concourse: move vault auth param to secret (#8094)

vault auth params are sensitive credentials and should be treated as
secret

This returns auth params functionality closer to concourse chart v1.16.1,
but it is a breaking change compared to that version

Signed-off-by: Chris Hiestand <chrishiestand@gmail.com>

stable/concourse/Chart.yaml

@@ -1,5 +1,5 @@
 name: concourse
-version: 2.2.0
+version: 3.0.0
 appVersion: 4.2.1
 description: Concourse is a simple and scalable CI system.
 icon: https://avatars1.githubusercontent.com/u/7809479

stable/concourse/README.md

@@ -151,6 +151,7 @@ The following table lists the configurable parameters of the Concourse chart and
 | `secrets.vaultClientCert` | Vault Client Certificate | `nil` |
 | `secrets.vaultClientKey` | Vault Client Key | `nil` |
 | `secrets.vaultClientToken` | Vault periodic client token | `nil` |
+| `secrets.vaultAuthParam` | Paramter to pass when logging in via the backend | `nil` |
 | `secrets.influxdbPassword` | Password used to authenticate with influxdb | `nil` |
 | `secrets.syslogCaCert` | SSL certificate to verify Syslog server | `nil` |
 

stable/concourse/templates/secrets.yaml

@@ -61,6 +61,7 @@ data:
   vault-client-token: {{ default "" .Values.secrets.vaultClientToken | b64enc | quote }}
   vault-client-cert: {{ default "" .Values.secrets.vaultClientCert | b64enc | quote }}
   vault-client-key: {{ default "" .Values.secrets.vaultClientKey | b64enc | quote }}
+  vault-client-auth-param: {{ default "" .Values.secrets.vaultAuthParam | b64enc | quote }}
   {{- end }}
   {{- if .Values.concourse.web.awsSsm.enabled }}
   aws-ssm-access-key: {{ default "" .Values.secrets.awsSsmAccessKey | b64enc | quote }}

stable/concourse/templates/web-deployment.yaml

@@ -303,14 +303,16 @@ spec:
               value: {{ .Values.concourse.web.vault.pathPrefix | quote }}
             - name: CONCOURSE_VAULT_AUTH_BACKEND
               value: {{ .Values.concourse.web.vault.authBackend | quote }}
+            {{- if .Values.concourse.web.vault.useCaCert }}
+            - name: CONCOURSE_VAULT_CA_CERT
+              value: "/concourse-vault/ca.cert"
+            {{- end }}
+            {{- if eq (default "" .Values.concourse.web.vault.authBackend) "token" }}
             - name: CONCOURSE_VAULT_CLIENT_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: {{ template "concourse.concourse.fullname" . }}
                   key: vault-client-token
-            {{- if .Values.concourse.web.vault.useCaCert }}
-            - name: CONCOURSE_VAULT_CA_CERT
-              value: "/concourse-vault/ca.cert"
             {{- end }}
             {{- if eq (default "" .Values.concourse.web.vault.authBackend) "cert" }}
             - name: CONCOURSE_VAULT_CLIENT_CERT
@@ -318,14 +320,17 @@ spec:
             - name: CONCOURSE_VAULT_CLIENT_KEY
               value: "/concourse-vault/client.key"
             {{- end }}
+            {{- if eq (default "" .Values.concourse.web.vault.authBackend) "approle" }}
+            - name: CONCOURSE_VAULT_AUTH_PARAM
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "concourse.concourse.fullname" . }}
+                  key: vault-client-auth-param
+            {{- end }}
             {{- if .Values.concourse.web.vault.authBackendMaxTtl }}
             - name: CONCOURSE_VAULT_AUTH_BACKEND_MAX_TTL
               value: {{ .Values.concourse.web.vault.authBackendMaxTtl | quote }}
             {{- end }}
-            {{- if .Values.concourse.web.vault.authParam }}
-            - name: CONCOURSE_VAULT_AUTH_PARAM
-              value: {{ .Values.concourse.web.vault.authParam | quote }}
-            {{- end }}
             {{- if .Values.concourse.web.vault.cache }}
             - name: CONCOURSE_VAULT_CACHE
               value: {{ .Values.concourse.web.vault.cache | quote }}

stable/concourse/values.yaml

@@ -196,8 +196,6 @@ concourse:
       retryMax: 5m
       ## The initial time between retries when logging in or reAuthing a secret.
       retryInitial: 1s
-      ## Paramter to pass when logging in via the backend. Can be specified multiple times.
-      # authParam: id=foo,secret_id=bar
     ## Don't actually do any automatic scheduling or checking.
     # noop:
     staticWorker:
@@ -1158,6 +1156,14 @@ secrets:
   ##
   # vaultClientToken:
 
+  ## vault authentication parameters
+  ## Paramter to pass when logging in via the backend
+  ## Required for "approle" authenication method
+  ## e.g. "role_id=x,secret_id=x"
+  ## ref: https://concourse-ci.org/creds.html#vault-auth-param=NAME=VALUE
+  ##
+  # vaultAuthParam:
+
   ## provide the client certificate for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend
   ## the value will be written to /concourse-vault/client.cert
   ## make sure to also set credentialManager.vault.authBackend to `cert`