[stable/mariadb] generate random password by default (#1262)

* [stable/mariadb] generate random password by default

- Updates MariaDB to generate a random password by default
- Adds a basic verification test to connect and authenticate with the
  MariaDB server

* randomly generate user password

* fix notes template

* add section on consuming credentials

* [stable/mariadb] Fix chart version

stable/mariadb/Chart.yaml

@@ -1,5 +1,5 @@
 name: mariadb
-version: 0.7.0
+version: 1.0.0
 description: Fast, reliable, scalable, and easy to use open-source relational database system. MariaDB Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software.
 keywords:
 - mariadb
@@ -11,6 +11,6 @@ icon: https://bitnami.com/assets/stacks/mariadb/img/mariadb-stack-220x234.png
 sources:
 - https://github.com/bitnami/bitnami-docker-mariadb
 maintainers:
-- name: Bitnami
+- name: bitnami-bot
   email: containers@bitnami.com
 engine: gotpl

stable/mariadb/README.md

@@ -46,10 +46,11 @@ The command removes all the Kubernetes components associated with the chart and
 The following tables lists the configurable parameters of the MariaDB chart and their default values.
 
 |          Parameter          |                Description                 |                   Default                   |
-|-----------------------------|--------------------------------------------|---------------------------------------------|
+| --------------------------- | ------------------------------------------ | ------------------------------------------- |
 | `image`                     | MariaDB image                              | `bitnami/mariadb:{VERSION}`                 |
 | `imagePullPolicy`           | Image pull policy.                         | `IfNotPresent`                              |
-| `mariadbRootPassword`       | Password for the `root` user.              | `nil`                                       |
+| `usePassword`               | Enable password authentication             | `true`                                      |
+| `mariadbRootPassword`       | Password for the `root` user.              | Randomly generated                          |
 | `mariadbUser`               | Username of new user to create.            | `nil`                                       |
 | `mariadbPassword`           | Password for the new user.                 | `nil`                                       |
 | `mariadbDatabase`           | Name for new database to create.           | `nil`                                       |
@@ -108,6 +109,32 @@ EOF
 helm install --name my-release -f mariadb-values.yaml stable/mariadb
 ```
 
+## Consuming credentials
+
+To connect to your database in your application, you can consume the credentials from the secret. For example:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: my-app
+spec:
+  containers:
+    - name: my-app
+      image: bitnami/mariadb:latest
+      env:
+        - name: MARIADB_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: my-release-mariadb
+              key: mariadb-root-password
+      command: ["sh", "-c"]
+      args:
+      - mysql -h my-release-mariadb.default.svc.cluster.local -p$MARIADB_ROOT_PASSWORD -e 'show databases;'
+  restartPolicy: Never
+
+```
+
 ## Persistence
 
 The [Bitnami MariaDB](https://github.com/bitnami/bitnami-docker-mariadb) image stores the MariaDB data and configurations at the `/bitnami/mariadb` path of the container.

stable/mariadb/templates/NOTES.txt

@@ -1,11 +1,23 @@
 MariaDB can be accessed via port 3306 on the following DNS name from within your cluster:
 {{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
 
+{{ if .Values.usePassword -}}
+To get the root password run:
+
+    MARIADB_ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.mariadb-root-password}" | base64 --decode)
+
+{{ if .Values.mariadbUser -}}
+To get the password for "{{ .Values.mariadbUser }}" run:
+
+    MARIADB_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.mariadb-password}" | base64 --decode)
+{{- end }}
+{{- end -}}
+
 To connect to your database:
 
 1. Run a pod that you can use as a client:
 
-    kubectl run {{ template "fullname" . }}-client --rm --tty -i --image bitnami/mariadb --command -- bash
+    kubectl run {{ template "fullname" . }}-client --rm --tty -i {{ if .Values.usePassword }}--env MARIADB_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD{{ end }} --image bitnami/mariadb --command -- bash
 
 2. Connect using the mysql cli, then provide your password:
-    $ mysql -h {{ template "fullname" . }} {{- if .Values.mariadbRootPassword }} -p {{ .Values.mariadbRootPassword }}{{- end -}}
+    mysql -h {{ template "fullname" . }} {{- if .Values.usePassword }} -p$MARIADB_ROOT_PASSWORD{{ end }}

stable/mariadb/templates/deployment.yaml

@@ -38,22 +38,27 @@ spec:
         image: "{{ .Values.image }}"
         imagePullPolicy: {{ .Values.imagePullPolicy | quote }}
         env:
+        {{- if .Values.usePassword }}
         - name: MARIADB_ROOT_PASSWORD
           valueFrom:
             secretKeyRef:
               name: {{ template "fullname" . }}
               key: mariadb-root-password
-        - name: MARIADB_USER
-          value: {{ default "" .Values.mariadbUser | quote }}
+        {{- if .Values.mariadbUser }}
         - name: MARIADB_PASSWORD
           valueFrom:
             secretKeyRef:
               name: {{ template "fullname" . }}
               key: mariadb-password
-        - name: MARIADB_DATABASE
-          value: {{ default "" .Values.mariadbDatabase | quote }}
+        {{- end }}
+        {{- else }}
         - name: ALLOW_EMPTY_PASSWORD
           value: "yes"
+        {{- end }}
+        - name: MARIADB_USER
+          value: {{ default "" .Values.mariadbUser | quote }}
+        - name: MARIADB_DATABASE
+          value: {{ default "" .Values.mariadbDatabase | quote }}
         ports:
         - name: mysql
           containerPort: 3306

stable/mariadb/templates/secrets.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.usePassword -}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -9,5 +10,14 @@ metadata:
     heritage: "{{ .Release.Service }}"
 type: Opaque
 data:
-  mariadb-root-password: {{ default "" .Values.mariadbRootPassword | b64enc | quote }}
-  mariadb-password: {{ default "" .Values.mariadbPassword | b64enc | quote }}
+  {{- if .Values.mariadbRootPassword }}
+  mariadb-root-password: {{ .Values.mariadbRootPassword | b64enc | quote }}
+  {{- else }}
+  mariadb-root-password: {{ randAlphaNum 10 | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.mariadbPassword }}
+  mariadb-password: {{ .Values.mariadbPassword | b64enc | quote }}
+  {{- else }}
+  mariadb-password: {{ randAlphaNum 10 | b64enc | quote }}
+  {{- end }}
+{{- end -}}

stable/mariadb/templates/test-runner.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ template "fullname" . }}-test-{{ randAlphaNum 5 | lower }}"
+  annotations:
+    "helm.sh/hook": test-success
+    "pod.beta.kubernetes.io/init-containers": '[
+      {
+        "name": "test-framework",
+        "image": "dduportal/bats:0.4.0",
+        "command": ["bash", "-c", "
+          set -ex\n
+          # copy bats to tools dir\n
+          cp -R /usr/local/libexec/ /tools/bats/\n
+        "],
+        "volumeMounts": [
+          {"name": "tools", "mountPath": "/tools"}
+        ]
+      }
+    ]'
+spec:
+  containers:
+    - name: mariadb-test
+      image: {{.Values.image}}
+      command: ["/tools/bats/bats", "-t", "/tests/run.sh"]
+      {{- if .Values.usePassword }}
+      env:
+        - name: MARIADB_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "fullname" . }}
+              key: mariadb-root-password
+      {{- end }}
+      volumeMounts:
+      - mountPath: /tests
+        name: tests
+        readOnly: true
+      - mountPath: /tools
+        name: tools
+  volumes:
+  - name: tests
+    configMap:
+      name: {{ template "fullname" . }}-tests
+  - name: tools
+    emptyDir: {}
+  restartPolicy: Never

stable/mariadb/templates/tests.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "fullname" . }}-tests
+data:
+  run.sh: |-
+    @test "Testing MariaDB is accessible" {
+      mysql -h {{ template "fullname" . }} {{- if .Values.usePassword }} -p$MARIADB_ROOT_PASSWORD{{ end }} -e 'show databases;'
+    }

stable/mariadb/values.yaml

@@ -9,12 +9,17 @@ image: bitnami/mariadb:10.1.23-r2
 ## ref: http://kubernetes.io/docs/user-guide/images/#updating-images
 imagePullPolicy: IfNotPresent
 
+## Use password authentication
+usePassword: true
+
 ## Specify password for root user
+## Defaults to a random 10-character alphanumeric string if not set and usePassword is true
 ## ref: https://github.com/bitnami/bitnami-docker-mariadb/blob/master/README.md#setting-the-root-password-on-first-run
 ##
 # mariadbRootPassword:
 
 ## Create a database user
+## Password defaults to a random 10-character alphanumeric string if not set and usePassword is true
 ## ref: https://github.com/bitnami/bitnami-docker-mariadb/blob/master/README.md#creating-a-database-user-on-first-run
 ##
 # mariadbUser:
@@ -34,7 +39,7 @@ serviceType: ClusterIP
 ##
 persistence:
   enabled: true
-  
+
   ## A manually managed Persistent Volume and Claim
   ## Requires persistence.enabled: true
   ## If defined, PVC must be created manually before volume will be bound