feat(ops): harden install preflight and wire runtime app secrets

openstudio-server/templates/rserve/rserve-deploy.yaml

@@ -42,13 +42,27 @@ spec:
              - name: OS_SERVER_NUMBER_OF_WORKERS
                value: {{ .Values.rserve.number_of_workers | quote }}
              - name: SECRET_KEY_BASE
-               value: {{ .Values.web.secret_key_value }}
+               valueFrom:
+                 secretKeyRef:
+                   name: {{ include "openstudio.appSecretName" . | quote }}
+                   key: {{ include "openstudio.appSecretKey.webSecret" . | quote }}
+             - name: REDIS_PASSWORD
+               valueFrom:
+                 secretKeyRef:
+                   name: {{ include "openstudio.appSecretName" . | quote }}
+                   key: {{ include "openstudio.appSecretKey.redisPassword" . | quote }}
              - name: REDIS_URL
-               value: {{ .Values.redis_svc.url  }}
+               value: {{ printf "redis://:$(REDIS_PASSWORD)@%s:%v" .Values.redis_svc.name .Values.redis_svc.port | quote }}
              - name: MONGO_USER
-               value: {{ .Values.db.username }}
+               valueFrom:
+                 secretKeyRef:
+                   name: {{ include "openstudio.appSecretName" . | quote }}
+                   key: {{ include "openstudio.appSecretKey.dbUsername" . | quote }}
              - name: MONGO_PASSWORD
-               value: {{ .Values.db.password }}
+               valueFrom:
+                 secretKeyRef:
+                   name: {{ include "openstudio.appSecretName" . | quote }}
+                   key: {{ include "openstudio.appSecretKey.dbPassword" . | quote }}
           livenessProbe:
             exec:
               command: ["grep", "-qs", "/mnt/openstudio ",  "/proc/mounts"]

openstudio-server/templates/secrets/_helpers.tpl

@@ -0,0 +1,34 @@
+{{- define "openstudio.appSecretName" -}}
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $existingSecret := default "" (get $secrets "existingSecret") -}}
+{{- if ne $existingSecret "" -}}
+{{- $existingSecret -}}
+{{- else -}}
+{{- $secretNameOverride := default "" (get $secrets "nameOverride") -}}
+{{- default (printf "%s-app-secrets" .Release.Name) $secretNameOverride -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "openstudio.appSecretKey.dbUsername" -}}
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $keys := default (dict) (get $secrets "keys") -}}
+{{- default "db-username" (get $keys "dbUsername") -}}
+{{- end -}}
+
+{{- define "openstudio.appSecretKey.dbPassword" -}}
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $keys := default (dict) (get $secrets "keys") -}}
+{{- default "db-password" (get $keys "dbPassword") -}}
+{{- end -}}
+
+{{- define "openstudio.appSecretKey.redisPassword" -}}
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $keys := default (dict) (get $secrets "keys") -}}
+{{- default "redis-password" (get $keys "redisPassword") -}}
+{{- end -}}
+
+{{- define "openstudio.appSecretKey.webSecret" -}}
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $keys := default (dict) (get $secrets "keys") -}}
+{{- default "web-secret-key" (get $keys "webSecret") -}}
+{{- end -}}

openstudio-server/templates/secrets/app-secrets.yaml

@@ -0,0 +1,61 @@
+{{- $secrets := default (dict) .Values.secrets -}}
+{{- $existingSecret := default "" (get $secrets "existingSecret") -}}
+{{- $create := true -}}
+{{- $validateExistingSecret := true -}}
+{{- $dbUsernameKey := include "openstudio.appSecretKey.dbUsername" . -}}
+{{- $dbPasswordKey := include "openstudio.appSecretKey.dbPassword" . -}}
+{{- $redisPasswordKey := include "openstudio.appSecretKey.redisPassword" . -}}
+{{- $webSecretKey := include "openstudio.appSecretKey.webSecret" . -}}
+{{- $secretName := include "openstudio.appSecretName" . -}}
+{{- if hasKey $secrets "create" -}}
+{{- $create = (get $secrets "create") -}}
+{{- end -}}
+{{- if hasKey $secrets "validateExistingSecret" -}}
+{{- $validateExistingSecret = (get $secrets "validateExistingSecret") -}}
+{{- end -}}
+{{- if and (ne $existingSecret "") $create -}}
+{{- fail "secrets.existingSecret and secrets.create=true cannot both be set; choose one secret source" -}}
+{{- end -}}
+{{- if and (ne $existingSecret "") (not $create) $validateExistingSecret -}}
+{{- $existingSecretObject := lookup "v1" "Secret" .Release.Namespace $existingSecret -}}
+{{- if not $existingSecretObject -}}
+{{- fail (printf "secrets.existingSecret=%q was not found in namespace %q. Create it first or disable secrets.validateExistingSecret." $existingSecret .Release.Namespace) -}}
+{{- end -}}
+{{- $secretData := default (dict) (get $existingSecretObject "data") -}}
+{{- $requiredKeys := list
+      $dbUsernameKey
+      $dbPasswordKey
+      $redisPasswordKey
+      $webSecretKey -}}
+{{- $missingKeys := list -}}
+{{- $emptyKeys := list -}}
+{{- range $key := $requiredKeys -}}
+  {{- if not (hasKey $secretData $key) -}}
+    {{- $missingKeys = append $missingKeys $key -}}
+  {{- else if eq (index $secretData $key) "" -}}
+    {{- $emptyKeys = append $emptyKeys $key -}}
+  {{- end -}}
+{{- end -}}
+{{- if gt (len $missingKeys) 0 -}}
+{{- fail (printf "secrets.existingSecret=%q in namespace %q is missing required keys: %s" $existingSecret .Release.Namespace (join ", " $missingKeys)) -}}
+{{- end -}}
+{{- if gt (len $emptyKeys) 0 -}}
+{{- fail (printf "secrets.existingSecret=%q in namespace %q has empty values for required keys: %s" $existingSecret .Release.Namespace (join ", " $emptyKeys)) -}}
+{{- end -}}
+{{- end -}}
+{{- if and (eq $existingSecret "") $create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openstudio-server
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+stringData:
+  {{ $dbUsernameKey }}: {{ required "db.username must be set to a non-empty value when secrets.create=true" .Values.db.username | quote }}
+  {{ $dbPasswordKey }}: {{ required "db.password must be set to a non-empty value when secrets.create=true" .Values.db.password | quote }}
+  {{ $redisPasswordKey }}: {{ required "redis.password must be set to a non-empty value when secrets.create=true" .Values.redis.password | quote }}
+  {{ $webSecretKey }}: {{ required "web.secret_key_value must be set to a non-empty value when secrets.create=true" .Values.web.secret_key_value | quote }}
+{{- end }}

openstudio-server/templates/web-background/web-background-deploy.yaml

@@ -45,13 +45,27 @@ spec:
             - name: QUEUES
               value: background,analyses
             - name: SECRET_KEY_BASE
-              value: {{ .Values.web.secret_key_value }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.webSecret" . | quote }}
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.redisPassword" . | quote }}
             - name: REDIS_URL
-              value: {{ .Values.redis_svc.url  }}
+              value: {{ printf "redis://:$(REDIS_PASSWORD)@%s:%v" .Values.redis_svc.name .Values.redis_svc.port | quote }}
             - name: MONGO_USER
-              value: {{ .Values.db.username }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbUsername" . | quote }}
             - name: MONGO_PASSWORD
-              value: {{ .Values.db.password }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbPassword" . | quote }}
           command: ["/usr/local/bin/start-web-background"]
           livenessProbe:
             exec:

openstudio-server/templates/web/web-deploy.yaml

@@ -52,13 +52,27 @@ spec:
             - name: QUEUES
               value: analysis_wrappers
             - name: SECRET_KEY_BASE
-              value: {{ .Values.web.secret_key_value }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.webSecret" . | quote }}
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.redisPassword" . | quote }}
             - name: REDIS_URL
-              value: {{ .Values.redis_svc.url  }}
+              value: {{ printf "redis://:$(REDIS_PASSWORD)@%s:%v" .Values.redis_svc.name .Values.redis_svc.port | quote }}
             - name: MONGO_USER
-              value: {{ .Values.db.username }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbUsername" . | quote }}
             - name: MONGO_PASSWORD
-              value: {{ .Values.db.password }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbPassword" . | quote }}
             - name: MAX_REQUESTS
               value: {{ (ceil (mulf .Values.worker_hpa.maxReplicas 1.05)) | quote }}
             - name: MAX_POOL

openstudio-server/templates/worker/worker-deploy.yaml

@@ -49,13 +49,27 @@ spec:
             - name:  COUNT
               value: "1"
             - name: SECRET_KEY_BASE
-              value: {{ .Values.web.secret_key_value }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.webSecret" . | quote }}
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.redisPassword" . | quote }}
             - name: REDIS_URL
-              value: {{ .Values.redis_svc.url  }}
+              value: {{ printf "redis://:$(REDIS_PASSWORD)@%s:%v" .Values.redis_svc.name .Values.redis_svc.port | quote }}
             - name: MONGO_USER
-              value: {{ .Values.db.username }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbUsername" . | quote }}
             - name: MONGO_PASSWORD
-              value: {{ .Values.db.password }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openstudio.appSecretName" . | quote }}
+                  key: {{ include "openstudio.appSecretKey.dbPassword" . | quote }}
           command: ["/usr/local/bin/start-workers"]
       terminationGracePeriodSeconds: {{ .Values.worker.container.terminationGracePeriodSeconds }} # for long openstudio jobs.
       priorityClassName: low-priority