Skip to content

Commit 0522e61

Browse files
iromlimo-automoabu
authored
feat(jans-pycloudlib): add AWS Secrets Manager support for configuration layers (#3112)
* feat(jans-pycloudlib): add AWS Secrets Manager support for configuration layers Ref: #3026 * chore(jans-pycloudlib): updated build (#3113) Signed-off-by: mo-auto <54212639+mo-auto@users.noreply.github.com> Signed-off-by: mo-auto <54212639+mo-auto@users.noreply.github.com> * feat: add aws secret setup to helm chart * ci: add update of pycloud exception Signed-off-by: mo-auto <54212639+mo-auto@users.noreply.github.com> Co-authored-by: mo-auto <54212639+mo-auto@users.noreply.github.com> Co-authored-by: moabu <47318409+moabu@users.noreply.github.com>
1 parent d4c63d7 commit 0522e61

File tree

39 files changed

+914
-33
lines changed

39 files changed

+914
-33
lines changed

‎.github/workflows/pr-ref-issue.yml

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
- "release-please-**"
1616
- "dependabot/**"
1717
- "snyk-**"
18+
- "update-pycloud-in-**"
1819
workflow_dispatch:
1920
jobs:
2021
check-prs-issue:

‎charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,17 @@ spec:
4141
{{- include "auth-server-key-rotation.usr-secret-envs" . | indent 16 }}
4242
imagePullPolicy: {{ .Values.image.pullPolicy }}
4343
volumeMounts:
44+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
45+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
46+
name: aws-shared-credential-file
47+
subPath: aws_shared_credential_file
48+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
49+
name: aws-config-file
50+
subPath: aws_config_file
51+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
52+
name: aws-secrets-replica-regions
53+
subPath: aws_secrets_replica_regions
54+
{{- end }}
4455
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
4556
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
4657
name: google-sa
@@ -80,6 +91,26 @@ spec:
8091
{{- with .Values.volumes }}
8192
{{- toYaml . | nindent 12 }}
8293
{{- end }}
94+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
95+
- name: aws-shared-credential-file
96+
secret:
97+
secretName: {{ .Release.Name }}-aws-config-creds
98+
items:
99+
- key: aws_shared_credential_file
100+
path: aws_shared_credential_file
101+
- name: aws-config-file
102+
secret:
103+
secretName: {{ .Release.Name }}-aws-config-creds
104+
items:
105+
- key: aws_config_file
106+
path: aws_config_file
107+
- name: aws-secrets-replica-regions
108+
secret:
109+
secretName: {{ .Release.Name }}-aws-config-creds
110+
items:
111+
- key: aws_secrets_replica_regions
112+
path: aws_secrets_replica_regions
113+
{{- end }}
83114
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
84115
- name: google-sa
85116
secret:

‎charts/janssen/charts/auth-server/templates/deployment.yml

+31
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,17 @@ spec:
8181
{{- with .Values.volumeMounts }}
8282
{{- toYaml . | nindent 10 }}
8383
{{- end }}
84+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
85+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
86+
name: aws-shared-credential-file
87+
subPath: aws_shared_credential_file
88+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
89+
name: aws-config-file
90+
subPath: aws_config_file
91+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
92+
name: aws-secrets-replica-regions
93+
subPath: aws_secrets_replica_regions
94+
{{- end }}
8495
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
8596
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
8697
name: google-sa
@@ -121,6 +132,26 @@ spec:
121132
{{- with .Values.volumes }}
122133
{{- toYaml . | nindent 8 }}
123134
{{- end }}
135+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
136+
- name: aws-shared-credential-file
137+
secret:
138+
secretName: {{ .Release.Name }}-aws-config-creds
139+
items:
140+
- key: aws_shared_credential_file
141+
path: aws_shared_credential_file
142+
- name: aws-config-file
143+
secret:
144+
secretName: {{ .Release.Name }}-aws-config-creds
145+
items:
146+
- key: aws_config_file
147+
path: aws_config_file
148+
- name: aws-secrets-replica-regions
149+
secret:
150+
secretName: {{ .Release.Name }}-aws-config-creds
151+
items:
152+
- key: aws_secrets_replica_regions
153+
path: aws_secrets_replica_regions
154+
{{- end }}
124155
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
125156
- name: google-sa
126157
secret:

