WIP: improve helm security

charts/dragonfly/templates/_helpers.tpl

@@ -213,3 +213,12 @@ Return the proper image name (for the injector image)
 {{- define "injector.image" -}}
 {{- include "common.images.image" ( dict "imageRoot" .Values.injector.image "global" .Values.global ) -}}
 {{- end -}}
+
+{{/*
+Generate an envFrom secretRef entry for an existing secret.
+Usage: include "dragonfly.envFromSecret" (dict "secretName" <name>)
+*/}}
+{{- define "dragonfly.envFromSecret" -}}
+- secretRef:
+    name: {{ .secretName }}
+{{- end -}}

charts/dragonfly/templates/client/client-daemonset.yaml

@@ -195,19 +195,13 @@ spec:
         volumeMounts:
         - name: config
           mountPath: "/etc/dragonfly"
-        - name: socket-dir
-          mountPath: /var/run/dragonfly
         {{- if .Values.client.extraVolumeMounts }}
         {{- toYaml .Values.client.extraVolumeMounts | nindent 8 }}
         {{- end }}
       volumes:
       - name: config
         configMap:
           name: {{ template "dragonfly.client.fullname" . }}
-      - name: socket-dir
-        hostPath:
-          path: /var/run/dragonfly
-          type: DirectoryOrCreate
       {{- if .Values.client.dfinit.enable }}
       - name: dfinit-config
         configMap:

charts/dragonfly/templates/client/metrics-svc.yaml

@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.client.metrics.service.type }}
-  clusterIP: {{ .Values.client.metrics.service.clusterIP }}
+  {{- with .Values.client.metrics.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
   - port: {{ .Values.client.config.metrics.server.port }}
     name: http-metrics

charts/dragonfly/templates/manager/manager-configmap.yaml

@@ -39,19 +39,23 @@ data:
       cacheDir: {{ .Values.manager.config.server.cacheDir }}
       pluginDir: {{ .Values.manager.config.server.pluginDir }}
     auth:
-{{ toYaml .Values.manager.config.auth | indent 6 }}
+      jwt:
+        realm: {{ .Values.manager.config.auth.jwt.realm }}
+        key: {{ if and .Values.global.templateConfig .Values.manager.config.auth.jwt.existingSecret }}${JWT_KEY}{{ else }}{{ .Values.manager.config.auth.jwt.key }}{{ end }}
+        timeout: {{ .Values.manager.config.auth.jwt.timeout }}
+        maxRefresh: {{ .Values.manager.config.auth.jwt.maxRefresh }}
     database:
       mysql:
         {{- if and .Values.mysql.enable (empty .Values.externalMysql.host)}}
         user: {{ .Values.mysql.auth.username }}
-        password: {{ .Values.mysql.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${MYSQL_PASSWORD}{{ else }}{{ .Values.mysql.auth.password }}{{ end }}
         host: {{ .Release.Name }}-{{ default "mysql" .Values.mysql.fullname }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
         port: {{ .Values.mysql.primary.service.port }}
         dbname: {{ .Values.mysql.auth.database }}
         migrate: {{ .Values.mysql.migrate }}
         {{- else }}
         user: {{ .Values.externalMysql.username }}
-        password: {{ .Values.externalMysql.password }}
+        password: {{ if .Values.global.templateConfig }}${MYSQL_PASSWORD}{{ else }}{{ .Values.externalMysql.password }}{{ end }}
         host: {{ .Values.externalMysql.host }}
         port: {{ .Values.externalMysql.port }}
         dbname: {{ .Values.externalMysql.database }}
@@ -61,13 +65,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         db: {{ .Values.externalRedis.db }}

charts/dragonfly/templates/manager/manager-deployment.yaml

@@ -68,6 +68,42 @@ spec:
       {{- end }}
       {{- if or .Values.redis.enable .Values.mysql.enable }}
       initContainers:
+      {{- if .Values.global.templateConfig }}
+      - name: config-template
+        # TODO: parametrize image with envsubsts
+        image: docker.io/tomkukral/tool
+        imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
+        command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
+        volumeMounts:
+        - name: config-tmp
+          mountPath: /config-tmp
+        - name: config
+          mountPath: /config
+        resources:
+          {{- toYaml .Values.manager.initContainer.resources | nindent 10 }}
+        envFrom:
+        {{- if and .Values.mysql.enable (empty .Values.externalMysql.host) }}
+        {{- if .Values.mysql.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.mysql.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalMysql.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalMysql.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.redis.enable }}
+        {{- if .Values.redis.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.redis.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalRedis.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalRedis.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.manager.config.auth.jwt.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.manager.config.auth.jwt.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.manager.extraEnvVars }}
+        env:
+        {{- include "common.tplvalues.render" (dict "value" .Values.manager.extraEnvVars "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
       {{- if .Values.redis.enable }}
       - name: wait-for-redis
         image: {{ template "manager.initContainer.image" . }}
@@ -109,8 +145,9 @@ spec:
           protocol: TCP
         {{- end }}
         volumeMounts:
-        - name: config
+        - name: {{ if .Values.global.templateConfig }}config-tmp{{ else }}config{{ end }}
           mountPath: "/etc/dragonfly"
+          readOnly: true
         {{- if .Values.manager.extraVolumeMounts }}
         {{- toYaml .Values.manager.extraVolumeMounts | nindent 8 }}
         {{- end }}
@@ -129,6 +166,10 @@ spec:
           timeoutSeconds: 10
           failureThreshold: 5
       volumes:
+      {{- if .Values.global.templateConfig }}
+      - name: config-tmp
+        emptyDir: {}
+      {{- end }}
       - name: config
         configMap:
           name: {{ template "dragonfly.manager.fullname" . }}

charts/dragonfly/templates/manager/manager-svc.yaml

@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.manager.service.type }}
-  clusterIP: {{ .Values.manager.service.clusterIP }}
+  {{- with .Values.manager.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.manager.restPort }}
       name: http-rest

charts/dragonfly/templates/manager/metrics-svc.yaml

@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.manager.metrics.service.type }}
-  clusterIP: {{ .Values.manager.metrics.service.clusterIP }}
+  {{- with .Values.manager.metrics.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
   - port: 8000
     name: http-metrics

charts/dragonfly/templates/scheduler/scheduler-configmap.yaml

@@ -20,13 +20,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
@@ -52,13 +52,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}

charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml

@@ -69,6 +69,31 @@ spec:
 {{ toYaml .Values.scheduler.hostAliases | indent 8 }}
       {{- end }}
       initContainers:
+      {{- if .Values.global.templateConfig }}
+      - name: config-template
+        image: docker.io/tomkukral/tool
+        imagePullPolicy: {{ .Values.scheduler.initContainer.image.pullPolicy }}
+        command: ["sh", "-c", "envsubst < /config/scheduler.yaml > /config-tmp/scheduler.yaml"]
+        volumeMounts:
+        - name: config-tmp
+          mountPath: /config-tmp
+        - name: config
+          mountPath: /config
+        resources:
+          {{- toYaml .Values.scheduler.initContainer.resources | nindent 10 }}
+        envFrom:
+        {{- if .Values.redis.enable }}
+        {{- if .Values.redis.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.redis.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalRedis.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalRedis.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.scheduler.extraEnvVars }}
+        env:
+        {{- include "common.tplvalues.render" (dict "value" .Values.scheduler.extraEnvVars "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
       - name: wait-for-manager
         image: {{ template "scheduler.initContainer.image" . }}
         imagePullPolicy: {{ .Values.scheduler.initContainer.image.pullPolicy }}
@@ -101,7 +126,7 @@ spec:
           protocol: TCP
         {{- end }}
         volumeMounts:
-        - name: config
+        - name: {{ if .Values.global.templateConfig }}config-tmp{{ else }}config{{ end }}
           mountPath: "/etc/dragonfly"
         {{- if .Values.scheduler.extraVolumeMounts }}
         {{- toYaml .Values.scheduler.extraVolumeMounts | nindent 8 }}
@@ -121,6 +146,10 @@ spec:
           timeoutSeconds: 10
           failureThreshold: 5
       volumes:
+      {{- if .Values.global.templateConfig }}
+      - name: config-tmp
+        emptyDir: {}
+      {{- end }}
       - name: config
         configMap:
           name: {{ template "dragonfly.scheduler.fullname" . }}

