From 2df2176d9cfaaa0bc897933964b0dc9dcae7ac67 Mon Sep 17 00:00:00 2001 From: Robert Van Voorhees Date: Wed, 16 Dec 2020 10:32:57 -0500 Subject: [PATCH] [bitnami/harbor] Feature/external db url secret (#4736) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [bitnami/harbor] Define external psql endpoint via secret, set sslmode TL;DR ===== - Allow Postgres endpoints to be defined via environment secretKeyRef - Disable SSL by default (no longer `nil`) for external database connections Detail ====== This change allows you to define the Postgres endpoint as a secret value, rather than providing passwords in raw values files. A new secret template is created for notary to introduce relevant environment variables for the notary service. Additionally, the default configuration for `externalDatabase.sslmode` was configured as `nil`. This change explicitly sets `disable` for both `values.yaml` and `values-production.yaml`. Chart version received a patch version bump. This _could_ potentially be seen as a minor version bump, depending on your interpretation of semantic versioning. Co-authored-by: Robert Van Voorhees * Bump chart version. * Update bitnami/harbor/Chart.yaml Co-authored-by: Francisco de Paz Galán * Update bitnami/harbor/templates/notary/notary-secret-envvars.yaml Co-authored-by: Francisco de Paz Galán * Need this for all values since it's referencing the data file not stringdata now. Co-authored-by: conzetti Co-authored-by: Francisco de Paz Galán --- bitnami/harbor/Chart.yaml | 2 +- bitnami/harbor/README.md | 2 +- bitnami/harbor/templates/clair/clair-dpl.yaml | 5 ++++- .../notary/notary-secret-envvars.yaml | 18 ++++++++++++++++++ .../harbor/templates/notary/notary-server.yaml | 5 ++++- .../harbor/templates/notary/notary-signer.yaml | 5 ++++- bitnami/harbor/values-production.yaml | 2 +- bitnami/harbor/values.yaml | 2 +- 8 files changed, 34 insertions(+), 7 deletions(-) create mode 100644 bitnami/harbor/templates/notary/notary-secret-envvars.yaml diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml index 9d956eb37..bc87d0e1b 100644 --- a/bitnami/harbor/Chart.yaml +++ b/bitnami/harbor/Chart.yaml @@ -34,4 +34,4 @@ sources: - https://github.com/bitnami/bitnami-docker-harbor-registry - https://github.com/bitnami/bitnami-docker-harbor-registryctl - https://goharbor.io/ -version: 9.1.2 +version: 9.2.0 diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md index 398533305..07a954c50 100644 --- a/bitnami/harbor/README.md +++ b/bitnami/harbor/README.md @@ -712,7 +712,7 @@ The following tables list the configurable parameters of the Harbor chart and th | `externalDatabase.notarySignerDatabase` | External database name for notary signer | `nil` | | `externalDatabase.notarySignerUsername` | External database username for notary signer | `nil` | | `externalDatabase.notarySignerPassword` | External database password for notary signer | `nil` | -| `externalDatabase.sslmode` | External database ssl mode | `nil` | +| `externalDatabase.sslmode` | External database ssl mode | `disable` | ### Redis Parameters diff --git a/bitnami/harbor/templates/clair/clair-dpl.yaml b/bitnami/harbor/templates/clair/clair-dpl.yaml index a9c01ec97..1af78c568 100644 --- a/bitnami/harbor/templates/clair/clair-dpl.yaml +++ b/bitnami/harbor/templates/clair/clair-dpl.yaml @@ -202,7 +202,10 @@ spec: - name: SCANNER_STORE_REDIS_URL value: {{ include "harbor.redisForClairAdapter" . }} - name: SCANNER_CLAIR_DATABASE_URL - value: {{ include "harbor.database.clair" . }} + valueFrom: + secretKeyRef: + name: {{ template "harbor.clair" . }} + key: database {{- if .Values.internalTLS.enabled }} - name: INTERNAL_TLS_ENABLED value: "true" diff --git a/bitnami/harbor/templates/notary/notary-secret-envvars.yaml b/bitnami/harbor/templates/notary/notary-secret-envvars.yaml new file mode 100644 index 000000000..4b892b836 --- /dev/null +++ b/bitnami/harbor/templates/notary/notary-secret-envvars.yaml @@ -0,0 +1,18 @@ +{{- if .Values.notary.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "harbor.notary-server" . }}-envvars + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: notary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + server_db_url: {{ include "harbor.database.notaryServer" . | b64enc | quote }} + signer_db_url: {{ include "harbor.database.notarySigner" . | b64enc | quote }} +{{- end }} diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml index 5b6193607..19cc3a051 100644 --- a/bitnami/harbor/templates/notary/notary-server.yaml +++ b/bitnami/harbor/templates/notary/notary-server.yaml @@ -85,7 +85,10 @@ spec: - name: MIGRATIONS_PATH value: migrations/server/postgresql - name: DB_URL - value: {{ include "harbor.database.notaryServer" . }} + valueFrom: + secretKeyRef: + name: {{ include "harbor.notary-server" . }}-envvars + key: server_db_url {{- if .Values.notary.server.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.extraEnvVars "context" $) | nindent 12 }} {{- end }} diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml index 1d6f5b511..b304e1852 100644 --- a/bitnami/harbor/templates/notary/notary-signer.yaml +++ b/bitnami/harbor/templates/notary/notary-signer.yaml @@ -84,7 +84,10 @@ spec: - name: MIGRATIONS_PATH value: migrations/signer/postgresql - name: DB_URL - value: {{ include "harbor.database.notarySigner" . | quote }} + valueFrom: + secretKeyRef: + name: {{ include "harbor.notary-server" . }}-envvars + key: signer_db_url - name: NOTARY_SIGNER_DEFAULTALIAS value: defaultalias {{- if .Values.notary.signer.extraEnvVars }} diff --git a/bitnami/harbor/values-production.yaml b/bitnami/harbor/values-production.yaml index 1405c3439..96d6f34ba 100644 --- a/bitnami/harbor/values-production.yaml +++ b/bitnami/harbor/values-production.yaml @@ -2703,7 +2703,7 @@ externalDatabase: port: 5432 ## External database ssl mode ## - sslmode: + sslmode: disable ## External database name for core ## coreDatabase: diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml index 6afbcf5f5..9d89d89f5 100644 --- a/bitnami/harbor/values.yaml +++ b/bitnami/harbor/values.yaml @@ -2702,7 +2702,7 @@ externalDatabase: port: 5432 ## External database ssl mode ## - sslmode: + sslmode: disable ## External database name for core ## coreDatabase: