From 10dd7478991c0f8a26c9723918f7b8effb6b2a09 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:09:14 +0100 Subject: [PATCH 001/107] fix(chart): truncated secrets-operator resource name --- helm-charts/secrets-operator/templates/metrics-service.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml index ebf7ce549..99178b8c3 100644 --- a/helm-charts/secrets-operator/templates/metrics-service.yaml +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service + name: {{ include "secrets-operator.fullname" . | trunc 28 }}-controller-manager-metrics-service labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: k8-operator From 00feee6903b2911e32e3f58c5055427835884e5c Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:11:43 +0100 Subject: [PATCH 002/107] fix(chart): shorten names with variables + improved secrets support --- .../templates/backend-deployment.yaml | 39 ++++++++++-------- .../templates/frontend-deployment.yaml | 40 +++++++++++++------ .../templates/deployment.yaml | 11 ++--- 3 files changed, 56 insertions(+), 34 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index f93f3c87e..187f1240a 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -1,3 +1,4 @@ +{{- $backend := .Values.backend }} apiVersion: apps/v1 kind: Deployment metadata: @@ -9,7 +10,7 @@ metadata: labels: {{- include "infisical.backend.labels" . | nindent 4 }} spec: - replicas: {{ .Values.backend.replicaCount }} + replicas: {{ $backend.replicaCount }} selector: matchLabels: {{- include "infisical.backend.matchLabels" . | nindent 6 }} @@ -17,15 +18,15 @@ spec: metadata: labels: {{- include "infisical.backend.matchLabels" . | nindent 8 }} - {{- with .Values.backend.podAnnotations }} + {{- with $backend.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} spec: containers: - - name: {{ template "infisical.name" . }}-{{ .Values.backend.name }} - image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.backend.image.pullPolicy }} + - name: {{ template "infisical.name" . }}-{{ $backend.name }} + image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ $backend.image.pullPolicy }} readinessProbe: httpGet: path: /api/status @@ -34,32 +35,24 @@ spec: periodSeconds: 10 ports: - containerPort: 4000 - {{- if .Values.backend.kubeSecretRef }} + {{- if $backend.kubeSecretRef }} envFrom: - secretRef: - name: {{ .Values.backend.kubeSecretRef }} + name: {{ $backend.kubeSecretRef }} {{- end }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} - {{- if .Values.backendEnvironmentVariables }} - {{- range $key, $value := .Values.backendEnvironmentVariables }} - {{- if $value | quote | eq "MUST_REPLACE" }} - {{ fail "Environment variables are not set. Please set all environment variables to continue." }} - {{ end }} - - name: {{ $key }} - value: {{ quote $value }} - {{- end }} - {{- end }} --- + apiVersion: v1 kind: Service metadata: name: {{ include "infisical.backend.fullname" . }} labels: {{- include "infisical.backend.labels" . | nindent 4 }} - {{- with .Values.backend.service.annotations }} + {{- with $backend.service.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} @@ -74,3 +67,15 @@ spec: {{- if eq .Values.backend.service.type "NodePort" }} nodePort: {{ .Values.backend.service.nodePort }} {{- end }} + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: {{ $backend.kubeSecretRef | default "infisical-backend" }} +type: Opaque +data: + {{- range $key, $value := $backend.secrets }} + {{ $key }}: {{ $value | b64enc }} + {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index d396e5628..68f0a6315 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -1,3 +1,4 @@ +{{- $frontend := .Values.frontend }} apiVersion: apps/v1 kind: Deployment metadata: @@ -9,7 +10,7 @@ metadata: labels: {{- include "infisical.frontend.labels" . | nindent 4 }} spec: - replicas: {{ .Values.frontend.replicaCount }} + replicas: {{ $frontend.replicaCount }} selector: matchLabels: {{- include "infisical.frontend.matchLabels" . | nindent 6 }} @@ -17,26 +18,27 @@ spec: metadata: labels: {{- include "infisical.frontend.matchLabels" . | nindent 8 }} - {{- with .Values.frontend.podAnnotations }} + {{- with $frontend.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} spec: containers: - - name: {{ template "infisical.name" . }}-{{ .Values.frontend.name }} - image: "{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.frontend.image.pullPolicy }} + - name: {{ template "infisical.name" . }}-{{ $frontend.name }} + image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ $frontend.image.pullPolicy }} readinessProbe: httpGet: path: / port: 3000 initialDelaySeconds: 10 periodSeconds: 10 - {{- if .Values.frontend.kubeSecretRef }} + {{- if $frontend.kubeSecretRef }} envFrom: - secretRef: - name: {{ .Values.frontend.kubeSecretRef }} + name: {{ $frontend.kubeSecretRef }} {{- end }} + # Below variables should be defined available through the above secretRef secret {{- if .Values.frontendEnvironmentVariables }} env: {{- range $key, $value := .Values.frontendEnvironmentVariables }} @@ -49,25 +51,39 @@ spec: {{- end }} ports: - containerPort: 3000 + --- + apiVersion: v1 kind: Service metadata: name: {{ include "infisical.frontend.fullname" . }} labels: {{- include "infisical.frontend.labels" . | nindent 4 }} - {{- with .Values.frontend.service.annotations }} + {{- with $frontend.service.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - type: {{ .Values.frontend.service.type }} + type: {{ $frontend.service.type }} selector: {{- include "infisical.frontend.matchLabels" . | nindent 8 }} ports: - protocol: TCP port: 3000 # service targetPort: 3000 # container port - {{- if eq .Values.frontend.service.type "NodePort" }} - nodePort: {{ .Values.frontend.service.nodePort }} - {{- end }} \ No newline at end of file + {{- if eq $frontend.service.type "NodePort" }} + nodePort: {{ $frontend.service.nodePort }} + {{- end }} + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} +type: Opaque +data: + {{- range $key, $value := $frontend.secrets }} + {{ $key }}: {{ $value | b64enc }} + {{- end }} \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml index 026728bfa..0b40cb05e 100644 --- a/helm-charts/secrets-operator/templates/deployment.yaml +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -1,3 +1,4 @@ +{{- $ctrlManager := .Values.controllerManager }} apiVersion: v1 kind: ServiceAccount metadata: @@ -19,7 +20,7 @@ metadata: control-plane: controller-manager {{- include "secrets-operator.labels" . | nindent 4 }} spec: - replicas: {{ .Values.controllerManager.replicas }} + replicas: {{ $ctrlManager.replicas }} selector: matchLabels: control-plane: controller-manager @@ -57,14 +58,14 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag + image: {{ $ctrlManager.kubeRbacProxy.image.repository }}:{{ $ctrlManager.kubeRbacProxy.image.tag | default .Chart.AppVersion }} name: kube-rbac-proxy ports: - containerPort: 8443 name: https protocol: TCP - resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent + resources: {{- toYaml $ctrlManager.kubeRbacProxy.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false @@ -80,7 +81,7 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag + image: {{ $ctrlManager.manager.image.repository }}:{{ $ctrlManager.manager.image.tag | default .Chart.AppVersion }} livenessProbe: httpGet: @@ -95,7 +96,7 @@ spec: port: 8081 initialDelaySeconds: 5 periodSeconds: 10 - resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 + resources: {{- toYaml $ctrlManager.manager.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false From 9db69430b57ad3c087a8abe9d5737a1d70047e84 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:12:51 +0100 Subject: [PATCH 003/107] fix(chart): ingress shorten names with variables + ingressClassName --- helm-charts/infisical/templates/ingress.yaml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index cf9952ea3..bde3d36d2 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -1,16 +1,18 @@ {{ if .Values.ingress.enabled }} +{{- $ingress := .Values.ingress }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: infisical-ingress - {{- with .Values.ingress.annotations }} + {{- with $ingress.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: -{{- if .Values.ingress.tls }} + ingressClassName: {{ $ingress.ingressClassName | default "nginx"}} +{{- if $ingress.tls }} tls: - {{- range .Values.ingress.tls }} + {{- range $ingress.tls }} - hosts: {{- range .hosts }} - {{ . | quote }} @@ -19,18 +21,18 @@ spec: {{- end }} {{- end }} rules: - - host: {{ .Values.ingress.hostName}} + - host: {{ $ingress.hostName}} http: paths: - - path: {{ .Values.ingress.frontend.path }} - pathType: {{ .Values.ingress.frontend.pathType }} + - path: {{ $ingress.frontend.path }} + pathType: {{ $ingress.frontend.pathType }} backend: service: name: {{ include "infisical.frontend.fullname" . }} port: number: 3000 - - path: {{ .Values.ingress.backend.path }} - pathType: {{ .Values.ingress.backend.pathType }} + - path: {{ $ingress.backend.path }} + pathType: {{ $ingress.backend.pathType }} backend: service: name: {{ include "infisical.backend.fullname" . }} From e2df6e94a58e5324b9c1c7906dfae8d772f596bb Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:18:39 +0100 Subject: [PATCH 004/107] chore(chart): breaking change version bump + docs --- helm-charts/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/README.md b/helm-charts/README.md index 1bb587a2a..858f458bb 100644 --- a/helm-charts/README.md +++ b/helm-charts/README.md @@ -36,4 +36,4 @@ Steps to update the documentation : 1. `npm install ./readme-generator-for-helm` 1. `npm exec readme-generator -- --readme README.md --values values.yaml` - It'll insert the table below the `## Parameters` title - - It'll output errors if some of the path aren't documented \ No newline at end of file + - It'll output errors if some of the path aren't documented From a031e84ab8ed76f41430b062793088f8aeb6d7ec Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sun, 29 Jan 2023 20:13:39 +0100 Subject: [PATCH 005/107] fix(chart): uses envFrom only to inject secrets and conf --- .../infisical/templates/frontend-deployment.yaml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 68f0a6315..3c2fd4a6e 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -38,17 +38,6 @@ spec: - secretRef: name: {{ $frontend.kubeSecretRef }} {{- end }} - # Below variables should be defined available through the above secretRef secret - {{- if .Values.frontendEnvironmentVariables }} - env: - {{- range $key, $value := .Values.frontendEnvironmentVariables }} - {{- if $value | quote | eq "MUST_REPLACE" }} - {{ fail "Environment variables are not set. Please set all environment variables to continue." }} - {{ end }} - - name: {{ $key }} - value: {{ quote $value }} - {{- end }} - {{- end }} ports: - containerPort: 3000 From 2cc8e59ca863614a21a8f20fe629d83cc0752e2b Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 02:02:59 +0100 Subject: [PATCH 006/107] fix(chart): kubeSecretRef disables and overwrites default secrets --- helm-charts/infisical/templates/backend-deployment.yaml | 6 +++--- helm-charts/infisical/templates/frontend-deployment.yaml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 187f1240a..582a84788 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -35,11 +35,9 @@ spec: periodSeconds: 10 ports: - containerPort: 4000 - {{- if $backend.kubeSecretRef }} envFrom: - secretRef: - name: {{ $backend.kubeSecretRef }} - {{- end }} + name: {{ $backend.kubeSecretRef | default "infisical-backend" }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} @@ -70,6 +68,7 @@ spec: --- +{{ if not $backend.kubeSecretRef }} apiVersion: v1 kind: Secret metadata: @@ -79,3 +78,4 @@ data: {{- range $key, $value := $backend.secrets }} {{ $key }}: {{ $value | b64enc }} {{- end }} +{{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 3c2fd4a6e..3a5985132 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -33,11 +33,9 @@ spec: port: 3000 initialDelaySeconds: 10 periodSeconds: 10 - {{- if $frontend.kubeSecretRef }} envFrom: - secretRef: - name: {{ $frontend.kubeSecretRef }} - {{- end }} + name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} ports: - containerPort: 3000 @@ -67,6 +65,7 @@ spec: --- +{{ if not $frontend.kubeSecretRef }} apiVersion: v1 kind: Secret metadata: @@ -75,4 +74,5 @@ type: Opaque data: {{- range $key, $value := $frontend.secrets }} {{ $key }}: {{ $value | b64enc }} - {{- end }} \ No newline at end of file + {{- end }} +{{- end }} \ No newline at end of file From aa5d76108178b466913084ed2cd41ebf2dcd1300 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 02:10:28 +0100 Subject: [PATCH 007/107] fix(chart): image tags default to latest --- helm-charts/infisical/templates/backend-deployment.yaml | 2 +- helm-charts/infisical/templates/frontend-deployment.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 582a84788..09047dd58 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: {{ template "infisical.name" . }}-{{ $backend.name }} - image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default .Chart.AppVersion }}" + image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default "latest" }}" imagePullPolicy: {{ $backend.image.pullPolicy }} readinessProbe: httpGet: diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 3a5985132..762bd1852 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: {{ template "infisical.name" . }}-{{ $frontend.name }} - image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default .Chart.AppVersion }}" + image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default "latest" }}" imagePullPolicy: {{ $frontend.image.pullPolicy }} readinessProbe: httpGet: From a6b9400a4a5618dec9d4226e73c8f1682a0ae227 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 12:39:59 +0100 Subject: [PATCH 008/107] fix(chart): wrap secret values into quotes automatically --- helm-charts/infisical/templates/backend-deployment.yaml | 2 +- helm-charts/infisical/templates/frontend-deployment.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 09047dd58..362713904 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -76,6 +76,6 @@ metadata: type: Opaque data: {{- range $key, $value := $backend.secrets }} - {{ $key }}: {{ $value | b64enc }} + {{ $key }}: {{ $value | quote | b64enc }} {{- end }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 762bd1852..2086b340f 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -73,6 +73,6 @@ metadata: type: Opaque data: {{- range $key, $value := $frontend.secrets }} - {{ $key }}: {{ $value | b64enc }} + {{ $key }}: {{ $value | quote | b64enc }} {{- end }} {{- end }} \ No newline at end of file From c034b62b718591285be66cdb4f1bc96a28bb498a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Wed, 1 Feb 2023 01:37:08 +0100 Subject: [PATCH 009/107] fix(chart): default secret name to the service fullname --- helm-charts/infisical/templates/backend-deployment.yaml | 4 ++-- helm-charts/infisical/templates/frontend-deployment.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 362713904..3378d8f5b 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -37,7 +37,7 @@ spec: - containerPort: 4000 envFrom: - secretRef: - name: {{ $backend.kubeSecretRef | default "infisical-backend" }} + name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} @@ -72,7 +72,7 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $backend.kubeSecretRef | default "infisical-backend" }} + name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} type: Opaque data: {{- range $key, $value := $backend.secrets }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 2086b340f..4d6401539 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -35,7 +35,7 @@ spec: periodSeconds: 10 envFrom: - secretRef: - name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} + name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} ports: - containerPort: 3000 @@ -69,7 +69,7 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} + name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} type: Opaque data: {{- range $key, $value := $frontend.secrets }} From b7a1689aeb800d0d3b036c34d9051d4a0815f81a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 19:49:17 +0100 Subject: [PATCH 010/107] feat(chart): env variables auto-generation --- .../templates/backend-deployment.yaml | 35 ++++++++++------ .../templates/frontend-deployment.yaml | 16 ++++++-- helm-charts/infisical/values.yaml | 40 ++++++++++++------- 3 files changed, 60 insertions(+), 31 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 3378d8f5b..fca05b2a3 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -3,7 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "infisical.backend.fullname" . }} - {{- with .Values.backend.deploymentAnnotations }} + {{- with $backend.deploymentAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} @@ -15,7 +15,7 @@ spec: matchLabels: {{- include "infisical.backend.matchLabels" . | nindent 6 }} template: - metadata: + metadata: labels: {{- include "infisical.backend.matchLabels" . | nindent 8 }} {{- with $backend.podAnnotations }} @@ -38,9 +38,6 @@ spec: envFrom: - secretRef: name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} - env: - - name: MONGO_URL - value: {{ include "infisical.mongodb.connectionString" . | quote }} --- @@ -55,15 +52,15 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - type: {{ .Values.backend.service.type }} + type: {{ $backend.service.type }} selector: {{- include "infisical.backend.matchLabels" . | nindent 8 }} ports: - protocol: TCP port: 4000 targetPort: 4000 # container port - {{- if eq .Values.backend.service.type "NodePort" }} - nodePort: {{ .Values.backend.service.nodePort }} + {{- if eq $backend.service.type "NodePort" }} + nodePort: {{ $backend.service.nodePort }} {{- end }} --- @@ -72,10 +69,24 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} + name: {{ include "infisical.backend.fullname" . }} + annotations: + "helm.sh/resource-policy": "keep" type: Opaque data: - {{- range $key, $value := $backend.secrets }} - {{ $key }}: {{ $value | quote | b64enc }} - {{- end }} + {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower) + "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) + "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) + "JWT_AUTH_SECRET" (randAlphaNum 32 | lower) + "JWT_SERVICE_SECRET" (randAlphaNum 32 | lower) + "JWT_MFA_SECRET" (randAlphaNum 32 | lower) }} + {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.backend.fullname" .)) | default dict }} + {{- $secretData := (get $secretObj "data") | default dict }} + {{ range $key, $value := .Values.backendEnvironmentVariables }} + {{- $default := get $requiredVars $key -}} + {{- $current := get $secretData $key | b64dec -}} + {{- $v := $value | default ($current | default $default) -}} + {{ $key }}: {{ $v | quote | b64enc }} + {{ end -}} + MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote | b64enc }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 4d6401539..e6f0a70b6 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -69,10 +69,18 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} + name: {{ include "infisical.frontend.fullname" . }} + annotations: + "helm.sh/resource-policy": "keep" type: Opaque data: - {{- range $key, $value := $frontend.secrets }} - {{ $key }}: {{ $value | quote | b64enc }} - {{- end }} + {{- $requiredVars := dict }} + {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.frontend.fullname" .)) | default dict }} + {{- $secretData := (get $secretObj "data") | default dict }} + {{ range $key, $value := .Values.frontendEnvironmentVariables }} + {{- $default := get $requiredVars $key -}} + {{- $current := get $secretData $key | b64dec -}} + {{- $v := $value | default ($current | default $default) -}} + {{ $key }}: {{ $v | quote | b64enc }} + {{ end -}} {{- end }} \ No newline at end of file diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index d569e7c31..8253aba21 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -46,6 +46,8 @@ frontend: ## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## kubeSecretRef: "" + ## Frontend service + ## service: ## @param frontend.service.annotations Backend service annotations ## @@ -103,6 +105,8 @@ backend: ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## kubeSecretRef: "" + ## Backend service + ## service: ## @param backend.service.annotations Backend service annotations ## @@ -118,20 +122,22 @@ backend: ## Documentation : https://infisical.com/docs/self-hosting/configuration/envars ## backendEnvironmentVariables: - ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## - ENCRYPTION_KEY: MUST_REPLACE - ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ENCRYPTION_KEY: "" + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## - JWT_SIGNUP_SECRET: MUST_REPLACE - JWT_REFRESH_SECRET: MUST_REPLACE - JWT_AUTH_SECRET: MUST_REPLACE - JWT_SERVICE_SECRET: MUST_REPLACE + JWT_SIGNUP_SECRET: "" + JWT_REFRESH_SECRET: "" + JWT_AUTH_SECRET: "" + JWT_SERVICE_SECRET: "" + JWT_MFA_SECRET: "" ## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported @@ -140,13 +146,13 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. team@infisical.com) ## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host ## - SMTP_HOST: MUST_REPLACE + SMTP_HOST: "" SMTP_PORT: 587 SMTP_SECURE: false SMTP_FROM_NAME: Infisical - SMTP_FROM_ADDRESS: MUST_REPLACE - SMTP_USERNAME: MUST_REPLACE - SMTP_PASSWORD: MUST_REPLACE + SMTP_FROM_ADDRESS: "" + SMTP_USERNAME: "" + SMTP_PASSWORD: "" ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## SITE_URL: infisical.local @@ -209,8 +215,12 @@ mongodb: ## databases: - "infisical" - rootPassword: root + ## @param mongodb.auth.rootPassword Database root user name + ## rootUser: root + ## @param mongodb.auth.rootPassword Database root user password + ## + rootPassword: root ## MongoDB persistence configuration ## persistence: From 28369411f7d80ea2d6b734f8d031ccd54e56ad09 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 20:16:37 +0100 Subject: [PATCH 011/107] fix(chart): update chart dependencies --- helm-charts/infisical/Chart.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/helm-charts/infisical/Chart.lock b/helm-charts/infisical/Chart.lock index 3b5f48ca4..6bfcb167c 100644 --- a/helm-charts/infisical/Chart.lock +++ b/helm-charts/infisical/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami - version: 13.6.7 + version: 13.6.8 - name: mailhog repository: https://codecentric.github.io/helm-charts version: 5.2.3 -digest: sha256:a54ae9ee60775f6f1aa916b59aee55b3ed5234b6bd88185fcb118b7f69539d70 -generated: "2023-02-13T14:13:27.525541038+01:00" +digest: sha256:e2cf9cf448786af6d9b98725f4714c2bdd056446cb50533e499b9ccfe7da1d31 +generated: "2023-03-13T20:05:05.754788071+01:00" From da888e27add48384dbc30cc7d05d29ff131f5079 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 20:18:21 +0100 Subject: [PATCH 012/107] fix(chart): ingressClassName cross-version compatibility --- helm-charts/infisical/templates/ingress.yaml | 9 ++++++++- helm-charts/infisical/values.yaml | 14 ++++++++------ 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index bde3d36d2..9b181fe64 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -1,5 +1,10 @@ {{ if .Values.ingress.enabled }} {{- $ingress := .Values.ingress }} +{{- if and $ingress.ingressClassName (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey $ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set $ingress.annotations "kubernetes.io/ingress.class" $ingress.ingressClassName}} + {{- end }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -9,7 +14,9 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - ingressClassName: {{ $ingress.ingressClassName | default "nginx"}} + {{- if and $ingress.ingressClassName (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ $ingress.ingressClassName | default "nginx" }} + {{- end }} {{- if $ingress.tls }} tls: {{- range $ingress.tls }} diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 8253aba21..9ee624e7b 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -256,10 +256,13 @@ ingress: ## @param ingress.enabled Enable ingress ## enabled: true - annotations: - ## @skip ingress.annotations.kubernetes.io/ingress.class - ## - kubernetes.io/ingress.class: "nginx" + ## @param mailhog.ingress.ingressClassName Ingress class name + ## + ingressClassName: nginx + ## @param mailhog.ingress.annotations Ingress annotations + ## + annotations: {} + # kubernetes.io/ingress.class: "nginx" # cert-manager.io/issuer: letsencrypt-nginx ## @param ingress.hostName Ingress hostname (your custom domain name) ## Replace with your own domain @@ -351,8 +354,7 @@ mailhog: ingressClassName: nginx ## @param mailhog.ingress.annotations Ingress annotations ## - annotations: - {} + annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" ## @param mailhog.ingress.labels Ingress labels From 744caf8c79586d4604336c47564a25902681a662 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 14 Mar 2023 01:43:43 +0100 Subject: [PATCH 013/107] chore(script): remove auto-generated variables from setup script --- helm-charts/infisical/examples/kind.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/examples/kind.sh b/helm-charts/infisical/examples/kind.sh index 62280cbb3..c81e1b5e2 100755 --- a/helm-charts/infisical/examples/kind.sh +++ b/helm-charts/infisical/examples/kind.sh @@ -58,18 +58,17 @@ cat < Date: Tue, 14 Mar 2023 01:45:00 +0100 Subject: [PATCH 014/107] fix(chart): secret data to stringData for cross-type compatibility --- helm-charts/infisical/templates/backend-deployment.yaml | 6 +++--- helm-charts/infisical/templates/frontend-deployment.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index fca05b2a3..9f3ae2d91 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -73,7 +73,7 @@ metadata: annotations: "helm.sh/resource-policy": "keep" type: Opaque -data: +stringData: {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower) "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) @@ -86,7 +86,7 @@ data: {{- $default := get $requiredVars $key -}} {{- $current := get $secretData $key | b64dec -}} {{- $v := $value | default ($current | default $default) -}} - {{ $key }}: {{ $v | quote | b64enc }} + {{ $key }}: {{ $v | quote }} {{ end -}} - MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote | b64enc }} + MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index e6f0a70b6..114cfc112 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -73,7 +73,7 @@ metadata: annotations: "helm.sh/resource-policy": "keep" type: Opaque -data: +stringData: {{- $requiredVars := dict }} {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.frontend.fullname" .)) | default dict }} {{- $secretData := (get $secretObj "data") | default dict }} @@ -81,6 +81,6 @@ data: {{- $default := get $requiredVars $key -}} {{- $current := get $secretData $key | b64dec -}} {{- $v := $value | default ($current | default $default) -}} - {{ $key }}: {{ $v | quote | b64enc }} + {{ $key }}: {{ $v | quote }} {{ end -}} {{- end }} \ No newline at end of file From b2663fb3e040df91173c6837c09524457e2a9667 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:29:58 +0100 Subject: [PATCH 015/107] chore(pr): pull request template comments --- .github/pull_request_template.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 45816f5cd..fd27d42c1 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,6 +1,6 @@ # Description 📣 -*Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.* + ## Type ✨ @@ -11,7 +11,7 @@ # Tests 🛠️ -*Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. You may want to add screenshots when relevant and possible* + ```sh # Here's some code block to paste some code snippets From e37f584d75f2adda1a32a8ae6a0101be3c36e63e Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:30:55 +0100 Subject: [PATCH 016/107] fix(chart): upgrade deps and bump the verison --- helm-charts/infisical/Chart.lock | 6 +++--- helm-charts/infisical/Chart.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/Chart.lock b/helm-charts/infisical/Chart.lock index 6bfcb167c..5170df21b 100644 --- a/helm-charts/infisical/Chart.lock +++ b/helm-charts/infisical/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami - version: 13.6.8 + version: 13.9.1 - name: mailhog repository: https://codecentric.github.io/helm-charts version: 5.2.3 -digest: sha256:e2cf9cf448786af6d9b98725f4714c2bdd056446cb50533e499b9ccfe7da1d31 -generated: "2023-03-13T20:05:05.754788071+01:00" +digest: sha256:1ddb3ffef899859222b72547657f57ea303e768d67886a4a57edcb0f773ea83f +generated: "2023-03-14T12:58:34.387144895+01:00" diff --git a/helm-charts/infisical/Chart.yaml b/helm-charts/infisical/Chart.yaml index 80fe48fcc..55cc51b9b 100644 --- a/helm-charts/infisical/Chart.yaml +++ b/helm-charts/infisical/Chart.yaml @@ -7,7 +7,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.15 +version: 0.1.16 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -17,7 +17,7 @@ appVersion: "1.17.0" dependencies: - name: mongodb - version: "~13.6.7" + version: "~13.9.1" repository: "https://charts.bitnami.com/bitnami" condition: mongodb.enabled - name: mailhog From 767943368ea35494c1d9c4675ac50c104661921a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:32:54 +0100 Subject: [PATCH 017/107] fix(conf): mongodb probes + docs --- helm-charts/infisical/values.yaml | 50 +++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 9ee624e7b..db91aa26b 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -122,15 +122,15 @@ backend: ## Documentation : https://infisical.com/docs/self-hosting/configuration/envars ## backendEnvironmentVariables: - ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## ENCRYPTION_KEY: "" - ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## JWT_SIGNUP_SECRET: "" @@ -193,6 +193,38 @@ mongodb: repository: bitnami/mongodb pullPolicy: IfNotPresent tag: "6.0.4-debian-11-r0" + ## Bitnami MongoDB(®) pods' liveness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param mongodb.livenessProbe.enabled Enable livenessProbe + ## @param mongodb.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param mongodb.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param mongodb.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param mongodb.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param mongodb.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 20 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 + ## Bitnami MongoDB(®) pods' readiness probe. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param mongodb.readinessProbe.enabled Enable readinessProbe + ## @param mongodb.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param mongodb.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param mongodb.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param mongodb.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param mongodb.