awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 06:28:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(chart): env variables auto-generation

Browse Source
This commit is contained in:
Grraahaam
2023-03-13 19:58:03 +01:00
parent c034b62b71
commit b7a1689aeb
3 changed files with 60 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm-charts/infisical/templates/backend-deployment.yaml
+23 -12
View File
@@ -3,7 +3,7 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: {{ include "infisical.backend.fullname" . }} name: {{ include "infisical.backend.fullname" . }}
{{- with .Values.backend.deploymentAnnotations }} {{- with $backend.deploymentAnnotations }}
annotations: annotations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
@@ -15,7 +15,7 @@ spec:
matchLabels: matchLabels:
{{- include "infisical.backend.matchLabels" . | nindent 6 }} {{- include "infisical.backend.matchLabels" . | nindent 6 }}
template: template:
metadata: metadata:
labels: labels:
{{- include "infisical.backend.matchLabels" . | nindent 8 }} {{- include "infisical.backend.matchLabels" . | nindent 8 }}
{{- with $backend.podAnnotations }} {{- with $backend.podAnnotations }}
@@ -38,9 +38,6 @@ spec:
envFrom: envFrom:
- secretRef: - secretRef:
name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }}
env:
- name: MONGO_URL
value: {{ include "infisical.mongodb.connectionString" . | quote }}
--- ---
@@ -55,15 +52,15 @@ metadata:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
type: {{ .Values.backend.service.type }} type: {{ $backend.service.type }}
selector: selector:
{{- include "infisical.backend.matchLabels" . | nindent 8 }} {{- include "infisical.backend.matchLabels" . | nindent 8 }}
ports: ports:
- protocol: TCP - protocol: TCP
port: 4000 port: 4000
targetPort: 4000 # container port targetPort: 4000 # container port
{{- if eq .Values.backend.service.type "NodePort" }} {{- if eq $backend.service.type "NodePort" }}
nodePort: {{ .Values.backend.service.nodePort }} nodePort: {{ $backend.service.nodePort }}
{{- end }} {{- end }}
--- ---
@@ -72,10 +69,24 @@ spec:
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} name: {{ include "infisical.backend.fullname" . }}
annotations:
"helm.sh/resource-policy": "keep"
type: Opaque type: Opaque
data: data:
{{- range $key, $value := $backend.secrets }} {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower)
{{ $key }}: {{ $value | quote | b64enc }} "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower)
{{- end }} "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower)
"JWT_AUTH_SECRET" (randAlphaNum 32 | lower)
"JWT_SERVICE_SECRET" (randAlphaNum 32 | lower)
"JWT_MFA_SECRET" (randAlphaNum 32 | lower) }}
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.backend.fullname" .)) | default dict }}
{{- $secretData := (get $secretObj "data") | default dict }}
{{ range $key, $value := .Values.backendEnvironmentVariables }}
{{- $default := get $requiredVars $key -}}
{{- $current := get $secretData $key | b64dec -}}
{{- $v := $value | default ($current | default $default) -}}
{{ $key }}: {{ $v | quote | b64enc }}
{{ end -}}
MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote | b64enc }}
{{- end }} {{- end }}
helm-charts/infisical/templates/frontend-deployment.yaml
+12 -4
View File
@@ -69,10 +69,18 @@ spec:
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} name: {{ include "infisical.frontend.fullname" . }}
annotations:
"helm.sh/resource-policy": "keep"
type: Opaque type: Opaque
data: data:
{{- range $key, $value := $frontend.secrets }} {{- $requiredVars := dict }}
{{ $key }}: {{ $value | quote | b64enc }} {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.frontend.fullname" .)) | default dict }}
{{- end }} {{- $secretData := (get $secretObj "data") | default dict }}
{{ range $key, $value := .Values.frontendEnvironmentVariables }}
{{- $default := get $requiredVars $key -}}
{{- $current := get $secretData $key | b64dec -}}
{{- $v := $value | default ($current | default $default) -}}
{{ $key }}: {{ $v | quote | b64enc }}
{{ end -}}
{{- end }} {{- end }}
helm-charts/infisical/values.yaml
+25 -15
View File
@@ -46,6 +46,8 @@ frontend:
## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
## ##
kubeSecretRef: "" kubeSecretRef: ""
## Frontend service
##
service: service:
## @param frontend.service.annotations Backend service annotations ## @param frontend.service.annotations Backend service annotations
## ##
@@ -103,6 +105,8 @@ backend:
## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
## ##
kubeSecretRef: "" kubeSecretRef: ""
## Backend service
##
service: service:
## @param backend.service.annotations Backend service annotations ## @param backend.service.annotations Backend service annotations
## ##
@@ -118,20 +122,22 @@ backend:
## Documentation : https://infisical.com/docs/self-hosting/configuration/envars ## Documentation : https://infisical.com/docs/self-hosting/configuration/envars
## ##
backendEnvironmentVariables: backendEnvironmentVariables:
## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16'
## ##
ENCRYPTION_KEY: MUST_REPLACE ENCRYPTION_KEY: ""
## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). <kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret)
## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16'
## ##
JWT_SIGNUP_SECRET: MUST_REPLACE JWT_SIGNUP_SECRET: ""
JWT_REFRESH_SECRET: MUST_REPLACE JWT_REFRESH_SECRET: ""
JWT_AUTH_SECRET: MUST_REPLACE JWT_AUTH_SECRET: ""
JWT_SERVICE_SECRET: MUST_REPLACE JWT_SERVICE_SECRET: ""
JWT_MFA_SECRET: ""
## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections
## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections
## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported ## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
@@ -140,13 +146,13 @@ backendEnvironmentVariables:
## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. [email protected]) ## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. [email protected])
## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host ## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host
## ##
SMTP_HOST: MUST_REPLACE SMTP_HOST: ""
SMTP_PORT: 587 SMTP_PORT: 587
SMTP_SECURE: false SMTP_SECURE: false
SMTP_FROM_NAME: Infisical SMTP_FROM_NAME: Infisical
SMTP_FROM_ADDRESS: MUST_REPLACE SMTP_FROM_ADDRESS: ""
SMTP_USERNAME: MUST_REPLACE SMTP_USERNAME: ""
SMTP_PASSWORD: MUST_REPLACE SMTP_PASSWORD: ""
## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com)
## ##
SITE_URL: infisical.local SITE_URL: infisical.local
@@ -209,8 +215,12 @@ mongodb:
## ##
databases: databases:
- "infisical" - "infisical"
rootPassword: root ## @param mongodb.auth.rootPassword Database root user name
##
rootUser: root rootUser: root
## @param mongodb.auth.rootPassword Database root user password
##
rootPassword: root
## MongoDB persistence configuration ## MongoDB persistence configuration
## ##
persistence: persistence: