From 99f49522a9ad8bebda921bdde3fe75a434e9122c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20M=C3=A9vollon?= Date: Mon, 18 Dec 2023 12:12:46 +0100 Subject: [PATCH 1/8] feat: init Vault POC --- src/pages/index.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/index.tsx b/src/pages/index.tsx index 3c8df563..be6b34a1 100644 --- a/src/pages/index.tsx +++ b/src/pages/index.tsx @@ -25,7 +25,7 @@ const Home: NextPage = () => {

- Template + POC VAULT

Template de la fabrique des ministères sociaux.

 From d0683a9e568be750405ed76ccd97a2ed294ff5da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20M=C3=A9vollon?= Date: Mon, 18 Dec 2023 12:36:06 +0100 Subject: [PATCH 2/8] remove needs --- .kontinuous/values.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml index cd241be2..9179162a 100644 --- a/.kontinuous/values.yaml +++ b/.kontinuous/values.yaml @@ -65,7 +65,6 @@ jobs: build-hasura: use: build - ~needs: [build-app] with: imagePackage: hasura registrySecretRefName: harbor @@ -87,7 +86,9 @@ hasura: - name: HASURA_GRAPHQL_UNAUTHORIZED_ROLE value: anonymous - name: HASURA_GRAPHQL_JWT_SECRET - value: '{"jwk_url": "http://keycloakx-http:8080/realms/app-realm/protocol/openid-connect/certs"}' + value: + '{"jwk_url": + "http://keycloakx-http:8080/realms/app-realm/protocol/openid-connect/certs"}' envFrom: - secretRef: name: pg-hasura-app @@ -137,7 +138,8 @@ keycloakx: statefulsetAnnotations: kapp.k14s.io/nonce: "" kapp.k14s.io/update-strategy: fallback-on-replace - kapp.k14s.io/change-group.keycloakx: "kontinuous/keycloakx.{{ .Values.global.namespace }}" + kapp.k14s.io/change-group.keycloakx: + "kontinuous/keycloakx.{{ .Values.global.namespace }}" kapp.k14s.io/disable-original: "" kapp.k14s.io/create-strategy: fallback-on-update From 65f1aff8784676f7de71a39e3fc61177b80f33f6 Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Mon, 18 Dec 2023 15:17:18 +0100 Subject: [PATCH 3/8] feat: poc vault v0 --- .idea/.gitignore | 5 +++++ .idea/inspectionProfiles/Project_Default.xml | 6 ++++++ .idea/misc.xml | 6 ++++++ .idea/modules.xml | 8 ++++++++ .idea/template.iml | 9 +++++++++ .idea/vcs.xml | 6 ++++++ src/pages/index.tsx | 2 +- 7 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 .idea/.gitignore create mode 100644 .idea/inspectionProfiles/Project_Default.xml create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/template.iml create mode 100644 .idea/vcs.xml diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 00000000..b58b603f --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,5 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml new file mode 100644 index 00000000..03d9549e --- /dev/null +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 00000000..639900d1 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 00000000..f212188f --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/template.iml b/.idea/template.iml new file mode 100644 index 00000000..d6ebd480 --- /dev/null +++ b/.idea/template.iml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 00000000..35eb1ddf --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/src/pages/index.tsx b/src/pages/index.tsx index be6b34a1..e76b8bd8 100644 --- a/src/pages/index.tsx +++ b/src/pages/index.tsx @@ -25,7 +25,7 @@ const Home: NextPage = () => {

- POC VAULT + POC VAULT v0

Template de la fabrique des ministères sociaux.