charts/dragonfly/templates/scheduler/scheduler-svc.yaml

@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.scheduler.service.type }}
-  clusterIP: {{ .Values.scheduler.service.clusterIP }}
+  {{- with .Values.scheduler.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.scheduler.config.server.port }}
       name: grpc

charts/dragonfly/templates/seed-client/seed-client-svc.yaml

@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.seedClient.service.type }}
-  clusterIP: {{ .Values.seedClient.service.clusterIP }}
+  {{- with .Values.seedClient.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.seedClient.config.proxy.server.port }}
       name: http-proxy

charts/dragonfly/values.yaml

@@ -19,6 +19,10 @@ global:
   # -- Global storageClass for Persistent Volume(s).
   storageClass: ''
 
+  # -- template (envsubst) configuration file by init-container
+  # it allows to pass secrets from env vars instead of hardcoding to config
+  templateConfig: false
+
 manager:
   # -- Enable manager.
   enable: true
@@ -179,6 +183,11 @@ manager:
         # encoded base64 of dragonfly.
         # Please change the key in production.
         key: 'ZHJhZ29uZmx5Cg=='
+        # -- existingSecret is the name of an existing Kubernetes Secret containing the JWT signing key.
+        # When set, the key field is ignored and the secret value is used instead.
+        existingSecret: ''
+        # -- existingSecretKey is the key within the existing secret that holds the JWT signing key.
+        existingSecretKey: 'JWT_KEY'
         # -- Timeout is duration that a jwt token is valid,
         # default duration is two days.
         timeout: 48h
@@ -1305,12 +1314,18 @@ client:
   extraEnvVars: []
   # -- Extra volumes for dfdaemon.
   extraVolumes:
+    - name: socket-dir
+      hostPath:
+        path: /var/run/dragonfly
+        type: DirectoryOrCreate
     - name: storage
       emptyDir: {}
     - name: logs
       emptyDir: {}
   # -- Extra volumeMounts for dfdaemon.
   extraVolumeMounts:
+    - name: socket-dir
+      mountPath: /var/run/dragonfly
     - name: storage
       mountPath: /var/lib/dragonfly/
     - name: logs
@@ -1831,6 +1846,11 @@ mysql:
     username: dragonfly
     # -- Mysql password.
     password: dragonfly
+    # -- Existing secret name containing the mysql password. When set with global.templateConfig=true,
+    # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
+    existingSecret: ''
+    # -- Key in the existing secret that holds the mysql password.
+    existingSecretKey: 'MYSQL_PASSWORD'
     # -- Mysql database name.
     database: manager
   primary:
@@ -1847,6 +1867,11 @@ externalMysql:
   username: dragonfly
   # -- External mysql password.
   password: dragonfly
+  # -- Existing secret name containing the external mysql password. When set with global.templateConfig=true,
+  # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
+  existingSecret: ''
+  # -- Key in the existing secret that holds the external mysql password.
+  existingSecretKey: 'MYSQL_PASSWORD'
   # -- External mysql database name.
   database: manager
   # -- External mysql port.
@@ -1864,6 +1889,11 @@ redis:
     enabled: true
     # -- Redis password.
     password: dragonfly
+    # -- Existing secret name containing the redis password. When set with global.templateConfig=true,
+    # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
+    existingSecret: ''
+    # -- Key in the existing secret that holds the redis password.
+    existingSecretKey: 'REDIS_PASSWORD'
   master:
     service:
       ports:
@@ -1880,6 +1910,11 @@ externalRedis:
   username: ''
   # -- External redis password.
   password: ''
+  # -- Existing secret name containing the external redis password. When set with global.templateConfig=true,
+  # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
+  existingSecret: ''
+  # -- Key in the existing secret that holds the external redis password.
+  existingSecretKey: 'REDIS_PASSWORD'
   # -- External redis sentinel addresses.
   sentinelUsername: ''
   # -- External redis sentinel password.