3.3 KiB
External Secrets
This document covers how to utilise external secrets and special requirements.
General
For most components when set the external secret will supersede e.g. a password in a values.yaml file.
The file external_secrets.yaml lists all possible references to external secrets that are currently implemented in openDesk.
Components
This section covers information and special requirements to external secrets that some Helm Charts expect.
MinIO
Like described in the upstream values.yaml credentials and information about a user in external secrets listed in usersExistingSecrets have to be formatted as follows:
stringData:
username1: |
username=test-username
password=test-password
disabled=false
policies=readwrite,consoleAdmin,diagnostics
setPolicies=fa
Further we need the credentials introduced at MinIO in various other components that didn't implement the special format from MinIO. Hence we have to create key-value-pairs of the passwords for them.
Cassandra
Cassandra is pre-populated with information regarding Dovecot with a cql script. The openDesk default initDB setting is configured as follows:
initUserData.cql: >
CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.username | quote }};
ALTER ROLE {{ .Values.databases.dovecotDictmap.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotDictmapUser "''" | squote }} AND LOGIN = true;
GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotDictmap.name | quote }} TO {{ .Values.databases.dovecotDictmap.username | quote }};
CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotACL.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
This has to be adapted into a secret that also holds a cql script and is named in initDBSecret.
XWiki
Properties listed in the file of the external secret will overwrite plain values.
Like described in the upstream values.yaml credentials and information about a user in external secrets listed in propertiesSecret have to be formatted as follows:
stringData:
propertiesFile: |
propertie1=propertie1Value
propertie2=propertie2Value
propertie3=propertie3Value