feat: make secret configurable and add secret annotations to deployme…

…nt (#32)
clearml · Nov 4, 2021 · bba5c07 · bba5c07
1 parent b7f73e3
commit bba5c07
Show file tree

Hide file tree

Showing 7 changed files with 32 additions and 12 deletions.
diff --git a/charts/clearml/Chart.yaml b/charts/clearml/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: clearml
 description: MLOps platform
 type: application
-version: "3.0.4"
+version: "3.0.5"
 appVersion: "1.1.1"
 home: https://clear.ml
 icon: https://raw.githubusercontent.com/allegroai/clearml/master/docs/clearml-logo.svg

diff --git a/charts/clearml/README.md b/charts/clearml/README.md
@@ -1,6 +1,6 @@
 # ClearML Ecosystem for Kubernetes
 
-![Version: 3.0.4](https://img.shields.io/badge/Version-3.0.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.1.1](https://img.shields.io/badge/AppVersion-1.1.1-informational?style=flat-square)
+![Version: 3.0.5](https://img.shields.io/badge/Version-3.0.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.1.1](https://img.shields.io/badge/AppVersion-1.1.1-informational?style=flat-square)
 
 MLOps platform
 
@@ -281,6 +281,12 @@ For detailed instructions, see the [Optional Configuration](https://github.com/a
 | redis.master.persistence.size | string | `"5Gi"` |  |
 | redis.master.port | int | `6379` |  |
 | redis.usePassword | bool | `false` |  |
+| secret.authToken | string | `"1SCf0ov3Nm544Td2oZ0gXSrsNx5XhMWdVlKz1tOgcx158bD5RV"` |  |
+| secret.credentials.apiserver.accessKey | string | `"5442F3443MJMORWZA3ZH"` |  |
+| secret.credentials.apiserver.secretKey | string | `"BxapIRo9ZINi8x25CRxz8Wdmr2pQjzuWVB4PNASZqCtTyWgWVQ"` |  |
+| secret.credentials.tests.accessKey | string | `"ENP39EQM4SLACGD5FXB7"` |  |
+| secret.credentials.tests.secretKey | string | `"lPcm0imbcBZ8mwgO7tpadutiS3gnJD05x9j7afwXPS35IKbpiQ"` |  |
+| secret.httpSession | string | `"9Tw20RbhJ1bLBiHEOWXvhplKGUbTgLzAtwFN2oLQvWwS0uRpD5"` |  |
 | webserver.affinity | object | `{}` |  |
 | webserver.extraEnvs | list | `[]` |  |
 | webserver.image.pullPolicy | string | `"IfNotPresent"` |  |

diff --git a/charts/clearml/templates/deployment-agent.yaml b/charts/clearml/templates/deployment-agent.yaml
@@ -17,8 +17,9 @@ spec:
       {{- include "clearml.selectorLabelsAgent" $ | nindent 6 }}
   template:
     metadata:
-      {{- with .podAnnotations }}
       annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") $ | sha256sum }}
+      {{- with .podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:

diff --git a/charts/clearml/templates/deployment-agentservices.yaml b/charts/clearml/templates/deployment-agentservices.yaml
@@ -12,8 +12,9 @@ spec:
       {{- include "clearml.selectorLabelsAgentServices" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.agentservices.podAnnotations }}
       annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      {{- with .Values.agentservices.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:

diff --git a/charts/clearml/templates/deployment-apiserver.yaml b/charts/clearml/templates/deployment-apiserver.yaml
@@ -11,8 +11,9 @@ spec:
       {{- include "clearml.selectorLabelsApiServer" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.apiserver.podAnnotations }}
       annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      {{- with .Values.apiserver.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:

diff --git a/charts/clearml/templates/secrets.yaml b/charts/clearml/templates/secrets.yaml
@@ -2,10 +2,10 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: clearml-conf
-data:
-  apiserver_key: NTQ0MkYzNDQzTUpNT1JXWkEzWkg=
-  apiserver_secret: QnhhcElSbzlaSU5pOHgyNUNSeHo4V2RtcjJwUWp6dVdWQjRQTkFTWnFDdFR5V2dXVlE=
-  http_session: OVR3MjBSYmhKMWJMQmlIRU9XWHZocGxLR1ViVGdMekF0d0ZOMm9MUXZXd1MwdVJwRDU=
-  auth_token: MVNDZjBvdjNObTU0NFRkMm9aMGdYU3JzTng1WGhNV2RWbEt6MXRPZ2N4MTU4YkQ1UlY=
-  tests_user_key: RU5QMzlFUU00U0xBQ0dENUZYQjc=
-  tests_user_secret: bFBjbTBpbWJjQlo4bXdnTzd0cGFkdXRpUzNnbkpEMDV4OWo3YWZ3WFBTMzVJS2JwaVE=
+stringData:
+  apiserver_key: {{ .Values.secret.credentials.apiserver.accessKey }}
+  apiserver_secret: {{ .Values.secret.credentials.apiserver.secretKey }}
+  http_session: {{ .Values.secret.httpSession }}
+  auth_token: {{ .Values.secret.authToken }}
+  tests_user_key: {{ .Values.secret.credentials.tests.accessKey }}
+  tests_user_secret: {{ .Values.secret.credentials.tests.secretKey }}
diff --git a/charts/clearml/values.yaml b/charts/clearml/values.yaml
@@ -14,6 +14,17 @@ ingress:
     hostName: "files.clearml.127-0-0-1.nip.io"
     tlsSecretName: ""
 
+secret:
+  httpSession: "9Tw20RbhJ1bLBiHEOWXvhplKGUbTgLzAtwFN2oLQvWwS0uRpD5"
+  authToken: "1SCf0ov3Nm544Td2oZ0gXSrsNx5XhMWdVlKz1tOgcx158bD5RV"
+  credentials:
+    apiserver:
+      accessKey: "5442F3443MJMORWZA3ZH"
+      secretKey: "BxapIRo9ZINi8x25CRxz8Wdmr2pQjzuWVB4PNASZqCtTyWgWVQ"
+    tests:
+      accessKey: "ENP39EQM4SLACGD5FXB7"
+      secretKey: "lPcm0imbcBZ8mwgO7tpadutiS3gnJD05x9j7afwXPS35IKbpiQ"
+
 apiserver:
   prepopulateEnabled: "true"
   prepopulateZipFiles: "/opt/clearml/db-pre-populate"