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 ## @param mongodb.service.annotations Service annotations ## service: @@ -215,7 +247,7 @@ mongodb: ## databases: - "infisical" - ## @param mongodb.auth.rootPassword Database root user name + ## @param mongodb.auth.rootUser Database root user name ## rootUser: root ## @param mongodb.auth.rootPassword Database root user password @@ -256,10 +288,10 @@ ingress: ## @param ingress.enabled Enable ingress ## enabled: true - ## @param mailhog.ingress.ingressClassName Ingress class name + ## @param ingress.ingressClassName Ingress class name ## ingressClassName: nginx - ## @param mailhog.ingress.annotations Ingress annotations + ## @param ingress.annotations Ingress annotations ## annotations: {} # kubernetes.io/ingress.class: "nginx" From 164da9d8e009f21667b4d5b57c9e537ecceec240 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:34:40 +0100 Subject: [PATCH 018/107] chore(doc): updated helm parameters doc + 0.1.16 upgrade instructions --- helm-charts/infisical/README.md | 190 ++++++++++++++++------ helm-charts/infisical/templates/NOTES.txt | 8 +- 2 files changed, 146 insertions(+), 52 deletions(-) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 4e20bbc86..d45b89f22 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -6,7 +6,7 @@ This is the Infisical application Helm chart. This chart includes the following | ---------- | ----------------------------------- | | `frontend` | Infisical's Web UI | | `backend` | Infisical's API | -| `mongodb` | Infisical's local database | +| `mongodb` | Infisical's database | | `mailhog` | Infisical's development SMTP server | ## Installation @@ -36,6 +36,17 @@ helm upgrade --install --atomic \ infisical infisical/infisical ``` +### Backup + +If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# export secrets to a given file (requires jq) +kubectl get secrets -n \ + -o json | jq '.data | map_values(@base64d)' > \ + .bak +``` + ## Parameters ### Common parameters @@ -68,34 +79,35 @@ helm upgrade --install --atomic \ ### Infisical backend parameters -| Name | Description | Value | -| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | -| `backend.enabled` | Enable backend | `true` | -| `backend.name` | Backend name | `backend` | -| `backend.fullnameOverride` | Backend fullnameOverride | `""` | -| `backend.podAnnotations` | Backend pod annotations | `{}` | -| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | -| `backend.replicaCount` | Backend replica count | `2` | -| `backend.image.repository` | Backend image repository | `infisical/backend` | -| `backend.image.tag` | Backend image tag | `latest` | -| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | -| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | -| `backend.service.annotations` | Backend service annotations | `{}` | -| `backend.service.type` | Backend service type | `ClusterIP` | -| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | -| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | -| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | -| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | -| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` | -| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | +| Name | Description | Value | +| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | +| `backend.enabled` | Enable backend | `true` | +| `backend.name` | Backend name | `backend` | +| `backend.fullnameOverride` | Backend fullnameOverride | `""` | +| `backend.podAnnotations` | Backend pod annotations | `{}` | +| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | +| `backend.replicaCount` | Backend replica count | `2` | +| `backend.image.repository` | Backend image repository | `infisical/backend` | +| `backend.image.tag` | Backend image tag | `latest` | +| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | +| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | +| `backend.service.annotations` | Backend service annotations | `{}` | +| `backend.service.type` | Backend service type | `ClusterIP` | +| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | +| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_MFA_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `""` | +| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | +| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | +| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | +| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | +| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | ### MongoDB(®) parameters @@ -112,11 +124,25 @@ helm upgrade --install --atomic \ | `mongodb.image.repository` | MongoDB(®) image registry | `bitnami/mongodb` | | `mongodb.image.tag` | MongoDB(®) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` | | `mongodb.image.pullPolicy` | MongoDB(®) image pull policy | `IfNotPresent` | +| `mongodb.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `mongodb.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `mongodb.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | +| `mongodb.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `10` | +| `mongodb.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `mongodb.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `mongodb.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `mongodb.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `mongodb.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `mongodb.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | | `mongodb.service.annotations` | Service annotations | `{}` | | `mongodb.auth.enabled` | Enable custom authentication | `true` | | `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.auth.rootUser` | Database root user name | `root` | +| `mongodb.auth.rootPassword` | Database root user password | `root` | | `mongodb.persistence.enabled` | Enable database persistence | `true` | | `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` | | `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` | @@ -127,11 +153,13 @@ helm upgrade --install --atomic \ ### Ingress parameters -| Name | Description | Value | -| ------------------ | ------------------------------------------- | ----------------- | -| `ingress.enabled` | Enable ingress | `true` | -| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | -| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | +| Name | Description | Value | +| -------------------------- | ------------------------------------------- | ----------------- | +| `ingress.enabled` | Enable ingress | `true` | +| `ingress.ingressClassName` | Ingress class name | `nginx` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | +| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | ### Mailhog parameters @@ -152,7 +180,7 @@ helm upgrade --install --atomic \ | `mailhog.ingress.labels` | Ingress labels | `{}` | | `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` | -Learn more in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes) + ## Persistence @@ -185,32 +213,37 @@ Below example will deploy the following : - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) - [**mailhog.infisical.local**](https://mailhog.infisical.local) - - Local SMTP server used to receive the signup verification code + - Local SMTP server used to receive the emails (e.g. signup verification code) - You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) Use below values to setup a local development environment, adapt those variables as you need +#### TL;DR + +If you're running a k8s cluster with `ingress-nginx`, you can run one of the below scripts : + +```sh +# With 'kind' + 'helm', to create a local cluster and deploy the chart +./examples.local-kind.sh + +# With 'helm' only, if you already have a cluster to deploy the chart +./examples.local-helm.sh +``` + +#### Instructions + +Here's the step-by-step instructions to setup your local development environment. First create the below file : + ```yaml # values.dev.yaml -# Enable all services for local development -frontend: - enabled: true -backend: - enabled: true -mongodb: - enabled: true +# Enable mailhog for local development mailhog: enabled: true # Configure backend development variables (required) backendEnvironmentVariables: - ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218 - JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f - JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff - JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200 - JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a SITE_URL: https://infisical.local SMTP_FROM_ADDRESS: dev@infisical.local SMTP_FROM_NAME: Local Infisical @@ -240,6 +273,63 @@ helm upgrade --install --atomic \ ## Upgrading -### 1.15.0 +Find the chart upgrade instructions below. When upgrading from your version to one of the listed below, please follow every instructions in between. -Refactoring in progress, instructions are coming soon \ No newline at end of file +Here's a snippet to upgrade your installation manually : + +```sh +# replace below '' with your own values +helm upgrade --install --atomic \ + -n "" --create-namespace \ + -f "" \ + . +``` + +### 0.1.16 + +- Auto-generation for the following variables, to ease your future upgrades or setups : + - `ENCRYPTION_KEY` + - `JWT_SIGNUP_SECRET` + - `JWT_REFRESH_SECRET` + - `JWT_AUTH_SECRET` + - `JWT_SERVICE_SECRET` + - `JWT_MFA_SECRET` + +We've migrated the applications' environment variables into `secrets` resources, shared within the deployments through `envFrom`. If you upgrade your installation make sure to backup your deployments' environment variables (e.g. encryption key and jwt secrets). + +The preference order is : +- **user-defined** (values file or inline) + - **existing-secret** (for existing installations, you don't have to specify the secrets when upgrading if they already exist) + - **auto-generated** (if none of the values above have been found, we'll auto-generate a value for the user, only for the above mentioned variables) + +#### Instructions + +1. Make sure **you have all the required environment variables** defined in the value file (or inline `--set`) you'll provide to `helm` + 1. e.g. All the above mentioned variables +1. **Backup your existing secrets** (safety precaution) + 1. with below [snippets](#snippets) +1. **Upgrade the chart**, with the [instructions](#upgrading) + 1. It'll create a secret per service, and store the secrets/conf within (auto-generate if you don't provide the required ones) + 1. It'll link the secret to the deployment through `envFrom` + 1. It'll automatically remove the hard-coded `env.