }}

‎components/tyk-enterprise-portal/values.yaml

+32-5
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,16 @@
88

99
global:
1010
adminUser:
11+
# If you don't want to store plaintext secrets for admin user in the Helm value file and would
12+
# rather provide the k8s Secret externally please populate the value below
13+
# You can set following fields in the secret:
14+
# - adminUserEmail sets .global.adminUser.email
15+
# - adminUserPassword sets .global.adminUser.password
16+
useSecretName: ""
17+
18+
# email of Enterprise Portal admin
1119
email: [email protected]
20+
# password of Enterprise Portal admin
1221
password: 123456
1322
tls:
1423
dashboard: false
@@ -17,20 +26,29 @@ global:
1726
dashboard: 3000
1827
bootstrap:
1928
enterprisePortal: false
29+
2030
secrets:
31+
# enterprisePortal secret stands for secret including Tyk Dashboard credentials.
32+
# It should include the followings:
33+
# - TYK_ORG: Tyk Dashboard Organisation ID
34+
# - TYK_AUTH: Tyk Dashboard API Access Credentials
2135
enterprisePortal: tyk-enterprise-portal-conf
2236

23-
# If you don't want to store plaintext secrets in the Helm value file and would
24-
# rather provide the k8s Secret externally please populate the value below
37+
# useSecretName can be used if you don't want to store plaintext values for Enterprise Portal license in
38+
# the Helm value file and would rather provide the k8s Secret externally.
39+
# You should set following fields in the secret
40+
# - EnterprisePortalLicense - Sets LicenseKey for Enterprise Portal
41+
# - EnterprisePortalStorageConnectionString - Sets Database.ConnectionString for Enterprise Portal
2542
useSecretName: ""
2643

2744
# The hostname to bind the Enterprise Portal to.
2845
hostName: tyk-enterprise-portal.local
46+
2947
# Enterprise Portal license.
3048
license: ""
3149

32-
#In case you want to deploy enterprise portal as a standalone app, you can configure a different dashboard URL using
33-
#the parameter bellow
50+
# In case you want to deploy enterprise portal as a standalone app, you can configure a different dashboard URL using
51+
# the parameter bellow.
3452
overrideTykDashUrl: ""
3553
# Enterprise portal can be deployed as StatefulSet or as Deployment
3654
kind: StatefulSet
@@ -73,22 +91,27 @@ storage:
7391
annotations: {}
7492
labels: {}
7593
selector: {}
94+
7695
replicaCount: 1
7796
containerPort: 3001
97+
7898
image:
7999
repository: tykio/portal
80100
# Enterprise portal < v1.2 is not supported
81-
tag: v1.5.0
101+
tag: v1.6.0
82102
pullPolicy: Always
103+
83104
# image pull secrets to use when pulling images from repository
84105
imagePullSecrets: []
106+
85107
service:
86108
type: NodePort
87109
port: 3001
88110
externalTrafficPolicy: Local
89111
annotations: {}
90112
# Creates an ingress object in k8s. Will require an ingress-controller and
91113
# annotation to that ingress controller.
114+
92115
ingress:
93116
enabled: false
94117
# specify your ingress controller class name below
@@ -105,6 +128,7 @@ ingress:
105128
# - secretName: chart-example-tls
106129
# hosts:
107130
# - chart-example.local
131+
108132
resources: {}
109133
# We usually recommend not to specify default resources and to leave this
110134
# as a conscious choice for the user. This also increases chances charts
@@ -117,6 +141,7 @@ resources: {}
117141
# requests:
118142
# cpu: 100m
119143
# memory: 128Mi
144+
120145
securityContext:
121146
runAsUser: 1000
122147
fsGroup: 2000
@@ -132,13 +157,15 @@ nodeSelector: {}
132157
tolerations: []
133158
affinity: {}
134159
extraEnvs: []
160+
135161
## extraVolumes A list of volumes to be added to the pod
136162
## extraVolumes:
137163
## - name: ca-certs
138164
## secret:
139165
## defaultMode: 420
140166
## secretName: ca-certs
141167
extraVolumes: []
168+
142169
## extraVolumeMounts A list of volume mounts to be added to the pod
143170
## extraVolumeMounts:
144171
## - name: ca-certs

‎components/tyk-gateway/templates/deployment-gw-repset.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,32 @@ spec:
165165
- name: TYK_GW_AUTHOVERRIDE_AUTHPROVIDER_STORAGEENGINE
166166
value: "rpc"
167167
- name: TYK_GW_SLAVEOPTIONS_RPCKEY
168+
{{ if .Values.global.remoteControlPlane.useSecretName }}
169+
valueFrom:
170+
secretKeyRef:
171+
name: {{ .Values.global.remoteControlPlane.useSecretName }}
172+
key: orgId
173+
{{ else }}
168174
value: "{{ .Values.global.remoteControlPlane.orgId }}"
175+
{{ end }}
169176
- name: TYK_GW_SLAVEOPTIONS_APIKEY
177+
{{ if .Values.global.remoteControlPlane.useSecretName }}
178+
valueFrom:
179+
secretKeyRef:
180+
name: {{ .Values.global.remoteControlPlane.useSecretName }}
181+
key: userApiKey
182+
{{ else }}
170183
value: "{{ .Values.global.remoteControlPlane.userApiKey }}"
184+
{{ end }}
171185
- name: TYK_GW_SLAVEOPTIONS_GROUPID
186+
{{ if .Values.global.remoteControlPlane.useSecretName }}
187+
valueFrom:
188+
secretKeyRef:
189+
name: {{ .Values.global.remoteControlPlane.useSecretName }}
190+
key: groupID
191+
{{ else }}
172192
value: "{{ .Values.global.remoteControlPlane.groupID}}"
193+
{{ end }}
173194
- name: TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING
174195
value: "{{ .Values.global.remoteControlPlane.connectionString }}"
175196
- name: TYK_GW_SLAVEOPTIONS_USESSL

‎components/tyk-gateway/values.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,14 @@ global:
9191
database: 0
9292

9393
remoteControlPlane:
94+
# useSecretName can be used if you don't want to store plaintext values for remote control plane configurations in
95+
# the Helm value file and would rather provide the k8s Secret externally.
96+
# You should set following fields in the secret
97+
# - orgId - Sets slave_options.rpc_key of Tyk Gateway
98+
# - userApiKey - Sets slave_options.api_key of Tyk Gateway
99+
# - groupID - Sets slave_options.group_id of Tyk Gateway
100+
useSecretName: ""
101+
94102
enabled: false
95103
# connection string used to connect to an MDCB deployment. For Tyk Cloud users, you can get it from Tyk Cloud Console and retrieve the MDCB connection string.
96104
connectionString: ""

‎components/tyk-pump/values.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,14 @@ global:
9898
# keyName: ""
9999

100100
remoteControlPlane:
101+
# useSecretName can be used if you don't want to store plaintext values for remote control plane configurations in
102+
# the Helm value file and would rather provide the k8s Secret externally.
103+
# You should set following fields in the secret
104+
# - orgId - Sets slave_options.rpc_key of Tyk Gateway
105+
# - userApiKey - Sets slave_options.api_key of Tyk Gateway
106+
# - groupID - Sets slave_options.group_id of Tyk Gateway
107+
useSecretName: ""
108+
101109
# connection string used to connect to an MDCB deployment. For Tyk Cloud users, you can get it from Tyk Cloud Console and retrieve the MDCB connection string.
102110
connectionString: ""
103111
# orgID of your dashboard user

0 commit comments

Comments
 (0)