Skip to content

Commit 3c210bf

Browse files
ryan0x44ryan0x44
committed
Configure local fakevault during components bootstrap
Signed-off-by: Ryan Djurovich <git@ryan0x44.com>
1 parent 27d8c7a commit 3c210bf

5 files changed

Lines changed: 62 additions & 3 deletions

File tree

‎Makefile‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,20 +143,23 @@ _local-bootstrap:
143143
PLATFORM_GIT_CA_CERT_FILE="$$(printf '%s' "$$status_json" | jq -r '.local_server.ca_cert_file // empty')"; \
144144
CLUSTER_ID="$$(printf '%s' "$$status_json" | jq -r '.cluster_id // empty')"; \
145145
LOCAL_VM_PROVIDER="$$(printf '%s' "$$status_json" | jq -r '.vm.provider // empty')"; \
146+
LOCAL_VM_NODE_IP="$$(printf '%s' "$$status_json" | jq -r '.vm.node_ip // empty')"; \
146147
LOCAL_SERVER_HTTP_PORT="$$(printf '%s' "$$status_json" | jq -r '.local_server.http_port // empty')"; \
147148
LOCAL_SERVER_HTTPS_PORT="$$(printf '%s' "$$status_json" | jq -r '.local_server.https_port // empty')"; \
148149
if [ -z "$$PLATFORM_GIT_REPOSITORY_URL" ] || [ -z "$$PLATFORM_GIT_REPOSITORY_BRANCH" ] || [ -z "$$PLATFORM_GIT_SECRET_REF_NAME" ] || [ -z "$$PLATFORM_GIT_CA_CERT_FILE" ]; then \
149150
echo "Error: podplane local status --json did not return local Git URL, branch, secretRef, and CA file." >&2; \
150151
exit 1; \
151152
fi; \
152-
if [ -z "$$CLUSTER_ID" ] || [ -z "$$LOCAL_VM_PROVIDER" ] || [ -z "$$LOCAL_SERVER_HTTP_PORT" ] || [ -z "$$LOCAL_SERVER_HTTPS_PORT" ]; then \
153-
echo "Error: podplane local status --json did not return cluster ID, VM provider, and local server ports." >&2; \
153+
if [ -z "$$CLUSTER_ID" ] || [ -z "$$LOCAL_VM_PROVIDER" ] || [ -z "$$LOCAL_VM_NODE_IP" ] || [ -z "$$LOCAL_SERVER_HTTP_PORT" ] || [ -z "$$LOCAL_SERVER_HTTPS_PORT" ]; then \
154+
echo "Error: podplane local status --json did not return cluster ID, VM provider, VM node IP, and local server ports." >&2; \
154155
exit 1; \
155156
fi; \
156157
case "$$LOCAL_VM_PROVIDER" in \
157158
qemu) LOCAL_SERVER_HOST_FROM_VM=10.0.2.2 ;; \
158159
*) echo "Error: unsupported local VM provider '$$LOCAL_VM_PROVIDER' for local components bootstrap." >&2; exit 1 ;; \
159160
esac; \
161+
: "$${LOCAL_FAKEVAULT_ADDRESS:=https://$$LOCAL_VM_NODE_IP:19443/vault/$$CLUSTER_ID}"; \
162+
: "$${LOCAL_FAKEVAULT_CA_CERT_FILE:=$$PLATFORM_GIT_CA_CERT_FILE}"; \
160163
: "$${OIDC_ISSUER:=https://oidc.localhost:$$LOCAL_SERVER_HTTPS_PORT/oidc}"; \
161164
: "$${OIDC_AUDIENCE:=$$CLUSTER_ID}"; \
162165
: "$${REGISTRY_HOSTNAME:=$$CLUSTER_ID-registry.local}"; \
@@ -167,7 +170,7 @@ _local-bootstrap:
167170
: "$${REGISTRY_SECRET_ACCESS_KEY:=test}"; \
168171
: "$${AWS_S3_USE_PATH_STYLE:=true}"; \
169172
export PLATFORM_GIT_REPOSITORY_URL PLATFORM_GIT_REPOSITORY_BRANCH PLATFORM_GIT_SECRET_REF_NAME PLATFORM_GIT_CA_CERT_FILE; \
170-
export CLUSTER_ID OIDC_ISSUER OIDC_AUDIENCE REGISTRY_HOSTNAME REGISTRY_BUCKET REGISTRY_REGION REGISTRY_ENDPOINT REGISTRY_ACCESS_KEY_ID REGISTRY_SECRET_ACCESS_KEY AWS_S3_USE_PATH_STYLE; \
173+
export CLUSTER_ID LOCAL_FAKEVAULT_ADDRESS LOCAL_FAKEVAULT_CA_CERT_FILE OIDC_ISSUER OIDC_AUDIENCE REGISTRY_HOSTNAME REGISTRY_BUCKET REGISTRY_REGION REGISTRY_ENDPOINT REGISTRY_ACCESS_KEY_ID REGISTRY_SECRET_ACCESS_KEY AWS_S3_USE_PATH_STYLE; \
171174
DOMAIN="$${DOMAIN:-default.localhost}" PLATFORM_INSTALL=$(PLATFORM_INSTALL) ./bootstrap/apply.sh
172175

