3d6f3088a3
This change creates a pre-delete hook to clean out all entries in the credential table of the keystone database when the keystone service is deleted. Note that these are not the typical username/password.[0] This fixes the issue of leftover credential blobs being saved in the database that are unable to be decrypted since the original encryption keys are removed upon deletion of the keystone service [0] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/newton/credential-encryption.html Change-Id: I8adf0878af2f3b880e9194a6cb8d97b58d6895a5
105 lines
4.2 KiB
YAML
105 lines
4.2 KiB
YAML
{{/*
|
|
Copyright 2019 The Openstack-Helm Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.job_credential_cleanup }}
|
|
{{- $envAll := index . -}}
|
|
|
|
{{- $serviceName := "keystone" -}}
|
|
{{- $nodeSelector := index . "nodeSelector" | default ( dict $envAll.Values.labels.job.node_selector_key $envAll.Values.labels.job.node_selector_value ) -}}
|
|
{{- $configMapBin := "keystone-bin" -}}
|
|
{{- $configMapEtc := "keystone-etc" -}}
|
|
{{- $dbToClean := index . "dbToClean" | default ( dict "adminSecret" $envAll.Values.secrets.oslo_db.admin "configFile" (printf "/etc/%s/%s.conf" $serviceName $serviceName ) "logConfigFile" (printf "/etc/%s/logging.conf" $serviceName ) "configDbSection" "database" "configDbKey" "connection" ) -}}
|
|
|
|
{{ tuple $envAll "credential_cleanup" $serviceName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
|
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "keystone-credential-cleanup"
|
|
annotations:
|
|
"helm.sh/hook": pre-delete
|
|
"helm.sh/hook-delete-policy": hook-succeed
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{ tuple $envAll $serviceName "credential-cleanup" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
|
spec:
|
|
serviceAccountName: {{ $serviceName }}
|
|
restartPolicy: OnFailure
|
|
nodeSelector:
|
|
{{ toYaml $nodeSelector | indent 8 }}
|
|
initContainers:
|
|
{{ tuple $envAll "credential_cleanup" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
|
containers:
|
|
{{ $dbToCleanType := default "oslo" $dbToClean.inputType }}
|
|
- name: {{ printf "%s-%s" $serviceName "credential-cleanup" | quote }}
|
|
image: {{ $envAll.Values.images.tags.keystone_credential_cleanup }}
|
|
imagePullPolicy: {{ $envAll.Values.images.pull_policy }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.jobs.db_drop | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
env:
|
|
- name: ROOT_DB_CONNECTION
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $dbToClean.adminSecret | quote }}
|
|
key: DB_CONNECTION
|
|
{{- if eq $dbToCleanType "oslo" }}
|
|
- name: OPENSTACK_CONFIG_FILE
|
|
value: {{ $dbToClean.configFile | quote }}
|
|
- name: OPENSTACK_CONFIG_DB_SECTION
|
|
value: {{ $dbToClean.configDbSection | quote }}
|
|
- name: OPENSTACK_CONFIG_DB_KEY
|
|
value: {{ $dbToClean.configDbKey | quote }}
|
|
{{- end }}
|
|
command:
|
|
- python
|
|
- /tmp/cred-clean.py
|
|
volumeMounts:
|
|
- name: cred-clean-sh
|
|
mountPath: /tmp/cred-clean.py
|
|
subPath: cred-clean.py
|
|
readOnly: true
|
|
{{- if eq $dbToCleanType "oslo" }}
|
|
- name: etc-service
|
|
mountPath: {{ dir $dbToClean.configFile | quote }}
|
|
- name: cred-clean-conf
|
|
mountPath: {{ $dbToClean.configFile | quote }}
|
|
subPath: {{ base $dbToClean.configFile | quote }}
|
|
readOnly: true
|
|
- name: cred-clean-conf
|
|
mountPath: {{ $dbToClean.logConfigFile | quote }}
|
|
subPath: {{ base $dbToClean.logConfigFile | quote }}
|
|
readOnly: true
|
|
{{- end }}
|
|
volumes:
|
|
- name: cred-clean-sh
|
|
configMap:
|
|
name: "keystone-bin"
|
|
defaultMode: 0555
|
|
{{- $local := dict "configMapBinFirst" true -}}
|
|
{{- $dbToCleanType := default "oslo" $dbToClean.inputType }}
|
|
{{- if and (eq $dbToCleanType "oslo") $local.configMapBinFirst }}
|
|
{{- $_ := set $local "configMapBinFirst" false }}
|
|
- name: etc-service
|
|
emptyDir: {}
|
|
- name: cred-clean-conf
|
|
secret:
|
|
secretName: "keystone-etc"
|
|
defaultMode: 0444
|
|
{{- end -}}
|
|
{{- end -}}
|