Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Always renew sk-api token creation credentials #330

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Always renew sk-api token creation credentials #330

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a8f169a
set restartPolicy for sk-api initContainer
pascal-meunier Dec 2, 2023
9c4830a
Loop until success in renew-sk-secret-script
pascal-meunier Dec 6, 2023
a90cd40
restore export statements in renew-sk-secret-script
pascal-meunier Dec 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions playbooks/roles/security/templates/kube/api/api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
{% if security_renew_sk_script == true %}
initContainers:
- name: renew-sk-secret
# restartPolicy requires Kubernetes >= 1.28
restartPolicy: Always
command: ["/tmp/renew-sk-secret-script"]
#command: ["sleep","3600"]
image: {{ security_skadminutil_image }}
Expand Down
45 changes: 41 additions & 4 deletions playbooks/roles/skadmin/templates/kube/renew-sk-secret/renew-sk-secret-script
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,46 @@
export KUBE_TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token`
export KUBE_NAMESPACE=`cat /var/run/secrets/kubernetes.io/serviceaccount/namespace`

VAULT_SECRETID=`curl -s -X POST -H "X-Vault-Token: $VAULT_TOKEN" {{skadmin_vault_url}}/v1/auth/approle/role/sk/secret-id | jq -r .data.secret_id`
VAULT_ROLEID=`curl -s -X GET -H "X-Vault-Token: $VAULT_TOKEN" {{skadmin_vault_url}}/v1/auth/approle/role/sk/role-id | jq -r .data.role_id`
while :
do
VAULT_SECRETID=`curl -s -X POST -H "X-Vault-Token: $VAULT_TOKEN" http://vault:8200/v1/auth/approle/role/sk/secret-id | jq -r .data.secret_id`
if [ $? -ne 0 ]; then
echo "jq filtering of VAULT_SECRETID failed"
sleep 10
continue
fi
VAULT_ROLEID=`curl -s -X GET -H "X-Vault-Token: $VAULT_TOKEN" http://vault:8200/v1/auth/approle/role/sk/role-id | jq -r .data.role_id`
if [ $? -ne 0 ]; then
echo "jq filtering of VAULT_ROLEID failed"
sleep 10
continue
fi

kubectl delete secret tapis-sk-vault-secrets
kubectl create secret generic tapis-sk-vault-secrets --from-literal=vault-secretid=$VAULT_SECRETID --from-literal=vault-roleid=$VAULT_ROLEID
# no error but no secret_id either? If so curl must have failed
if [ "x${VAULT_SECRETID}" == "xnull" ] || [ "x${VAULT_SECRETID}" == "x" ]; then
echo "bad secret_id"
sleep 10
continue
fi

# no error but no role_id either? If so curl must have failed
if [ "x${VAULT_ROLEID}" == "xnull" ] || [ "x${VAULT_ROLEID}" == "x" ]; then
echo "bad role_id"
sleep 10
continue
fi

# replace kubernetes secret
kubectl delete secret tapis-sk-vault-secrets
# ignore error if secret didn't exist

kubectl create secret generic tapis-sk-vault-secrets --from-literal=vault-secretid=$VAULT_SECRETID --from-literal=vault-roleid=$VAULT_ROLEID
if [ $? -ne 0 ]; then
echo "creating secret failed"
sleep 10
continue
fi

# getting here means we successfully replaced the secret with a well-formed one, so we're done
break
done