‎charts/janssen/charts/config-api/templates/deployment.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,17 @@ spec:
7777
{{- with .Values.volumeMounts }}
7878
{{- toYaml . | nindent 12 }}
7979
{{- end }}
80+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
81+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
82+
name: aws-shared-credential-file
83+
subPath: aws_shared_credential_file
84+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
85+
name: aws-config-file
86+
subPath: aws_config_file
87+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
88+
name: aws-secrets-replica-regions
89+
subPath: aws_secrets_replica_regions
90+
{{- end }}
8091
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
8192
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
8293
name: google-sa
@@ -106,6 +117,26 @@ spec:
106117
{{- with .Values.volumes }}
107118
{{- toYaml . | nindent 8 }}
108119
{{- end }}
120+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
121+
- name: aws-shared-credential-file
122+
secret:
123+
secretName: {{ .Release.Name }}-aws-config-creds
124+
items:
125+
- key: aws_shared_credential_file
126+
path: aws_shared_credential_file
127+
- name: aws-config-file
128+
secret:
129+
secretName: {{ .Release.Name }}-aws-config-creds
130+
items:
131+
- key: aws_config_file
132+
path: aws_config_file
133+
- name: aws-secrets-replica-regions
134+
secret:
135+
secretName: {{ .Release.Name }}-aws-config-creds
136+
items:
137+
- key: aws_secrets_replica_regions
138+
path: aws_secrets_replica_regions
139+
{{- end }}
109140
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
110141
- name: google-sa
111142
secret:

‎charts/janssen/charts/config/templates/load-init-config.yml

+31
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,26 @@ spec:
3434
volumes:
3535
{{- with .Values.volumes }}
3636
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
39+
- name: aws-shared-credential-file
40+
secret:
41+
secretName: {{ .Release.Name }}-aws-config-creds
42+
items:
43+
- key: aws_shared_credential_file
44+
path: aws_shared_credential_file
45+
- name: aws-config-file
46+
secret:
47+
secretName: {{ .Release.Name }}-aws-config-creds
48+
items:
49+
- key: aws_config_file
50+
path: aws_config_file
51+
- name: aws-secrets-replica-regions
52+
secret:
53+
secretName: {{ .Release.Name }}-aws-config-creds
54+
items:
55+
- key: aws_secrets_replica_regions
56+
path: aws_secrets_replica_regions
3757
{{- end }}
3858
- name: {{ include "config.fullname" . }}-mount-gen-file
3959
secret:
@@ -59,6 +79,17 @@ spec:
5979
{{- with .Values.volumeMounts }}
6080
{{- toYaml . | nindent 10 }}
6181
{{- end }}
82+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
83+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
84+
name: aws-shared-credential-file
85+
subPath: aws_shared_credential_file
86+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
87+
name: aws-config-file
88+
subPath: aws_config_file
89+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
90+
name: aws-secrets-replica-regions
91+
subPath: aws_secrets_replica_regions
92+
{{- end }}
6293
- mountPath: /app/db/generate.json
6394
name: {{ include "config.fullname" . }}-mount-gen-file
6495
subPath: generate.json

‎charts/janssen/charts/config/templates/secrets.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,33 @@ data:
5959
couchbase.crt: {{ .Values.configmap.cnCouchbaseCrt }}
6060
{{- end }}
6161
{{- end }}
62+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
63+
---
64+
apiVersion: v1
65+
kind: Secret
66+
metadata:
67+
name: {{ .Release.Name }}-aws-config-creds
68+
labels:
69+
{{ include "config.labels" . | indent 4 }}
70+
{{- if .Values.additionalLabels }}
71+
{{ toYaml .Values.additionalLabels | indent 4 }}
72+
{{- end }}
73+
{{- if .Values.additionalAnnotations }}
74+
annotations:
75+
{{ toYaml .Values.additionalAnnotations | indent 4 }}
76+
{{- end }}
77+
type: Opaque
78+
stringData:
79+
aws_shared_credential_file: |-
80+
[{{ .Values.configmap.cnAwsProfile | quote }}]
81+
aws_access_key_id = {{ .Values.configmap.cnAwsAccessKeyId }}
82+
aws_secret_access_key = {{ .Values.configmap.cnAwsSecretAccessKey }}
83+
aws_config_file: |-
84+
[{{ .Values.configmap.cnAwsProfile | quote }}]
85+
region = {{ .Values.configmap.cnAwsDefaultRegion | quote }}
86+
aws_secrets_replica_regions: |-
87+
{{ .Values.configmap.cnAwsSecretsReplicaRegions | toJson }}
88+
{{- end }}
6289
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
6390
---
6491
apiVersion: v1

‎charts/janssen/charts/fido2/templates/deployment.yml

+31
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,17 @@ spec:
8181
{{- with .Values.volumeMounts }}
8282
{{- toYaml . | nindent 10 }}
8383
{{- end }}
84+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
85+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
86+
name: aws-shared-credential-file
87+
subPath: aws_shared_credential_file
88+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
89+
name: aws-config-file
90+
subPath: aws_config_file
91+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
92+
name: aws-secrets-replica-regions
93+
subPath: aws_secrets_replica_regions
94+
{{- end }}
8495
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
8596
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
8697
name: google-sa
@@ -121,6 +132,26 @@ spec:
121132
{{- with .Values.volumes }}
122133
{{- toYaml . | nindent 8 }}
123134
{{- end }}
135+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
136+
- name: aws-shared-credential-file
137+
secret:
138+
secretName: {{ .Release.Name }}-aws-config-creds
139+
items:
140+
- key: aws_shared_credential_file
141+
path: aws_shared_credential_file
142+
- name: aws-config-file
143+
secret:
144+
secretName: {{ .Release.Name }}-aws-config-creds
145+
items:
146+
- key: aws_config_file
147+
path: aws_config_file
148+
- name: aws-secrets-replica-regions
149+
secret:
150+
secretName: {{ .Release.Name }}-aws-config-creds
151+
items:
152+
- key: aws_secrets_replica_regions
153+
path: aws_secrets_replica_regions
154+
{{- end }}
124155
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
125156
- name: google-sa
126157
secret:

‎charts/janssen/charts/persistence/templates/jobs.yml

+31
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,17 @@ spec:
6767
{{- with .Values.volumeMounts }}
6868
{{- toYaml . | nindent 10 }}
6969
{{- end }}
70+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
71+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
72+
name: aws-shared-credential-file
73+
subPath: aws_shared_credential_file
74+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
75+
name: aws-config-file
76+
subPath: aws_config_file
77+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
78+
name: aws-secrets-replica-regions
79+
subPath: aws_secrets_replica_regions
80+
{{- end }}
7081
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
7182
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
7283
name: google-sa
@@ -83,6 +94,26 @@ spec:
8394
{{- with .Values.volumes }}
8495
{{- toYaml . | nindent 8 }}
8596
{{- end }}
97+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
98+
- name: aws-shared-credential-file
99+
secret:
100+
secretName: {{ .Release.Name }}-aws-config-creds
101+
items:
102+
- key: aws_shared_credential_file
103+
path: aws_shared_credential_file
104+
- name: aws-config-file
105+
secret:
106+
secretName: {{ .Release.Name }}-aws-config-creds
107+
items:
108+
- key: aws_config_file
109+
path: aws_config_file
110+
- name: aws-secrets-replica-regions
111+
secret:
112+
secretName: {{ .Release.Name }}-aws-config-creds
113+
items:
114+
- key: aws_secrets_replica_regions
115+
path: aws_secrets_replica_regions
116+
{{- end }}
86117
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
87118
- name: google-sa
88119
secret:

‎charts/janssen/charts/scim/templates/deployment.yml

+31
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,17 @@ spec:
8989
{{- with .Values.volumeMounts }}
9090
{{- toYaml . | nindent 10 }}
9191
{{- end }}
92+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
93+
- mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }}
94+
name: aws-shared-credential-file
95+
subPath: aws_shared_credential_file
96+
- mountPath: {{ .Values.global.cnAwsConfigFile }}
97+
name: aws-config-file
98+
subPath: aws_config_file
99+
- mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }}
100+
name: aws-secrets-replica-regions
101+
subPath: aws_secrets_replica_regions
102+
{{- end }}
92103
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
93104
- mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
94105
name: google-sa
@@ -119,6 +130,26 @@ spec:
119130
{{- with .Values.volumes }}
120131
{{- toYaml . | nindent 8 }}
121132
{{- end }}
133+
{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }}
134+
- name: aws-shared-credential-file
135+
secret:
136+
secretName: {{ .Release.Name }}-aws-config-creds
137+
items:
138+
- key: aws_shared_credential_file
139+
path: aws_shared_credential_file
140+
- name: aws-config-file
141+
secret:
142+
secretName: {{ .Release.Name }}-aws-config-creds
143+
items:
144+
- key: aws_config_file
145+
path: aws_config_file
146+
- name: aws-secrets-replica-regions
147+
secret:
148+
secretName: {{ .Release.Name }}-aws-config-creds
149+
items:
150+
- key: aws_secrets_replica_regions
151+
path: aws_secrets_replica_regions
152+
{{- end }}
122153
{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
123154
- name: google-sa
124155
secret:

‎charts/janssen/values.schema.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -458,14 +458,14 @@
458458
}
459459
},
460460
"configAdapterName": {
461-
"description": "The config backend adapter that will hold Janssen configuration layer. google|kubernetes",
461+
"description": "The config backend adapter that will hold Janssen configuration layer. aws|google|kubernetes",
462462
"type": "string",
463-
"pattern": "^(kubernetes|google)$"
463+
"pattern": "^(kubernetes|google|aws)$"
464464
},
465465
"configSecretAdapter": {
466-
"description": "The config backend adapter that will hold Janssen secret layer. google|kubernetes",
466+
"description": "The config backend adapter that will hold Janssen secret layer. aws|google|kubernetes",
467467
"type": "string",
468-
"pattern": "^(kubernetes|google)$"
468+
"pattern": "^(kubernetes|google|aws)$"
469469
},
470470
"cnGoogleApplicationCredentials": {
471471
"description": "Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner.",

0 commit comments

Comments
 (0)