-
Notifications
You must be signed in to change notification settings - Fork 153
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Split secrets values across segmented secrets instances #227
Merged
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -155,6 +155,7 @@ The following table lists the configurable parameters for this chart and their d | |
| `superuser.email` | Email address for the initial super-user account | `[email protected]` | | ||
| `superuser.password` | Password for the initial super-user account | `admin` | | ||
| `superuser.apiToken` | API token created for the initial super-user account | `0123456789abcdef0123456789abcdef01234567` | | ||
| `superuser.existingSecret` | Use an existing Kubernetes `Secret` for secret values | `""` | | ||
| `skipStartupScripts` | Skip [netbox-docker startup scripts] | `true` | | ||
| `allowedHosts` | List of valid FQDNs for this NetBox instance | `["*"]` | | ||
| `admins` | List of admins to email about critical errors | `[]` | | ||
|
@@ -477,19 +478,40 @@ worker: | |
## Using an Existing Secret | ||
|
||
Rather than specifying passwords and secrets as part of the Helm release values, | ||
you may pass these to NetBox using a pre-existing `Secret` resource. When using | ||
you may pass these to NetBox using pre-existing `Secret` resources. When using | ||
this, the `Secret` must contain the following keys: | ||
|
||
### Superuser secret | ||
|
||
Type: `kubernetes.io/basic-auth` | ||
|
||
| Key | Description | Required? | | ||
| -----------------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | ||
| `username` | Username for the initial super-user account | Yes | | ||
| `password` | Password for the initial super-user account | Yes | | ||
| `email` | Email address for the initial super-user account | Yes | | ||
| `api_token` | API token created for the initial super-user account | Yes | | ||
|
||
### Config secret | ||
|
||
| Key | Description | Required? | | ||
| -----------------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | ||
| `db_password` | The password for the external PostgreSQL database | If `postgresql.enabled` is `false` and `externalDatabase.existingSecretName` is unset | | ||
| `email_password` | SMTP user password | Yes, but the value may be left blank if not required | | ||
| `ldap_bind_password` | Password for LDAP bind DN | If `remoteAuth.enabled` is `true` and `remoteAuth.backend` is `netbox.authentication.LDAPBackend` | | ||
| `secret_key` | Django secret key used for sessions and password reset tokens | Yes | | ||
|
||
### PostgreSQL secret | ||
|
||
| Key | Description | Required? | | ||
| -----------------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | ||
| `db_password` | The password for the external PostgreSQL database | If `postgresql.enabled` is `false` and `externalDatabase.existingSecretName` is unset | | ||
|
||
### Redis secret | ||
|
||
| Key | Description | Required? | | ||
| -----------------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | ||
| `redis_tasks_password` | Password for the external Redis tasks database | If `redis.enabled` is `false` and `tasksRedis.existingSecretName` is unset | | ||
| `redis_cache_password` | Password for the external Redis cache database | If `redis.enabled` is `false` and `cachingRedis.existingSecretName` is unset | | ||
| `secret_key` | Django secret key used for sessions and password reset tokens | Yes | | ||
| `superuser_password` | Password for the initial super-user account | Yes | | ||
| `superuser_api_token` | API token created for the initial super-user account | Yes | | ||
|
||
## Using extraConfig for S3 storage configuration | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
{{- if not (or .Values.postgresql.enabled .Values.externalDatabase.existingSecretName) -}} | ||
apiVersion: v1 | ||
kind: Secret | ||
metadata: | ||
name: {{ include "common.secrets.name" (dict "defaultNameSuffix" "postgresql" "context" $) }} | ||
namespace: {{ include "common.names.namespace" . | quote }} | ||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} | ||
{{- if .Values.commonAnnotations }} | ||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} | ||
{{- end }} | ||
type: Opaque | ||
data: | ||
db_password: {{ .Values.externalDatabase.password | b64enc | quote }} | ||
{{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
{{- if not (or .Values.redis.enabled (and .Values.tasksRedis.existingSecretName .Values.cachingRedis.existingSecretName)) -}} | ||
apiVersion: v1 | ||
kind: Secret | ||
metadata: | ||
name: {{ include "common.secrets.name" (dict "defaultNameSuffix" "redis" "context" $) }} | ||
namespace: {{ include "common.names.namespace" . | quote }} | ||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} | ||
{{- if .Values.commonAnnotations }} | ||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} | ||
{{- end }} | ||
type: Opaque | ||
data: | ||
{{ if not .Values.tasksRedis.existingSecretName -}} | ||
redis_tasks_password: {{ .Values.tasksRedis.password | b64enc | quote }} | ||
{{ end -}} | ||
{{ if not .Values.cachingRedis.existingSecretName -}} | ||
redis_cache_password: {{ .Values.cachingRedis.password | b64enc | quote }} | ||
{{ end -}} | ||
{{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
{{- if not .Values.superuser.existingSecret -}} | ||
apiVersion: v1 | ||
kind: Secret | ||
metadata: | ||
name: {{ include "common.secrets.name" (dict "defaultNameSuffix" "superuser" "context" $) }} | ||
namespace: {{ include "common.names.namespace" . | quote }} | ||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} | ||
{{- if .Values.commonAnnotations }} | ||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} | ||
{{- end }} | ||
type: kubernetes.io/basic-auth | ||
data: | ||
username: {{ .Values.superuser.name | default "admin" | b64enc | quote }} | ||
password: {{ .Values.superuser.password | default (randAlphaNum 16) | b64enc | quote }} | ||
email: {{ .Values.superuser.email | b64enc | quote }} | ||
api_token: {{ .Values.superuser.apiToken | default uuidv4 | b64enc | quote }} | ||
{{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -79,6 +79,7 @@ superuser: | |
email: [email protected] | ||
password: "" | ||
apiToken: "" | ||
existingSecret: "" | ||
|
||
# Skip the netbox-docker startup scripts which can pre-populate objects into a | ||
# fresh NetBox installation. By default these do nothing, but they take a while | ||
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe these need to be {{-