feat(helm): generate and keep OEG and FM encryption keys (7fedb4a9) · Commits · OOP / deploy / helm

oop-platform-chart/charts/federation-manager/templates/_helpers.tpl

+14 −0

Changes for oop-platform-chart/charts/federation-manager/templates/_helpers.tpl: 14 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -156,3 +156,17 @@ Namespace
		{{- define "federation-manager.db.waitImage" -}}
		{{- dig "images" "postgres" "postgres:18.6-alpine" (.Values.global \| default dict) -}}
		{{- end }}

		{{- define "federation-manager.encryptionKey.secretName" -}}
		{{- .Values.federationManager.encryptionKey.existingSecret \| default (printf "%s-keys" .Values.federationManager.name) -}}
		{{- end }}

		{{- define "federation-manager.keyValue" -}}
		{{- $existing := index . 0 -}}
		{{- $key := index . 1 -}}
		{{- if hasKey $existing $key -}}
		{{- index $existing $key -}}
		{{- else -}}
		{{- randBytes 32 \| replace "+" "-" \| replace "/" "_" \| b64enc -}}
		{{- end -}}
		{{- end }}

0 → 100644

+20 −0

Changes for oop-platform-chart/charts/federation-manager/templates/encryption-key-secret.yaml: 20 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		{{- $c := .Values.federationManager }}
		{{- if and $c.enabled (include "federation-manager.authEnabled" .) (not $c.encryptionKey.existingSecret) }}
		{{- $name := include "federation-manager.encryptionKey.secretName" . }}
		{{- $existing := (lookup "v1" "Secret" .Release.Namespace $name).data \| default dict }}
		apiVersion: v1
		kind: Secret
		metadata:
		name: {{ $name }}
		namespace: {{ include "federation-manager.namespace" . }}
		labels:
		{{- include "federation-manager.fm.labels" . \| nindent 4 }}
		annotations:
		helm.sh/resource-policy: keep
		{{- with .Values.commonAnnotations }}
		{{- toYaml . \| nindent 4 }}
		{{- end }}
		type: Opaque
		data:
		{{ $c.encryptionKey.key }}: {{ include "federation-manager.keyValue" (list $existing $c.encryptionKey.key) }}
		{{- end }}

+5 −0

Changes for oop-platform-chart/charts/federation-manager/templates/federation-manager-deployment.yaml: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -100,6 +100,11 @@ spec:
		value: {{ $c.bootstrapFederation \| toString \| quote }}
		- name: FM_ALLOW_INSECURE_PARTNER_ENDPOINTS
		value: {{ $c.allowInsecurePartnerEndpoints \| toString \| quote }}
		- name: FM_PARTNER_SECRET_KEY
		valueFrom:
		secretKeyRef:
		name: {{ include "federation-manager.encryptionKey.secretName" . }}
		key: {{ $c.encryptionKey.key }}
		- name: FM_LOG_LEVEL
		value: {{ $c.logLevel \| quote }}
		livenessProbe:

+4 −0

Changes for oop-platform-chart/charts/federation-manager/values.yaml: 4 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -56,6 +56,10 @@ federationManager:
		bootstrapFederation: false
		allowInsecurePartnerEndpoints: false

		encryptionKey:
		existingSecret: ""
		key: partner-secret-key

		partnerSecrets:
		existingSecret: ""
		mountPath: /run/secrets/partners

+14 −0

Changes for oop-platform-chart/charts/oeg/templates/_helpers.tpl: 14 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -110,3 +110,17 @@ Return the proper namespace
		{{- define "oeg.db.waitImage" -}}
		{{- dig "images" "postgres" "postgres:18.6-alpine" (.Values.global \| default dict) -}}
		{{- end }}

		{{- define "oeg.encryptionKey.secretName" -}}
		{{- .Values.oegcontroller.encryptionKey.existingSecret \| default (printf "%s-keys" .Values.oegcontroller.name) -}}
		{{- end }}

		{{- define "oeg.keyValue" -}}
		{{- $existing := index . 0 -}}
		{{- $key := index . 1 -}}
		{{- if hasKey $existing $key -}}
		{{- index $existing $key -}}
		{{- else -}}
		{{- randBytes 32 \| replace "+" "-" \| replace "/" "_" \| b64enc -}}
		{{- end -}}
		{{- end }}