173176
git-sync: ## Snapshot this checkout into the Podplane Git cache as components.git local-dev

‎bootstrap/apply.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,16 @@ set_bootstrap_args bootstrap.oidc.issuer "${OIDC_ISSUER:-}"
7979
set_bootstrap_args bootstrap.oidc.audience "${OIDC_AUDIENCE:-${CLUSTER_ID:-}}"
8080
set_bootstrap_args bootstrap.oidc.usernameClaim "${OIDC_USERNAME_CLAIM:-}"
8181
set_bootstrap_args bootstrap.oidc.groupsClaim "${OIDC_GROUPS_CLAIM:-}"
82+
set_bootstrap_args bootstrap.secrets.localFakeVault.address "${LOCAL_FAKEVAULT_ADDRESS:-}"
83+
84+
if [[ -n "${LOCAL_FAKEVAULT_CA_CERT_FILE:-}" ]]; then
85+
if [[ ! -f "${LOCAL_FAKEVAULT_CA_CERT_FILE}" ]]; then
86+
echo "Error: LOCAL_FAKEVAULT_CA_CERT_FILE does not exist: ${LOCAL_FAKEVAULT_CA_CERT_FILE}" >&2
87+
exit 1
88+
fi
89+
local_fakevault_ca_b64=$(base64 <"${LOCAL_FAKEVAULT_CA_CERT_FILE}" | tr -d '\n')
90+
set_bootstrap_args bootstrap.secrets.localFakeVault.caCert "${local_fakevault_ca_b64}"
91+
fi
8292

8393
if [[ -n "${PLATFORM_GIT_CA_CERT_FILE:-}" ]]; then
8494
if [[ ! -f "${PLATFORM_GIT_CA_CERT_FILE}" ]]; then

‎bootstrap/templates/flux-helmrelease.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,27 @@ spec:
5656
clientID: {{ .Values.bootstrap.oidc.audience | default .Values.bootstrap.clusterID | quote }}
5757
usernameClaim: {{ .Values.bootstrap.oidc.usernameClaim | quote }}
5858
groupsClaim: {{ .Values.bootstrap.oidc.groupsClaim | quote }}
59+
{{- if .Values.bootstrap.secrets.localFakeVault.address }}
60+
secrets:
61+
providers:
62+
local-fakevault:
63+
kind: openbao
64+
address: {{ .Values.bootstrap.secrets.localFakeVault.address | quote }}
65+
mountPath: secret
66+
{{- if .Values.bootstrap.secrets.localFakeVault.caCert }}
67+
caCert: {{ .Values.bootstrap.secrets.localFakeVault.caCert | b64dec | quote }}
68+
{{- end }}
69+
secrets-store-csi-provider-openbao:
70+
podplane:
71+
secrets:
72+
providers:
73+
local-fakevault:
74+
{{- if .Values.bootstrap.secrets.localFakeVault.caCert }}
75+
caCert: {{ .Values.bootstrap.secrets.localFakeVault.caCert | b64dec | quote }}
76+
{{- else }}
77+
caCert: ""
78+
{{- end }}
79+
{{- end }}
5980
zot-registry:
6081
platform:
6182
zotRegistry:

‎bootstrap/values.schema.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,27 @@
6767
},
6868
"required": ["issuer", "audience", "usernameClaim", "groupsClaim"]
6969
},
70+
"secrets": {
71+
"type": "object",
72+
"additionalProperties": false,
73+
"properties": {
74+
"localFakeVault": {
75+
"type": "object",
76+
"additionalProperties": false,
77+
"properties": {
78+
"address": {
79+
"type": "string"
80+
},
81+
"caCert": {
82+
"type": "string",
83+
"description": "Base64-encoded CA certificate PEM"
84+
}
85+
},
86+
"required": ["address", "caCert"]
87+
}
88+
},
89+
"required": ["localFakeVault"]
90+
},
7091
"flux": {
7192
"type": "object",
7293
"additionalProperties": false,

‎bootstrap/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ bootstrap:
2626
audience: ""
2727
usernameClaim: email
2828
groupsClaim: groups
29+
secrets:
30+
localFakeVault:
31+
address: ""
32+
caCert: "" # Base64-encoded CA certificate PEM
2933
flux:
3034
git:
3135
url: https://github.com/podplane/components.git

0 commit comments

Comments
 (0)