*` variables from your infisical deployments +1. Make sure that the **created secrets match the ones in your backups** + 1. e.g. `kubectl get secret -n -backend --template={{.data.ENCRYPTION_KEY}} | base64 -d` +1. You're all set! + +#### Snippets + +Here's some snippets to backup your current secrets **before the upgrade** (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# replace the below variables with yours (namespace + app) +namespace=infisical; app=infisical; components="frontend backend" + +for component in $components; do + dpl=$(kubectl get deployment -n $namespace -l app=$app -l component=$component \ + -o jsonpath="{.items[0].metadata.name}") + + kubectl get deployments -n $namespace $dpl \ + -o jsonpath='{.spec.template.spec.containers[0].env[*]}' | \ + jq -r '.name + ":" + .value' > infisical-$component-conf.bak +done +``` \ No newline at end of file diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 027ecde67..142fa202d 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -68,13 +68,17 @@ │ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} │ │ → Get MongoDB root password -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d │ │ → Get MongoDB users passwords -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d │ +│ → Export your backend secrets (requires jq) +│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \ +│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak +│ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ ## \ No newline at end of file From fc41be9db894f882383311e14a9c11279eb027b4 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:35:43 +0100 Subject: [PATCH 019/107] chore(script): add local installation example scripts --- helm-charts/infisical/.gitignore | 3 +- helm-charts/infisical/examples/local-helm.sh | 35 +++++++++++++++++++ .../examples/{kind.sh => local-kind.sh} | 10 ------ 3 files changed, 37 insertions(+), 11 deletions(-) create mode 100755 helm-charts/infisical/examples/local-helm.sh rename helm-charts/infisical/examples/{kind.sh => local-kind.sh} (92%) diff --git a/helm-charts/infisical/.gitignore b/helm-charts/infisical/.gitignore index a2968aad7..c9fe0caa7 100644 --- a/helm-charts/infisical/.gitignore +++ b/helm-charts/infisical/.gitignore @@ -1,3 +1,4 @@ charts/ node_modules/ -package*.json \ No newline at end of file +package*.json +*.bak \ No newline at end of file diff --git a/helm-charts/infisical/examples/local-helm.sh b/helm-charts/infisical/examples/local-helm.sh new file mode 100755 index 000000000..047535da1 --- /dev/null +++ b/helm-charts/infisical/examples/local-helm.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash + +## Infisical local k8s development environment setup script +## using 'helm' and assume you already have a cluster and an ingress (nginx) +## + +## +## DEVELOPMENT USE ONLY +## DO NOT USE IN PRODUCTION +## + +# define variables +cluster_name=infisical +host=infisical.local + +# install infisical (local development) +helm dep update +cat < Date: Thu, 16 Mar 2023 01:49:53 +0100 Subject: [PATCH 020/107] fix(chart): NOTES.txt typos --- helm-charts/infisical/templates/NOTES.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 142fa202d..737a878d6 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -76,8 +76,8 @@ │ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d │ │ → Export your backend secrets (requires jq) -│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \ -│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak +│ $ kubectl get secrets/ -n {{ .Release.Namespace }} \ +│ -o json | jq '.data | map_values(@base64d)' > .bak │ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ From 273f4228d7622509c02a9125363e8e6df72b5182 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 17 Mar 2023 10:43:14 +0700 Subject: [PATCH 021/107] Init models for permission, service account, and service account key --- backend/src/models/permission.ts | 22 ++++++++++++ backend/src/models/serviceAccount.ts | 48 +++++++++++++++++++++++++ backend/src/models/serviceAccountKey.ts | 44 +++++++++++++++++++++++ docker-compose.dev.yml | 6 ++-- 4 files changed, 117 insertions(+), 3 deletions(-) create mode 100644 backend/src/models/permission.ts create mode 100644 backend/src/models/serviceAccount.ts create mode 100644 backend/src/models/serviceAccountKey.ts diff --git a/backend/src/models/permission.ts b/backend/src/models/permission.ts new file mode 100644 index 000000000..6218aaf3a --- /dev/null +++ b/backend/src/models/permission.ts @@ -0,0 +1,22 @@ +import { Schema, model, Types, Document } from 'mongoose'; + +export interface IPermission extends Document { + _id: Types.ObjectId; + name: string; +} + +const permissionSchema = new Schema( + { + name: { + type: String, + required: true + } + }, + { + timestamps: true + } +); + +const Permission = model('Permission', permissionSchema); + +export default Permission; \ No newline at end of file diff --git a/backend/src/models/serviceAccount.ts b/backend/src/models/serviceAccount.ts new file mode 100644 index 000000000..6ce62f3af --- /dev/null +++ b/backend/src/models/serviceAccount.ts @@ -0,0 +1,48 @@ +import { Schema, model, Types, Document } from 'mongoose'; + +export interface IServiceAccount extends Document { + _id: Types.ObjectId; + name: string; + isActive: boolean; + organization: Types.ObjectId; + createdBy: Types.ObjectId; + publicKey: string; + expiresAt: Date; +} + +const serviceAccountSchema = new Schema( + { + name: { + type: String, + required: true + }, + isActive: { + type: Boolean, + required: true + }, + organization: { + type: Schema.Types.ObjectId, + ref: 'Organization', + required: true + }, + createdBy: { + type: Schema.Types.ObjectId, + ref: 'User', + required: true + }, + publicKey: { + type: String, + required: true + }, + expiresAt: { + type: Date + } + }, + { + timestamps: true + } +); + +const ServiceAccount = model('ServiceAcount', serviceAccountSchema); + +export default ServiceAccount; \ No newline at end of file diff --git a/backend/src/models/serviceAccountKey.ts b/backend/src/models/serviceAccountKey.ts new file mode 100644 index 000000000..e54d176d6 --- /dev/null +++ b/backend/src/models/serviceAccountKey.ts @@ -0,0 +1,44 @@ +import { Schema, model, Types } from 'mongoose'; + +export interface IServiceAccountKey { + _id: Types.ObjectId; + encryptedKey: string; + nonce: string; + sender: Types.ObjectId; + serviceAccount: Types.ObjectId; + workspace: Types.ObjectId; +} + +const serviceAccountSchema = new Schema( + { + encryptedKey: { + type: String, + required: true + }, + nonce: { + type: String, + required: true + }, + sender: { + type: Schema.Types.ObjectId, + required: true + }, + serviceAccount: { + type: Schema.Types.ObjectId, + ref: 'ServiceAccount', + required: true + }, + workspace: { + type: Schema.Types.ObjectId, + ref: 'Workspace', + required: true + } + }, + { + timestamps: true + } +); + +const ServiceAccountKey = model('ServiceAccountKey', serviceAccountSchema); + +export default ServiceAccountKey; diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 7e904cd14..287e80945 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -81,9 +81,9 @@ services: - mongo env_file: .env environment: - - ME_CONFIG_MONGODB_ADMINUSERNAME=${MONGO_USERNAME} - - ME_CONFIG_MONGODB_ADMINPASSWORD=${MONGO_PASSWORD} - - ME_CONFIG_MONGODB_URL=mongodb://${MONGO_USERNAME}:${MONGO_PASSWORD}@mongo:27017/ + - ME_CONFIG_MONGODB_ADMINUSERNAME=root + - ME_CONFIG_MONGODB_ADMINPASSWORD=example + - ME_CONFIG_MONGODB_URL=mongodb://root:example@mongo:27017/ ports: - 8081:8081 networks: From 95bb9e2586b10a516c136f312f70ca53be9c4cf1 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Fri, 17 Mar 2023 09:39:57 +0100 Subject: [PATCH 022/107] fix(chart): add INVITE_ONLY_SIGNUP variable --- helm-charts/infisical/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index db91aa26b..80638dd67 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -156,6 +156,9 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## SITE_URL: infisical.local + ## @param backendEnvironmentVariables.INVITE_ONLY_SIGNUP To disable account creation from the login page + ## + INVITE_ONLY_SIGNUP: false ## @section MongoDB(®) parameters ## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml From ba240f9e29a965b612b70583addd0353d91ee6c2 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Fri, 17 Mar 2023 09:41:49 +0100 Subject: [PATCH 023/107] chore(doc): add INVITE_ONLY_SIGNUP description --- helm-charts/infisical/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index d45b89f22..21bf34c42 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -108,6 +108,7 @@ kubectl get secrets -n \ | `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | | `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | | `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | +| `backendEnvironmentVariables.INVITE_ONLY_SIGNUP` | To disable account creation from the login page | `false` | ### MongoDB(®) parameters From ebdcccb6ca9b4e100b8d1dbeed8d3af7c78b64f0 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sat, 18 Mar 2023 13:34:06 +0700 Subject: [PATCH 024/107] Checkpoint service accounts --- backend/src/controllers/v2/index.ts | 2 + .../controllers/v2/organizationsController.ts | 69 ++++--- .../v2/serviceAccountsController.ts | 178 ++++++++++++++++++ backend/src/index.ts | 2 + .../dto/CreateServiceAccountDto.ts | 8 + .../interfaces/serviceAccounts/dto/index.ts | 5 + backend/src/middleware/index.ts | 2 + .../src/middleware/requireOrganizationAuth.ts | 10 +- .../middleware/requireServiceAccountAuth.ts | 39 ++++ backend/src/models/index.ts | 9 + backend/src/models/permission.ts | 22 --- backend/src/models/serviceAccount.ts | 9 +- backend/src/models/serviceAccountKey.ts | 4 +- .../src/models/serviceAccountPermission.ts | 37 ++++ backend/src/routes/v2/index.ts | 2 + backend/src/routes/v2/organizations.ts | 16 +- backend/src/routes/v2/serviceAccounts.ts | 53 ++++++ backend/src/types/express/index.d.ts | 1 + 18 files changed, 404 insertions(+), 64 deletions(-) create mode 100644 backend/src/controllers/v2/serviceAccountsController.ts create mode 100644 backend/src/interfaces/serviceAccounts/dto/CreateServiceAccountDto.ts create mode 100644 backend/src/interfaces/serviceAccounts/dto/index.ts create mode 100644 backend/src/middleware/requireServiceAccountAuth.ts delete mode 100644 backend/src/models/permission.ts create mode 100644 backend/src/models/serviceAccountPermission.ts