 From 65e0094f139ed7e3ee3b8e2ff088b79aae664e9a Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Tue, 19 Dec 2023 16:43:43 +0100 Subject: [PATCH 4/8] feat: vault agent injector for nextauth_secret --- .../preprod/templates/app.sealed.secret.yaml | 2 +- .kontinuous/patches/secrets.js | 26 +++++++++++++++++++ .kontinuous/values.yaml | 2 ++ 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 .kontinuous/patches/secrets.js diff --git a/.kontinuous/env/preprod/templates/app.sealed.secret.yaml b/.kontinuous/env/preprod/templates/app.sealed.secret.yaml index 6cb1477a..ca9c3ae5 100644 --- a/.kontinuous/env/preprod/templates/app.sealed.secret.yaml +++ b/.kontinuous/env/preprod/templates/app.sealed.secret.yaml @@ -6,7 +6,7 @@ metadata: name: app spec: encryptedData: - NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q== +# NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q== KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO KEYCLOAK_CLIENT_SECRET: AgAiI7KGxjFjhjSY3hYrlQ30oQ7eNE2jkaEcO3gOAQhlWMFvSu1b51rhl3htkPO5YTkAsfbC7EIZkdSTEjjF6eFUKua5Z51jbKf8wmmW3VfWky26yzzyazUJ7Sv/rAPwr4ialLUivvoYLrJECE49GasHm9mosBEuvuqpFYYmiJlSOrG9kM8RdybaZmGLiUZBUIRN1bIrC9ix7kdndaCQ8ysRVH76xQ2wpXYJU4rVn2bOJgbvR4T4q/pe6TeT/H7yUZ9ritgVPH9tFCuGK0xZ3CXFnUFwQsdsB9c0aB2jwoi2YmsK0XRasRAmu7PxsqD34xGkwtopVTvLsuKhCcN/V1x81gB/8+pW1Ox6yhQKH06GNsIruamhVxeIOXP7vt0/B93+cnZQUuFL7xt7rxnZEKq/1Ja0av/2UkxAUNYNc+kdRvLJbm8TVkWUuoWbMLUrsg3S6fItRHMG1M1t9MvdeihVlTyBThadnIfKSS3RiBKi/7Maozpa2g/ATsYX15qbDeONMgRZmo6itKGtmm6RBJpluSsGmPjBBO30oSdIV8gNEzdQuboSB86XjrDgQbGPj4Mn2aeQSEoNlxS0pjXB8/jOzp68YIh7by0LVrTA8su60oNrQCA5SVXTrO/PQJpXsC998iuohL1CvWIbxkP+GxXptwoRbrNy4lYPtxYGSCFH/rdEgPElLlHy4EMpfnVr+1NWvTWsusg6fgJXtcovXz+2aYQ42yhYVg5dS26xeX6cAg== template: diff --git a/.kontinuous/patches/secrets.js b/.kontinuous/patches/secrets.js new file mode 100644 index 00000000..824ad368 --- /dev/null +++ b/.kontinuous/patches/secrets.js @@ -0,0 +1,26 @@ +/* +Patch manifests +*/ +module.exports = (manifests) => { + for (const manifest of manifests) { + const { kind } = manifest; + if (kind === "Deployment" && manifest.metadata.name === "app") { + manifest.spec.template.metadata.annotations = { + ...manifest.spec.template.metadata.annotations, + "vault.hashicorp.com/service": "http://vault.vault-dev.svc:8200", + "vault.hashicorp.com/agent-inject": "true", + "vault.hashicorp.com/role": "webapp", + "vault.hashicorp.com/agent-inject-secret-nextauth": 'kv/data/dev/nextauth_secret', + "vault.hashicorp.com/agent-inject-secret-keycloack_client_id": 'kv/data/dev/keycloack_client_id', + "vault.hashicorp.com/agent-inject-secret-keycloack_client_secret": 'kv/data/dev/keycloack_client_secret', + "vault.hashicorp.com/agent-inject-template-dev": '| \ + {{- with secret "kv/dev/nextauth_secret" -}} \ + {{- range $key, $value := .Data.data }} \ + export {{ $key }}={{ $value }} \ + {{- end }} \ + {{- end }}' + }; + } + } + return manifests; +}; \ No newline at end of file diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml index 9179162a..70dce64f 100644 --- a/.kontinuous/values.yaml +++ b/.kontinuous/values.yaml @@ -49,6 +49,8 @@ app: ingress: annotations: nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" +# args: +# ['sh', '-c', 'source /vault/secrets/dev && node start'] jobs: runs: From fd77add087934e52d240464356fbeeb6b6f308cc Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Tue, 19 Dec 2023 17:47:43 +0100 Subject: [PATCH 5/8] feat: add service account for vault --- .kontinuous/env/dev/templates/app.vault.serviceaccount.yaml | 4 ++++ .kontinuous/values.yaml | 1 + 2 files changed, 5 insertions(+) create mode 100644 .kontinuous/env/dev/templates/app.vault.serviceaccount.yaml diff --git a/.kontinuous/env/dev/templates/app.vault.serviceaccount.yaml b/.kontinuous/env/dev/templates/app.vault.serviceaccount.yaml new file mode 100644 index 00000000..fc2bc660 --- /dev/null +++ b/.kontinuous/env/dev/templates/app.vault.serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault \ No newline at end of file diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml index 70dce64f..050f41f5 100644 --- a/.kontinuous/values.yaml +++ b/.kontinuous/values.yaml @@ -37,6 +37,7 @@ app: imagePackage: app containerPort: 3000 probesPath: "/healthz" + serviceAccountName: vault securityContext: fsGroup: 1001 runAsGroup: 1000 From 60e9e0f18e88ca1f1ad6356dbda19ae4ffd365b5 Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Wed, 20 Dec 2023 14:37:35 +0100 Subject: [PATCH 6/8] feat: add SA in patch --- .kontinuous/patches/secrets.js | 10 +++++++--- .kontinuous/values.yaml | 1 - 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.kontinuous/patches/secrets.js b/.kontinuous/patches/secrets.js index 824ad368..e66534ce 100644 --- a/.kontinuous/patches/secrets.js +++ b/.kontinuous/patches/secrets.js @@ -9,10 +9,10 @@ module.exports = (manifests) => { ...manifest.spec.template.metadata.annotations, "vault.hashicorp.com/service": "http://vault.vault-dev.svc:8200", "vault.hashicorp.com/agent-inject": "true", - "vault.hashicorp.com/role": "webapp", + "vault.hashicorp.com/role": "dev", "vault.hashicorp.com/agent-inject-secret-nextauth": 'kv/data/dev/nextauth_secret', - "vault.hashicorp.com/agent-inject-secret-keycloack_client_id": 'kv/data/dev/keycloack_client_id', - "vault.hashicorp.com/agent-inject-secret-keycloack_client_secret": 'kv/data/dev/keycloack_client_secret', + "vault.hashicorp.com/agent-inject-secret-keycloak_client_id": 'kv/data/dev/keycloak_client_id', + "vault.hashicorp.com/agent-inject-secret-keycloak_client_secret": 'kv/data/dev/keycloak_client_secret', "vault.hashicorp.com/agent-inject-template-dev": '| \ {{- with secret "kv/dev/nextauth_secret" -}} \ {{- range $key, $value := .Data.data }} \ @@ -20,6 +20,10 @@ module.exports = (manifests) => { {{- end }} \ {{- end }}' }; + manifest.spec.template.spec = { + ...manifest.spec.template.spec, + serviceAccountName: "vault" + }; } } return manifests; diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml index 050f41f5..70dce64f 100644 --- a/.kontinuous/values.yaml +++ b/.kontinuous/values.yaml @@ -37,7 +37,6 @@ app: imagePackage: app containerPort: 3000 probesPath: "/healthz" - serviceAccountName: vault securityContext: fsGroup: 1001 runAsGroup: 1000 From 26867bb73ecb0bfb83372d11bd8a0185f6151d49 Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Thu, 21 Dec 2023 10:23:11 +0100 Subject: [PATCH 7/8] feat:remove nextauth from k secretes --- .kontinuous/env/dev/templates/app.sealed.secret.yaml | 2 +- .kontinuous/patches/secrets.js | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.kontinuous/env/dev/templates/app.sealed.secret.yaml b/.kontinuous/env/dev/templates/app.sealed.secret.yaml index 6cb1477a..ca9c3ae5 100644 --- a/.kontinuous/env/dev/templates/app.sealed.secret.yaml +++ b/.kontinuous/env/dev/templates/app.sealed.secret.yaml @@ -6,7 +6,7 @@ metadata: name: app spec: encryptedData: - NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q== +# NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q== KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO KEYCLOAK_CLIENT_SECRET: AgAiI7KGxjFjhjSY3hYrlQ30oQ7eNE2jkaEcO3gOAQhlWMFvSu1b51rhl3htkPO5YTkAsfbC7EIZkdSTEjjF6eFUKua5Z51jbKf8wmmW3VfWky26yzzyazUJ7Sv/rAPwr4ialLUivvoYLrJECE49GasHm9mosBEuvuqpFYYmiJlSOrG9kM8RdybaZmGLiUZBUIRN1bIrC9ix7kdndaCQ8ysRVH76xQ2wpXYJU4rVn2bOJgbvR4T4q/pe6TeT/H7yUZ9ritgVPH9tFCuGK0xZ3CXFnUFwQsdsB9c0aB2jwoi2YmsK0XRasRAmu7PxsqD34xGkwtopVTvLsuKhCcN/V1x81gB/8+pW1Ox6yhQKH06GNsIruamhVxeIOXP7vt0/B93+cnZQUuFL7xt7rxnZEKq/1Ja0av/2UkxAUNYNc+kdRvLJbm8TVkWUuoWbMLUrsg3S6fItRHMG1M1t9MvdeihVlTyBThadnIfKSS3RiBKi/7Maozpa2g/ATsYX15qbDeONMgRZmo6itKGtmm6RBJpluSsGmPjBBO30oSdIV8gNEzdQuboSB86XjrDgQbGPj4Mn2aeQSEoNlxS0pjXB8/jOzp68YIh7by0LVrTA8su60oNrQCA5SVXTrO/PQJpXsC998iuohL1CvWIbxkP+GxXptwoRbrNy4lYPtxYGSCFH/rdEgPElLlHy4EMpfnVr+1NWvTWsusg6fgJXtcovXz+2aYQ42yhYVg5dS26xeX6cAg== template: diff --git a/.kontinuous/patches/secrets.js b/.kontinuous/patches/secrets.js index e66534ce..067449b3 100644 --- a/.kontinuous/patches/secrets.js +++ b/.kontinuous/patches/secrets.js @@ -13,10 +13,10 @@ module.exports = (manifests) => { "vault.hashicorp.com/agent-inject-secret-nextauth": 'kv/data/dev/nextauth_secret', "vault.hashicorp.com/agent-inject-secret-keycloak_client_id": 'kv/data/dev/keycloak_client_id', "vault.hashicorp.com/agent-inject-secret-keycloak_client_secret": 'kv/data/dev/keycloak_client_secret', - "vault.hashicorp.com/agent-inject-template-dev": '| \ + "vault.hashicorp.com/agent-inject-template-dev": '\ {{- with secret "kv/dev/nextauth_secret" -}} \ {{- range $key, $value := .Data.data }} \ - export {{ $key }}={{ $value }} \ +export {{ $key }}={{ $value }} \ {{- end }} \ {{- end }}' }; From d70e88f3300de7cc522cfb9d4d88049cfd803f94 Mon Sep 17 00:00:00 2001 From: Malo BRIANT Date: Thu, 21 Dec 2023 15:25:58 +0100 Subject: [PATCH 8/8] feat: raw env variable name --- .kontinuous/patches/secrets.js | 7 ++++++- .kontinuous/values.yaml | 3 +-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.kontinuous/patches/secrets.js b/.kontinuous/patches/secrets.js index 067449b3..d0aede69 100644 --- a/.kontinuous/patches/secrets.js +++ b/.kontinuous/patches/secrets.js @@ -16,7 +16,7 @@ module.exports = (manifests) => { "vault.hashicorp.com/agent-inject-template-dev": '\ {{- with secret "kv/dev/nextauth_secret" -}} \ {{- range $key, $value := .Data.data }} \ -export {{ $key }}={{ $value }} \ +export {{ $key | upper }}={{ $value }} \ {{- end }} \ {{- end }}' }; @@ -24,6 +24,11 @@ export {{ $key }}={{ $value }} \ ...manifest.spec.template.spec, serviceAccountName: "vault" }; + manifest.spec.template.spec.containers[0] = { + ...manifest.spec.template.spec.containers[0], + command: ['sh', '-c'], + args: ['source /vault/secrets/dev && yarn start'] + } } } return manifests; diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml index 70dce64f..ccdf3352 100644 --- a/.kontinuous/values.yaml +++ b/.kontinuous/values.yaml @@ -49,8 +49,7 @@ app: ingress: annotations: nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" -# args: -# ['sh', '-c', 'source /vault/secrets/dev && node start'] + jobs: runs: