Feature/addsecrets

charts/icinga-stack/charts/icinga-kubernetes/templates/_config.tpl

@@ -20,8 +20,32 @@ database:
     database: kubernetes
 
     # Database user.
+    {{- if and .Values.global.databases.kubernetes.username .Values.global.databases.kubernetes.username.value }}
     user: {{ .Values.global.databases.kubernetes.username.value }}
+    {{- else if and .Values.global.databases.kubernetes.username .Values.global.databases.kubernetes.credSecret .Values.global.databases.kubernetes.username.secretKey }}
+    valueFrom:
+    secretKeyRef:
+        name: {{ .Values.global.databases.kubernetes.credSecret }}
+        key: {{ .Values.global.databases.kubernetes.username.secretKey }}
+    {{- else }}
+    valueFrom:
+    secretKeyRef:
+        name: database.kubernetes
+        key: kubernetes_username
+    {{- end }}
 
     # Database password.
+    {{- if and .Values.global.databases.kubernetes.password .Values.global.databases.kubernetes.password.value }}
     password: {{ .Values.global.databases.kubernetes.password.value }}
+    {{- else if and .Values.global.databases.kubernetes.password .Values.global.databases.kubernetes.credSecret .Values.global.databases.kubernetes.password.secretKey }}
+    valueFrom:
+    secretKeyRef:
+        name: {{ .Values.global.databases.kubernetes.credSecret }}
+        key: {{ .Values.global.databases.kubernetes.username.secretKey }}
+    {{- else }}
+    valueFrom:
+    secretKeyRef:
+        name: database.kubernetes
+        key: kubernetes_username
+    {{- end }}   
 {{- end -}}

charts/icinga-stack/charts/icinga2/templates/_env_secrets.tpl

@@ -8,7 +8,10 @@
       name: {{ .Values.config.ticket_salt.credSecret | quote }}
       key: {{ .Values.config.ticket_salt.secretKey | quote }}
   {{- else }}
-    {{ fail "Icinga TicketSalt not set. Either set .Values.config.ticket_salt.value or .Values.config.ticket_salt.credSecret and .Values.config.ticket_salt.secretKey" }}
+  valueFrom:
+    secretKeyRef:
+      name: icinga2
+      key: ticket_salt
   {{- end }}
 {{- range $user, $settings := .Values.global.api.users }}
 {{- if ne $user "credSecret" }} # skip credSecret key
@@ -21,7 +24,10 @@
       name: {{ $.Values.global.api.users.credSecret | quote }}
       key: {{ $settings.password.secretKey | quote }}
 {{- else }}
-{{ fail (print $user " api user password not set. Set either .Values.global.api.users." $user ".password.value or .Values.global.api.users.credSecret and .Values.global.api.users." $user ".password.secretKey") }}
+  valueFrom:
+    secretKeyRef:
+      name: api.{{$user}}
+      key: {{$user}}_password
 {{- end }}
 {{- end }}
 {{- end }}

charts/icinga-stack/charts/icinga2/templates/secrets.yml

@@ -0,0 +1,9 @@
+{{- if and (not .Values.config.ticket_salt.value) (not .Values.config.ticket_salt.credSecret) (not .Values.config.ticket_salt.secretKey)}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: icinga2
+type: Opaque
+data:
+  ticket_salt : {{ randAlphaNum 32 | b64enc }}
+{{- end}}

charts/icinga-stack/charts/icingadb/templates/deployment.yaml

@@ -48,7 +48,10 @@ spec:
                   name: {{ .Values.global.databases.icingadb.credSecret | quote }}
                   key: {{ .Values.global.databases.icingadb.username.secretKey | quote }}
               {{- else }}
-              {{ fail ".Values.global.databases.icingadb.username not set. Set either .Values.global.databases.icingadb.username.value or .Values.global.databases.icingadb.credSecret and .Values.global.databases.icingadb.username.secretKey" }}
+              valueFrom:
+                secretKeyRef:
+                  name: database.icingadb
+                  key: icingadb_username
               {{- end }}
             - name: ICINGADB_DATABASE_PASSWORD
               {{- if and .Values.global.databases.icingadb.password .Values.global.databases.icingadb.password.value }}
@@ -59,7 +62,10 @@ spec:
                   name: {{ .Values.global.databases.icingadb.credSecret | quote }}
                   key: {{ .Values.global.databases.icingadb.password.secretKey | quote }}
               {{- else }}
-              {{ fail ".Values.global.databases.icingadb.password not set. Set either .Values.global.databases.icingadb.password.value or .Values.global.databases.icingadb.credSecret and .Values.global.databases.icingadb.password.secretKey" }}
+              valueFrom:
+                secretKeyRef:
+                  name: database.icingadb
+                  key: icingadb_password
               {{- end }}
             - name: ICINGADB_DATABASE_DATABASE
               value: {{ .Values.global.databases.icingadb.database | default "mysql" | quote }}

charts/icinga-stack/charts/icingaweb2/templates/_icingaweb-config.tpl

@@ -19,7 +19,10 @@
       name: {{ .Values.global.api.users.credSecret | quote }}
       key: {{ .Values.global.api.users.director.password.secretKey | quote }}
 {{- else }}
-{{ fail "director api user password not set. Set either .Values.global.api.users.director.password.value or .Values.global.api.users.credSecret and .Values.global.api.users.director.password.secretKey" }}
+  valueFrom:
+    secretKeyRef:
+      name: api.director
+      key: director_password
 {{- end }}
 {{- end }}
 {{- end }}
@@ -36,7 +39,10 @@
       name: {{ .Values.auth.admin_password.credSecret | quote }}
       key: {{ .Values.auth.admin_password.secretKey | quote }}
 {{- else }}
-{{ fail "Icinga Web auth admin password not set. Set either .Values.icingaweb2.auth.admin_password.value or .Values.icingaweb2.auth.admin_password.credSecret and .Values.icingaweb2.auth.admin_password.secretKey" }}
+  valueFrom:
+    secretKeyRef:
+      name: icingaweb2
+      key: auth_password
 {{- end}}
 - name: icingaweb.config.global.config_resource
   value: {{ .Values.auth.resource | default .Values.global.databases.icingaweb2.database | quote }}
@@ -76,7 +82,10 @@
       name: {{ .Values.global.api.users.credSecret | quote }}
       key: {{ .Values.global.api.users.icingaweb.password.secretKey | quote }}
 {{- else }}
-{{ fail "icingaweb API user password not set. Set either .Values.global.api.users.icingaweb.password.value or .Values.global.api.users.credSecret and .Values.global.api.users.icingaweb.password.secretKey" }}
+  valueFrom:
+    secretKeyRef:
+      name: api.icingaweb
+      key: icingaweb_password
 {{- end }}
 {{- end }}
 {{- if .Values.modules.audit.enabled }}

charts/icinga-stack/charts/icingaweb2/templates/secrets.yaml

@@ -0,0 +1,9 @@
+{{- if and (not .Values.auth.admin_password.value) (not .Values.auth.admin_password.credSecret) (not .Values.auth.admin_password.secretKey)}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: icingaweb2
+data:
+  auth_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}

charts/icinga-stack/templates/NOTES.txt

@@ -0,0 +1,11 @@
+For easy access to icingaweb2 you can do following:
+
+    kubectl port-forward svc/{{ .Release.Name }}-icingaweb2 -n {{ .Release.Namespace }} 8080:8080
+
+Open the browser on http://localhost:8080 to access icingaweb2.
+
+Afterwards you will be asked to login. The username is always icingaadmin
+
+In case you didn't define a password in the helm installation a random password will be generated. You can find the password by running:
+
+    kubectl get secret icingaweb2 -n {{ .Release.Namespace }} -o jsonpath='{.data.auth_password}' | base64 -d 

charts/icinga-stack/templates/internal-databases.yaml

@@ -41,8 +41,11 @@ spec:
                   name: {{ $settings.credSecret | quote }}
                   key: {{ $settings.username.secretKey | quote }}
               {{- else }}
-              {{ fail (print $resource " username not set. Set either .Values.global.databases." $resource ".username.value or .Values.global.databases." $resource ".credSecret and .Values.global.databases." $resource ".username.secretKey") }}
-              {{- end }}
+              valueFrom:
+                secretKeyRef:
+                  name: database.{{$resource}}
+                  key: {{$resource}}_username
+              {{- end }} 
             - name: MARIADB_PASSWORD
               {{- if and $settings.password $settings.password.value }}
               value: {{ $settings.password.value | quote }}
@@ -52,8 +55,11 @@ spec:
                   name: {{ $settings.credSecret | quote }}
                   key: {{ $settings.password.secretKey | quote }}
               {{- else }}
-              {{ fail (print $resource " password not set. Set either .Values.global.databases." $resource ".password.value or .Values.global.databases." $resource ".credSecret and .Values.global.databases." $resource ".password.secretKey") }}
-              {{- end }}
+              valueFrom:
+                secretKeyRef:
+                  name: database.{{$resource}}
+                  key: {{$resource}}_password
+              {{- end }}    
           volumeMounts:
             {{- if $settings.persistence.enabled }}
             - name: data

charts/icinga-stack/templates/secrets.yaml

@@ -0,0 +1,67 @@
+{{- if and (not .Values.global.api.users.director.password) (not .Values.global.api.users.credSecret) (not .Values.global.api.users.director.password.secretKey)}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: api.director
+data:
+  director_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}
+---
+{{- if and (not .Values.global.api.users.icingaweb.password) (not .Values.global.api.users.credSecret) (not .Values.global.api.users.icingaweb.password.secretKey)}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: api.icingaweb
+data:
+  icingaweb_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}
+---
+{{- if or (and (not .Values.global.databases.director.username) (not .Values.global.databases.director.credSecret) (not .Values.global.databases.director.username.secretKey))
+(and (not .Values.global.databases.director.password) (not .Values.global.databases.director.credSecret) (not .Values.global.databases.director.password.secretKey))}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: database.director
+data:
+  director_username: {{ "director" | b64enc }}
+  director_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}
+---
+{{- if or (and (not .Values.global.databases.icingaweb2.username) (not .Values.global.databases.icingaweb2.credSecret) (not .Values.global.databases.icingaweb2.username.secretKey)) 
+(and (not .Values.global.databases.icingaweb2.password) (not .Values.global.databases.icingaweb2.credSecret) (not .Values.global.databases.icingaweb2.password.secretKey))}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: database.icingaweb2
+data:
+  icingaweb2_username: {{ "icingaweb2db" | b64enc }}
+  icingaweb2_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}
+---
+{{- if or (and (not .Values.global.databases.icingadb.username) (not .Values.global.databases.icingadb.credSecret) (not .Values.global.databases.icingadb.username.secretKey)) 
+(and (not .Values.global.databases.icingadb.password) (not .Values.global.databases.icingadb.credSecret) (not .Values.global.databases.icingadb.password.secretKey))}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: database.icingadb
+data:
+  icingadb_username: {{ "icingadb" | b64enc }}
+  icingadb_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}
+---
+{{- if or (and (not .Values.global.databases.kubernetes.username) (not .Values.global.databases.kubernetes.credSecret) (not .Values.global.databases.kubernetes.username.secretKey)) 
+(and (not .Values.global.databases.kubernetes.password) (not .Values.global.databases.kubernetes.credSecret) (not .Values.global.databases.kubernetes.password.secretKey))}}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: database.kubernetes
+data:
+  kubernetes_username: {{ "kubernetes" | b64enc }}
+  kubernetes_password: {{ randAlphaNum 32 | b64enc }}
+type: Opaque
+{{- end}}