create mode 100644 backend/src/routes/v2/serviceAccounts.ts diff --git a/backend/src/controllers/v2/index.ts b/backend/src/controllers/v2/index.ts index d266ace3f..db78fa503 100644 --- a/backend/src/controllers/v2/index.ts +++ b/backend/src/controllers/v2/index.ts @@ -7,6 +7,7 @@ import * as serviceTokenDataController from './serviceTokenDataController'; import * as apiKeyDataController from './apiKeyDataController'; import * as secretController from './secretController'; import * as secretsController from './secretsController'; +import * as serviceAccountsController from './serviceAccountsController'; import * as environmentController from './environmentController'; import * as tagController from './tagController'; @@ -20,6 +21,7 @@ export { apiKeyDataController, secretController, secretsController, + serviceAccountsController, environmentController, tagController } diff --git a/backend/src/controllers/v2/organizationsController.ts b/backend/src/controllers/v2/organizationsController.ts index d167e5129..d7e6c1940 100644 --- a/backend/src/controllers/v2/organizationsController.ts +++ b/backend/src/controllers/v2/organizationsController.ts @@ -1,9 +1,11 @@ import { Request, Response } from 'express'; import * as Sentry from '@sentry/node'; +import { Types } from 'mongoose'; import { MembershipOrg, Membership, - Workspace + Workspace, + ServiceAccount } from '../../models'; import { deleteMembershipOrg } from '../../helpers/membershipOrg'; import { updateSubscriptionOrgQuantity } from '../../helpers/organization'; @@ -260,37 +262,44 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) => } } */ - let workspaces; - try { - const { organizationId } = req.params; + const { organizationId } = req.params; - const workspacesSet = new Set( - ( - await Workspace.find( - { - organization: organizationId - }, - '_id' - ) - ).map((w) => w._id.toString()) - ); + const workspacesSet = new Set( + ( + await Workspace.find( + { + organization: organizationId + }, + '_id' + ) + ).map((w) => w._id.toString()) + ); - workspaces = ( - await Membership.find({ - user: req.user._id - }).populate('workspace') - ) - .filter((m) => workspacesSet.has(m.workspace._id.toString())) - .map((m) => m.workspace); - } catch (err) { - Sentry.setUser({ email: req.user.email }); - Sentry.captureException(err); - return res.status(400).send({ - message: 'Failed to get organization workspaces' - }); - } - - return res.status(200).send({ + const workspaces = ( + await Membership.find({ + user: req.user._id + }).populate('workspace') + ) + .filter((m) => workspacesSet.has(m.workspace._id.toString())) + .map((m) => m.workspace); + +return res.status(200).send({ workspaces }); +} + +/** + * Return service accounts for organization with id [organizationId] + * @param req + * @param res + */ +export const getOrganizationServiceAccounts = async (req: Request, res: Response) => { + const { organizationId } = req.params; + const serviceAccounts = await ServiceAccount.find({ + organization: new Types.ObjectId(organizationId) + }); + + return res.status(200).send({ + serviceAccounts + }); } \ No newline at end of file diff --git a/backend/src/controllers/v2/serviceAccountsController.ts b/backend/src/controllers/v2/serviceAccountsController.ts new file mode 100644 index 000000000..dff280009 --- /dev/null +++ b/backend/src/controllers/v2/serviceAccountsController.ts @@ -0,0 +1,178 @@ +import { Request, Response } from 'express'; +import { Types } from 'mongoose'; +import { + ServiceAccount, + ServiceAccountKey, + ServiceAccountPermission +} from '../../models'; +import { + CreateServiceAccountDto +} from '../../interfaces/serviceAccounts/dto'; + +/** + * Create a new service account under organization with id [organizationId] + * that has access to workspaces [workspaces] + * @param req + * @param res + * @returns + */ +export const createServiceAccount = async (req: Request, res: Response) => { + const { + organizationId, + name, + publicKey, + expiresIn, + }: CreateServiceAccountDto = req.body; + + let expiresAt; + if (expiresIn) { + expiresAt = new Date(); + expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn); + } + + const serviceAccount = await new ServiceAccount({ + name, + organization: new Types.ObjectId(organizationId), + user: req.user, + publicKey, + expiresAt + }).save(); + + // await Promise.all( + // workspaces.map(async ({ + // workspaceId, + // environments, + // permissions, + // encryptedKey, + // nonce + // }: { + // workspaceId: string; + // environments: string[]; + // permissions: string[]; + // encryptedKey: string; + // nonce: string; + // }) => { + // const serviceAccountKey = await new ServiceAccountKey({ + // encryptedKey, + // nonce, + // sender: req.user._id, + // serviceAccount: serviceAccount._id, + // workspace: new Types.ObjectId(workspaceId) + // }); + + // console.log('serviceAccountKey: ', serviceAccountKey); + + // await Promise.all( + // permissions.map(async (name: string) => { + // const permission = await new ServiceAccountPermission({ + // serviceAccount: serviceAccount._id, + // name, + // workspace: new Types.ObjectId(workspaceId), + // environments + // }).save(); + + // console.log('permission: ', permission); + // }) + // ); + // }) + // ); + + return res.status(200).send({ + serviceAccount + }); +} + +// /** +// * Add a service account key to service account with id [serviceAccountId] +// * for workspace with id [workspaceId] +// * @param req +// * @param res +// * @returns +// */ +// export const addServiceAccountKey = async (req: Request, res: Response) => { +// const { +// workspaceId, +// encryptedKey, +// nonce +// } = req.body; + +// const serviceAccountKey = await new ServiceAccountKey({ +// encryptedKey, +// nonce, +// sender: req.user._id, +// serviceAccount: req.serviceAccount._d, +// workspace: new Types.ObjectId(workspaceId) +// }).save(); + +// return serviceAccountKey; +// } + +/** + * Delete service account with id [serviceAccountId] + * @param req + * @param res + * @returns + */ +export const deleteServiceAccount = async (req: Request, res: Response) => { + const { serviceAccountId } = req.params; + + const serviceAccount = await ServiceAccount.findByIdAndDelete(serviceAccountId); + + await ServiceAccountKey.deleteMany({ + serviceAccount: new Types.ObjectId(serviceAccountId) + }); + + return res.status(200).send({ + serviceAccount + }); +} + +export const addServiceAccountWorkspaceAccess = async (req: Request, res: Response) => { + const { serviceAccountId, workspaceId } = req.params; + const { + encryptedKey, + nonce, + permissions // should contain environments + } = req.body; + + const serviceAccountKey = await new ServiceAccountKey({ + encryptedKey, + nonce, + sender: req.user._id, + serviceAccount: req.serviceAccount._id, + workspace: new Types.ObjectId('workspaceId') + }); + + const serviceAccountPermissions = await Promise.all( + permissions.map + ); +} + +export const deleteServiceAccountWorkspaceAccess = async (req: Request, res: Response) => { + // TODO +} + +// /** +// * Add a service account key to service account with id [serviceAccountId] +// * for workspace with id [workspaceId] +// * @param req +// * @param res +// * @returns +// */ +// export const addServiceAccountKey = async (req: Request, res: Response) => { +// const { +// workspaceId, +// encryptedKey, +// nonce +// } = req.body; + +// const serviceAccountKey = await new ServiceAccountKey({ +// encryptedKey, +// nonce, +// sender: req.user._id, +// serviceAccount: req.serviceAccount._d, +// workspace: new Types.ObjectId(workspaceId) +// }).save(); + +// return serviceAccountKey; +// } \ No newline at end of file diff --git a/backend/src/index.ts b/backend/src/index.ts index 64d58cfc5..2c3060242 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -56,6 +56,7 @@ import { secret as v2SecretRouter, // begin to phase out secrets as v2SecretsRouter, serviceTokenData as v2ServiceTokenDataRouter, + serviceAccounts as v2ServiceAccountsRouter, apiKeyData as v2APIKeyDataRouter, environment as v2EnvironmentRouter, tags as v2TagsRouter, @@ -148,6 +149,7 @@ const main = async () => { app.use('/api/v2/secret', v2SecretRouter); // deprecated app.use('/api/v2/secrets', v2SecretsRouter); app.use('/api/v2/service-token', v2ServiceTokenDataRouter); // TODO: turn into plural route + app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new app.use('/api/v2/api-key', v2APIKeyDataRouter); // api docs diff --git a/backend/src/interfaces/serviceAccounts/dto/CreateServiceAccountDto.ts b/backend/src/interfaces/serviceAccounts/dto/CreateServiceAccountDto.ts new file mode 100644 index 000000000..dcab0f302 --- /dev/null +++ b/backend/src/interfaces/serviceAccounts/dto/CreateServiceAccountDto.ts @@ -0,0 +1,8 @@ +interface CreateServiceAccountDto { + organizationId: string; + name: string; + publicKey: string; + expiresIn: number; +} + +export default CreateServiceAccountDto; \ No newline at end of file diff --git a/backend/src/interfaces/serviceAccounts/dto/index.ts b/backend/src/interfaces/serviceAccounts/dto/index.ts new file mode 100644 index 000000000..916a198a6 --- /dev/null +++ b/backend/src/interfaces/serviceAccounts/dto/index.ts @@ -0,0 +1,5 @@ +import CreateServiceAccountDto from './CreateServiceAccountDto'; + +export { + CreateServiceAccountDto +} \ No newline at end of file diff --git a/backend/src/middleware/index.ts b/backend/src/middleware/index.ts index 7e014103c..103c6fa16 100644 --- a/backend/src/middleware/index.ts +++ b/backend/src/middleware/index.ts @@ -10,6 +10,7 @@ import requireIntegrationAuth from './requireIntegrationAuth'; import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth'; import requireServiceTokenAuth from './requireServiceTokenAuth'; import requireServiceTokenDataAuth from './requireServiceTokenDataAuth'; +import requireServiceAccountAuth from './requireServiceAccountAuth'; import requireSecretAuth from './requireSecretAuth'; import requireSecretsAuth from './requireSecretsAuth'; import validateRequest from './validateRequest'; @@ -27,6 +28,7 @@ export { requireIntegrationAuthorizationAuth, requireServiceTokenAuth, requireServiceTokenDataAuth, + requireServiceAccountAuth, requireSecretAuth, requireSecretsAuth, validateRequest diff --git a/backend/src/middleware/requireOrganizationAuth.ts b/backend/src/middleware/requireOrganizationAuth.ts index 04542b429..d001d03fe 100644 --- a/backend/src/middleware/requireOrganizationAuth.ts +++ b/backend/src/middleware/requireOrganizationAuth.ts @@ -2,6 +2,8 @@ import { Request, Response, NextFunction } from 'express'; import { IOrganization, MembershipOrg } from '../models'; import { UnauthorizedRequestError, ValidationError } from '../utils/errors'; +type req = 'params' | 'body' | 'query'; + /** * Validate if user on request is a member with proper roles for organization * on request params. @@ -11,18 +13,22 @@ import { UnauthorizedRequestError, ValidationError } from '../utils/errors'; */ const requireOrganizationAuth = ({ acceptedRoles, - acceptedStatuses + acceptedStatuses, + location = 'params' }: { acceptedRoles: string[]; acceptedStatuses: string[]; + location?: req; }) => { return async (req: Request, res: Response, next: NextFunction) => { // organization authorization middleware + + const { organizationId } = req[location]; // validate organization membership const membershipOrg = await MembershipOrg.findOne({ user: req.user._id, - organization: req.params.organizationId + organization: organizationId }).populate<{ organization: IOrganization }>('organization'); diff --git a/backend/src/middleware/requireServiceAccountAuth.ts b/backend/src/middleware/requireServiceAccountAuth.ts new file mode 100644 index 000000000..bc2cf2d12 --- /dev/null +++ b/backend/src/middleware/requireServiceAccountAuth.ts @@ -0,0 +1,39 @@ +import { Request, Response, NextFunction } from 'express'; +import { ServiceAccount } from '../models'; +import { + AccountNotFoundError, + UnauthorizedRequestError +} from '../utils/errors'; + +type req = 'params' | 'body' | 'query'; + +const requireServiceAccountAuth = ({ + acceptedRoles, + acceptedStatuses, + location = 'params' +}: { + acceptedRoles: string[]; + acceptedStatuses: string[]; + location?: req; +}) => { + return async (req: Request, res: Response, next: NextFunction) => { + const serviceAccountId = req[location].serviceAccountId; + const serviceAccount = await ServiceAccount.findById(serviceAccountId); + + // TODO: acceptedRoles and acceptedStatuses + + if (!serviceAccount) { + return next(AccountNotFoundError({ message: 'Failed to locate Service Account' })); + } + + if (serviceAccount.user.toString() !== req.user.id.toString()) { + return next(UnauthorizedRequestError({ message: 'Failed to authenticate the Service Account' })); + } + + req.serviceAccount = serviceAccount; + + next(); + } +} + +export default requireServiceAccountAuth; \ No newline at end of file diff --git a/backend/src/models/index.ts b/backend/src/models/index.ts index ead32aae4..a7796c6c6 100644 --- a/backend/src/models/index.ts +++ b/backend/src/models/index.ts @@ -10,6 +10,9 @@ import MembershipOrg, { IMembershipOrg } from './membershipOrg'; import Organization, { IOrganization } from './organization'; import Secret, { ISecret } from './secret'; import ServiceToken, { IServiceToken } from './serviceToken'; +import ServiceAccount, { IServiceAccount } from './serviceAccount'; // new +import ServiceAccountKey, { IServiceAccountKey } from './serviceAccountKey'; // new +import ServiceAccountPermission, { IServiceAccountPermission } from './serviceAccountPermission'; import TokenData, { ITokenData } from './tokenData'; import User, { IUser } from './user'; import UserAction, { IUserAction } from './userAction'; @@ -43,6 +46,12 @@ export { ISecret, ServiceToken, IServiceToken, + ServiceAccount, + IServiceAccount, + ServiceAccountKey, + IServiceAccountKey, + ServiceAccountPermission, + IServiceAccountPermission, TokenData, ITokenData, User, diff --git a/backend/src/models/permission.ts b/backend/src/models/permission.ts deleted file mode 100644 index 6218aaf3a..000000000 --- a/backend/src/models/permission.ts +++ /dev/null @@ -1,22 +0,0 @@ -import { Schema, model, Types, Document } from 'mongoose'; - -export interface IPermission extends Document { - _id: Types.ObjectId; - name: string; -} - -const permissionSchema = new Schema( - { - name: { - type: String, - required: true - } - }, - { - timestamps: true - } -); - -const Permission = model('Permission', permissionSchema); - -export default Permission; \ No newline at end of file diff --git a/backend/src/models/serviceAccount.ts b/backend/src/models/serviceAccount.ts index 6ce62f3af..1aecc4d29 100644 --- a/backend/src/models/serviceAccount.ts +++ b/backend/src/models/serviceAccount.ts @@ -3,9 +3,8 @@ import { Schema, model, Types, Document } from 'mongoose'; export interface IServiceAccount extends Document { _id: Types.ObjectId; name: string; - isActive: boolean; organization: Types.ObjectId; - createdBy: Types.ObjectId; + user: Types.ObjectId; publicKey: string; expiresAt: Date; } @@ -16,16 +15,12 @@ const serviceAccountSchema = new Schema( type: String, required: true }, - isActive: { - type: Boolean, - required: true - }, organization: { type: Schema.Types.ObjectId, ref: 'Organization', required: true }, - createdBy: { + user: { // user who created the service account type: Schema.Types.ObjectId, ref: 'User', required: true diff --git a/backend/src/models/serviceAccountKey.ts b/backend/src/models/serviceAccountKey.ts index e54d176d6..637ac188b 100644 --- a/backend/src/models/serviceAccountKey.ts +++ b/backend/src/models/serviceAccountKey.ts @@ -9,7 +9,7 @@ export interface IServiceAccountKey { workspace: Types.ObjectId; } -const serviceAccountSchema = new Schema( +const serviceAccountKeySchema = new Schema( { encryptedKey: { type: String, @@ -39,6 +39,6 @@ const serviceAccountSchema = new Schema( } ); -const ServiceAccountKey = model('ServiceAccountKey', serviceAccountSchema); +const ServiceAccountKey = model('ServiceAccountKey', serviceAccountKeySchema); export default ServiceAccountKey; diff --git a/backend/src/models/serviceAccountPermission.ts b/backend/src/models/serviceAccountPermission.ts new file mode 100644 index 000000000..e51ef4df4 --- /dev/null +++ b/backend/src/models/serviceAccountPermission.ts @@ -0,0 +1,37 @@ +import { Schema, model, Types, Document } from 'mongoose'; + +export interface IServiceAccountPermission extends Document { + _id: Types.ObjectId; + serviceAccount: Types.ObjectId; + name: string; + workspace?: Types.ObjectId; + environment?: string; +} + +const serviceAccountPermissionSchema = new Schema( + { + serviceAccount: { + type: Schema.Types.ObjectId, + ref: 'ServiceAccount', + required: true + }, + name: { + type: String, + required: true + }, + workspace: { + type: Schema.Types.ObjectId, + ref: 'Workspace', + }, + environment: { + type: 'String' + } + }, + { + timestamps: true + } +); + +const ServiceAccountPermission = model('ServiceAccountPermission', serviceAccountPermissionSchema); + +export default ServiceAccountPermission; \ No newline at end of file diff --git a/backend/src/routes/v2/index.ts b/backend/src/routes/v2/index.ts index 538ee4800..c088771eb 100644 --- a/backend/src/routes/v2/index.ts +++ b/backend/src/routes/v2/index.ts @@ -6,6 +6,7 @@ import workspace from './workspace'; import secret from './secret'; // deprecated import secrets from './secrets'; import serviceTokenData from './serviceTokenData'; +import serviceAccounts from './serviceAccounts'; import apiKeyData from './apiKeyData'; import environment from "./environment" import tags from "./tags" @@ -19,6 +20,7 @@ export { secret, secrets, serviceTokenData, + serviceAccounts, apiKeyData, environment, tags diff --git a/backend/src/routes/v2/organizations.ts b/backend/src/routes/v2/organizations.ts index e1488e8a7..a99de1ec9 100644 --- a/backend/src/routes/v2/organizations.ts +++ b/backend/src/routes/v2/organizations.ts @@ -6,7 +6,7 @@ import { requireMembershipOrgAuth, validateRequest } from '../../middleware'; -import { body, param, query } from 'express-validator'; +import { body, param } from 'express-validator'; import { OWNER, ADMIN, MEMBER, ACCEPTED } from '../../variables'; import { organizationsController } from '../../controllers/v2'; @@ -77,4 +77,18 @@ router.get( organizationsController.getOrganizationWorkspaces ); +router.get( + '/:organizationId/service-accounts', + param('organizationId').exists().trim(), + validateRequest, + requireAuth({ + acceptedAuthModes: ['jwt'] + }), + requireOrganizationAuth({ + acceptedRoles: [OWNER, ADMIN], + acceptedStatuses: [ACCEPTED] + }), + organizationsController.getOrganizationServiceAccounts +); + export default router; \ No newline at end of file diff --git a/backend/src/routes/v2/serviceAccounts.ts b/backend/src/routes/v2/serviceAccounts.ts new file mode 100644 index 000000000..901fae5f4 --- /dev/null +++ b/backend/src/routes/v2/serviceAccounts.ts @@ -0,0 +1,53 @@ +import express from 'express'; +const router = express.Router(); +import { + requireOrganizationAuth, + requireServiceAccountAuth +} from '../../middleware'; +import { body } from 'express-validator'; +import { + OWNER, + ADMIN, + MEMBER, + ACCEPTED +} from '../../variables'; +import { serviceAccountsController } from '../../controllers/v2'; + +router.post( + '/', + body('organizationId').exists().isString().trim(), + body('name').exists().isString().trim(), + body('publicKey').exists().isString().trim(), + body('expiresIn'), // measured in ms + requireOrganizationAuth({ + acceptedRoles: [OWNER, ADMIN, MEMBER], + acceptedStatuses: [ACCEPTED], + location: 'body' + }), + serviceAccountsController.createServiceAccount +); + +// router.post( +// '/:serviceAccountId/key', +// body('workspaceId').exists().isString().trim(), +// body('encryptedKey').exists().isString().trim(), +// body('nonce').exists().isString().trim(), +// requireServiceAccountAuth({ +// acceptedRoles: [OWNER, ADMIN, MEMBER], +// acceptedStatuses: [ACCEPTED] +// }), +// serviceAccountsController.addServiceAccountKey +// ); + +router.delete( + '/:serviceAccountId/key/:serviceAccountKeyId', + requireServiceAccountAuth({ + acceptedRoles: [OWNER, ADMIN, MEMBER], + acceptedStatuses: [ACCEPTED] + }), + async (req, res) => { + // TODO: delete service account key id + } +); + +export default router; \ No newline at end of file diff --git a/backend/src/types/express/index.d.ts b/backend/src/types/express/index.d.ts index acee877bd..74833daf0 100644 --- a/backend/src/types/express/index.d.ts +++ b/backend/src/types/express/index.d.ts @@ -19,6 +19,7 @@ declare global { secrets: any; secretSnapshot: any; serviceToken: any; + serviceAccount: any; accessToken: any; serviceTokenData: any; apiKeyData: any; From 8fb473c57c684e22ecc82705e3425d586a287896 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sat, 18 Mar 2023 13:52:38 +0700 Subject: [PATCH 025/107] Checkpoint service accounts --- .../v2/serviceAccountsController.ts | 163 +++++++++--------- 1 file changed, 77 insertions(+), 86 deletions(-) diff --git a/backend/src/controllers/v2/serviceAccountsController.ts b/backend/src/controllers/v2/serviceAccountsController.ts index dff280009..78758d85b 100644 --- a/backend/src/controllers/v2/serviceAccountsController.ts +++ b/backend/src/controllers/v2/serviceAccountsController.ts @@ -38,74 +38,86 @@ export const createServiceAccount = async (req: Request, res: Response) => { expiresAt }).save(); - // await Promise.all( - // workspaces.map(async ({ - // workspaceId, - // environments, - // permissions, - // encryptedKey, - // nonce - // }: { - // workspaceId: string; - // environments: string[]; - // permissions: string[]; - // encryptedKey: string; - // nonce: string; - // }) => { - // const serviceAccountKey = await new ServiceAccountKey({ - // encryptedKey, - // nonce, - // sender: req.user._id, - // serviceAccount: serviceAccount._id, - // workspace: new Types.ObjectId(workspaceId) - // }); - - // console.log('serviceAccountKey: ', serviceAccountKey); - - // await Promise.all( - // permissions.map(async (name: string) => { - // const permission = await new ServiceAccountPermission({ - // serviceAccount: serviceAccount._id, - // name, - // workspace: new Types.ObjectId(workspaceId), - // environments - // }).save(); - - // console.log('permission: ', permission); - // }) - // ); - // }) - // ); - return res.status(200).send({ serviceAccount }); } -// /** -// * Add a service account key to service account with id [serviceAccountId] -// * for workspace with id [workspaceId] -// * @param req -// * @param res -// * @returns -// */ -// export const addServiceAccountKey = async (req: Request, res: Response) => { -// const { -// workspaceId, -// encryptedKey, -// nonce -// } = req.body; +/** + * Add a service account key to service account with id [serviceAccountId] + * for workspace with id [workspaceId] + * @param req + * @param res + * @returns + */ +export const addServiceAccountKey = async (req: Request, res: Response) => { + const { + workspaceId, + encryptedKey, + nonce + } = req.body; -// const serviceAccountKey = await new ServiceAccountKey({ -// encryptedKey, -// nonce, -// sender: req.user._id, -// serviceAccount: req.serviceAccount._d, -// workspace: new Types.ObjectId(workspaceId) -// }).save(); + const serviceAccountKey = await new ServiceAccountKey({ + encryptedKey, + nonce, + sender: req.user._id, + serviceAccount: req.serviceAccount._d, + workspace: new Types.ObjectId(workspaceId) + }).save(); -// return serviceAccountKey; -// } + return serviceAccountKey; +} + +/** + * Add a permission to service account with id [serviceAccountId] + * @param req + * @param res + */ +export const addServiceAccountPermission = async (req: Request, res: Response) => { + const { + name, + workspaceId, + environment + } = req.body; // TODO: add DTO + + // TODO: validation? + + const serviceAccountPermission = await new ServiceAccountPermission({ + serviceAccount: req.serviceAccount._id, + name, + workspace: new Types.ObjectId(workspaceId), + environment + }); + + return res.status(200).send({ + serviceAccountPermission + }); +} + +/** + * Delete a permission from service account with id [serviceAccountId] + * @param req + * @param res + */ +export const deleteServiceAccountPermission = async (req: Request, res: Response) => { + const { + name, + workspaceId, + environment + } = req.body; // TODO: DTO + + // TODO: how to delete just 1 permission? + const serviceAccountPermission = await ServiceAccountPermission.findOneAndDelete({ + serviceAccount: req.serviceAccount._id, + name, + workspace: new Types.ObjectId(workspaceId), + environment + }); + + return res.status(200).send({ + serviceAccountPermission + }); +} /** * Delete service account with id [serviceAccountId] @@ -121,37 +133,16 @@ export const deleteServiceAccount = async (req: Request, res: Response) => { await ServiceAccountKey.deleteMany({ serviceAccount: new Types.ObjectId(serviceAccountId) }); + + await ServiceAccountPermission.deleteMany({ + serviceAccount: new Types.ObjectId(serviceAccountId) + }); return res.status(200).send({ serviceAccount }); } -export const addServiceAccountWorkspaceAccess = async (req: Request, res: Response) => { - const { serviceAccountId, workspaceId } = req.params; - const { - encryptedKey, - nonce, - permissions // should contain environments - } = req.body; - - const serviceAccountKey = await new ServiceAccountKey({ - encryptedKey, - nonce, - sender: req.user._id, - serviceAccount: req.serviceAccount._id, - workspace: new Types.ObjectId('workspaceId') - }); - - const serviceAccountPermissions = await Promise.all( - permissions.map - ); -} - -export const deleteServiceAccountWorkspaceAccess = async (req: Request, res: Response) => { - // TODO -} - // /** // * Add a service account key to service account with id [serviceAccountId] // * for workspace with id [workspaceId] From 686d3c409d15307d79ae3046f2c99cd8c066f023 Mon Sep 17 00:00:00 2001 From: akhilmhdh Date: Sun, 19 Mar 2023 00:32:59 +0530 Subject: [PATCH 026/107] feat(ui): added ui components for new dashboard --- .../utilities/cryptography/crypto.ts | 19 +++-- frontend/src/components/v2/Button/Button.tsx | 20 ++--- .../components/v2/Drawer/Drawer.stories.tsx | 32 +++++++ frontend/src/components/v2/Drawer/Drawer.tsx | 84 +++++++++++++++++++ frontend/src/components/v2/Drawer/index.tsx | 1 + .../v2/HoverCardv2/HoverCardv2.stories.tsx | 36 ++++++++ .../components/v2/HoverCardv2/HoverCardv2.tsx | 26 ++++++ .../src/components/v2/HoverCardv2/index.tsx | 1 + .../components/v2/IconButton/IconButton.tsx | 15 +++- frontend/src/components/v2/Input/Input.tsx | 3 + frontend/src/components/v2/Modal/Modal.tsx | 10 ++- .../v2/Popoverv2/Popoverv2.stories.tsx | 29 +++++++ .../src/components/v2/Popoverv2/Popoverv2.tsx | 54 ++++++++++++ .../src/components/v2/Popoverv2/index.tsx | 1 + frontend/src/components/v2/Switch/Switch.tsx | 6 +- frontend/src/components/v2/Tag/Tag.tsx | 56 ++++++++++--- .../src/components/v2/TextArea/TextArea.tsx | 7 +- .../components/v2/Tooltip/Tooltip.stories.tsx | 28 +++++++ .../src/components/v2/Tooltip/Tooltip.tsx | 53 ++++++++++++ frontend/src/components/v2/Tooltip/index.tsx | 1 + frontend/src/components/v2/index.tsx | 4 + 21 files changed, 445 insertions(+), 41 deletions(-) create mode 100644 frontend/src/components/v2/Drawer/Drawer.stories.tsx create mode 100644 frontend/src/components/v2/Drawer/Drawer.tsx create mode 100644 frontend/src/components/v2/Drawer/index.tsx create mode 100644 frontend/src/components/v2/HoverCardv2/HoverCardv2.stories.tsx create mode 100644 frontend/src/components/v2/HoverCardv2/HoverCardv2.tsx create mode 100644 frontend/src/components/v2/HoverCardv2/index.tsx create mode 100644 frontend/src/components/v2/Popoverv2/Popoverv2.stories.tsx create mode 100644 frontend/src/components/v2/Popoverv2/Popoverv2.tsx create mode 100644 frontend/src/components/v2/Popoverv2/index.tsx create mode 100644 frontend/src/components/v2/Tooltip/Tooltip.stories.tsx create mode 100644 frontend/src/components/v2/Tooltip/Tooltip.tsx create mode 100644 frontend/src/components/v2/Tooltip/index.tsx diff --git a/frontend/src/components/utilities/cryptography/crypto.ts b/frontend/src/components/utilities/cryptography/crypto.ts index 961dee83f..75b69a109 100644 --- a/frontend/src/components/utilities/cryptography/crypto.ts +++ b/frontend/src/components/utilities/cryptography/crypto.ts @@ -20,7 +20,7 @@ type EncryptAsymmetricProps = { * @param {Number} obj.time - number of iterations * @param {Number} obj.parallelism - desired parallelism * @param {Number} obj.hashLen - desired hash length (i.e. byte-length of derived key) - * @returns + * @returns */ const deriveArgonKey = async ({ password, @@ -39,8 +39,8 @@ const deriveArgonKey = async ({ }) => { let derivedKey; try { - derivedKey = await argon2.hash({ - pass: password, + derivedKey = await argon2.hash({ + pass: password, salt, type: argon2.ArgonType.Argon2id, mem, @@ -53,7 +53,7 @@ const deriveArgonKey = async ({ } return derivedKey; -} +}; /** * Return assymmetrically encrypted [plaintext] using [publicKey] where @@ -173,6 +173,7 @@ type DecryptSymmetricProps = { * */ const decryptSymmetric = ({ ciphertext, iv, tag, key }: DecryptSymmetricProps): string => { + if (!ciphertext) return ''; let plaintext; try { plaintext = aes.decrypt({ ciphertext, iv, tag, secret: key }); @@ -184,10 +185,10 @@ const decryptSymmetric = ({ ciphertext, iv, tag, key }: DecryptSymmetricProps): return plaintext; }; -export { - decryptAssymmetric, - decryptSymmetric, +export { + decryptAssymmetric, + decryptSymmetric, deriveArgonKey, - encryptAssymmetric, - encryptSymmetric + encryptAssymmetric, + encryptSymmetric }; diff --git a/frontend/src/components/v2/Button/Button.tsx b/frontend/src/components/v2/Button/Button.tsx index 8c6bf91b2..00663ad69 100644 --- a/frontend/src/components/v2/Button/Button.tsx +++ b/frontend/src/components/v2/Button/Button.tsx @@ -36,7 +36,7 @@ const buttonVariants = cva( star: 'text-bunker-200 bg-mineshaft-500' }, isDisabled: { - true: 'bg-mineshaft opacity-40 cursor-not-allowed', + true: 'bg-mineshaft text-white opacity-50 cursor-not-allowed', false: '' }, isFullWidth: { @@ -155,26 +155,26 @@ export const Button = forwardRef( className="absolute rounded-xl" /> )} - {leftIcon} - - {children} - + {children} +
{rightIcon} - +
); } diff --git a/frontend/src/components/v2/Drawer/Drawer.stories.tsx b/frontend/src/components/v2/Drawer/Drawer.stories.tsx new file mode 100644 index 000000000..9925d8cae --- /dev/null +++ b/frontend/src/components/v2/Drawer/Drawer.stories.tsx @@ -0,0 +1,32 @@ +import type { Meta, StoryObj } from '@storybook/react'; + +import { Button } from '../Button'; +import { Drawer, DrawerContent, DrawerContentProps, DrawerTrigger } from './Drawer'; + +const meta: Meta = { + title: 'Components/Drawer', + component: Drawer, + tags: ['v2'], + argTypes: {} +}; + +export default meta; +type Story = StoryObj; + +const Template = (args: DrawerContentProps) => ( + + + + + Hello world + +); + +export const Basic: Story = { + render: (args) =>