From e8b86357800bf7afdf01eef5af5caea10e3ce5ca Mon Sep 17 00:00:00 2001 From: JP Phillips Date: Mon, 27 Nov 2017 13:57:40 -0600 Subject: [PATCH] [stable/concourse] provide configuration(s) for integrating Concourse with Vault (#2446) * provide configuration(s) for integrating Concourse with Vault enabled configuring Concourse to use Vault for managing secrets, exposes 3 types of Auth Backends: tokens, approle, and TLS * provide configuration(s) for integrating Concourse with Vault enabled configuring Concourse to use Vault for managing secrets, exposes 3 types of Auth Backends: tokens, approle, and TLS --- stable/concourse/Chart.yaml | 2 +- stable/concourse/README.md | 36 ++++++++++ stable/concourse/templates/configmap.yaml | 6 +- stable/concourse/templates/secrets.yaml | 8 +++ .../concourse/templates/web-deployment.yaml | 70 +++++++++++++++++++ stable/concourse/values.yaml | 54 ++++++++++++++ 6 files changed, 174 insertions(+), 2 deletions(-) diff --git a/stable/concourse/Chart.yaml b/stable/concourse/Chart.yaml index 2c95c29616..b31edaab43 100644 --- a/stable/concourse/Chart.yaml +++ b/stable/concourse/Chart.yaml @@ -1,5 +1,5 @@ name: concourse -version: 0.9.0 +version: 0.10.0 appVersion: 3.6.0 description: Concourse is a simple and scalable CI system. icon: https://avatars1.githubusercontent.com/u/7809479 diff --git a/stable/concourse/README.md b/stable/concourse/README.md index 4e1bda9744..698880f3b8 100644 --- a/stable/concourse/README.md +++ b/stable/concourse/README.md @@ -137,6 +137,16 @@ The following tables lists the configurable parameters of the Concourse chart an | `postgresql.postgresPassword` | PostgreSQL Password for the new user | `concourse` | | `postgresql.postgresDatabase` | PostgreSQL Database to create | `concourse` | | `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` | +| `credentialManager.enabled` | Enable Credential Manager | `false` | +| `credentialManager.vault.url` | Vault Server URL | `nil` | +| `credentialManager.vault.pathPrefix` | Vault path to namespace secrets | `/concourse` | +| `credentialManager.vault.caCert` | CA public certificate when using self-signed TLS with Vault | `nil` | +| `credentialManager.vault.authBackend` | Vault Authentication Backend to use, leave blank when using clientToken | `nil` | +| `credentialManager.vault.clientToken` | Vault periodic client token | `nil` | +| `credentialManager.vault.appRoleId` | Vault AppRole RoleID | `nil` | +| `credentialManager.vault.appRoleSecretId` | Vault AppRole SecretID | `nil` | +| `credentialManager.vault.clientCert` | Vault Client Certificate | `nil` | +| `credentialManager.vault.clientKey` | Vault Client Key | `nil` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. @@ -290,3 +300,29 @@ postgresql: uri: postgres://concourse:changeme@my-postgres.com:5432/concourse?sslmode=require ``` + +### Credential Management + +By default, this chart will not use a [Credential Manager](https://concourse.ci/creds.html). + +```yaml +## Configuration values for the Credential Manager. +## ref: https://concourse.ci/creds.html +## +credentialManager: + ## Enable Credential Manager using below configuration. + ## + enabled: true + + ## use Hashicorp Vault for Credential Manager. + ## + vault: + ## URL pointing to vault addr (i.e. http://vault:8200). + ## + url: http://vault:8200 + + ## initial periodic token issued for concourse + ## ref: https://www.vaultproject.io/docs/concepts/tokens.html#periodic-tokens + ## + clientToken: PERIODIC_VAULT_TOKEN +``` diff --git a/stable/concourse/templates/configmap.yaml b/stable/concourse/templates/configmap.yaml index 1eb64a345f..658be36705 100644 --- a/stable/concourse/templates/configmap.yaml +++ b/stable/concourse/templates/configmap.yaml @@ -39,4 +39,8 @@ data: generic-oauth-token-url: {{ default "" .Values.concourse.genericOauthTokenUrl | quote }} worker-post-stop-delay-seconds: {{ .Values.worker.postStopDelaySeconds | quote }} worker-fatal-errors: {{ default "" .Values.worker.fatalErrors | quote }} - \ No newline at end of file + {{ if .Values.credentialManager.vault }} + vault-url: {{ default "" .Values.credentialManager.vault.url | quote }} + vault-path-prefix: {{ default "/concourse" .Values.credentialManager.vault.pathPrefix | quote }} + vault-auth-backend: {{ default "" .Values.credentialManager.vault.authBackend | quote }} + {{ end }} diff --git a/stable/concourse/templates/secrets.yaml b/stable/concourse/templates/secrets.yaml index 1b74595eb4..4d4101841f 100644 --- a/stable/concourse/templates/secrets.yaml +++ b/stable/concourse/templates/secrets.yaml @@ -29,3 +29,11 @@ data: generic-oauth-client-secret: {{ default "" .Values.concourse.genericOauthClientSecret | b64enc | quote }} encryption-key: {{ default "" .Values.concourse.encryptionKey | b64enc | quote }} old-encryption-key: {{ default "" .Values.concourse.oldEncryptionKey | b64enc | quote }} + {{ if .Values.credentialManager.vault }} + vault-ca-cert: {{ default "" .Values.credentialManager.vault.caCert | b64enc | quote }} + vault-client-token: {{ default "" .Values.credentialManager.vault.clientToken | b64enc | quote }} + vault-approle-id: {{ default "" .Values.credentialManager.vault.appRoleId | b64enc | quote }} + vault-approle-secret-id: {{ default "" .Values.credentialManager.vault.appRoleSecretId | b64enc | quote }} + vault-client-cert: {{ default "" .Values.credentialManager.vault.clientCert | b64enc | quote }} + vault-client-key: {{ default "" .Values.credentialManager.vault.clientKey | b64enc | quote }} + {{ end }} diff --git a/stable/concourse/templates/web-deployment.yaml b/stable/concourse/templates/web-deployment.yaml index 92e2e336dd..b758422322 100644 --- a/stable/concourse/templates/web-deployment.yaml +++ b/stable/concourse/templates/web-deployment.yaml @@ -22,6 +22,14 @@ spec: imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }} args: - "web" + {{- if .Values.credentialManager.enabled }} + {{- if default "" .Values.credentialManager.vault.appRoleId }} + - "--vault-auth-param" + - "role_id=${CONCOURSE_VAULT_APPROLE_ID}" + - "--vault-auth-param" + - "secret_id=${CONCOURSE_VAULT_APPROLE_SECRET_ID}" + {{- end }} + {{- end }} env: {{ if .Values.postgresql.enabled }} - name: POSTGRES_HOST @@ -244,6 +252,50 @@ spec: value: "/concourse-keys/session_signing_key" - name: CONCOURSE_TSA_AUTHORIZED_KEYS value: "/concourse-keys/worker_key.pub" + {{- if .Values.credentialManager.enabled }} + - name: CONCOURSE_VAULT_URL + valueFrom: + configMapKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-url + - name: CONCOURSE_VAULT_PATH_PREFIX + valueFrom: + configMapKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-path-prefix + - name: CONCOURSE_VAULT_AUTH_BACKEND + valueFrom: + configMapKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-auth-backend + - name: CONCOURSE_VAULT_CLIENT_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-client-token + {{- if .Values.credentialManager.vault.caCert }} + - name: CONCOURSE_VAULT_CA_CERT + value: "/concourse-vault/ca.crt" + {{- end }} + {{- if .Values.credentialManager.vault.clientCert }} + - name: CONCOURSE_VAULT_CLIENT_CERT + value: "/concourse-vault/client.crt" + - name: CONCOURSE_VAULT_CLIENT_KEY + value: "/concourse-vault/client.key" + {{- end }} + {{- if .Values.credentialManager.vault.appRoleId }} + - name: CONCOURSE_VAULT_APPROLE_ID + valueFrom: + secretKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-approle-id + - name: CONCOURSE_VAULT_APPROLE_SECRET_ID + valueFrom: + secretKeyRef: + name: {{ template "concourse.concourse.fullname" . }} + key: vault-approle-secret-id + {{- end }} + {{- end }} ports: - name: atc containerPort: {{ .Values.concourse.atcPort }} @@ -267,6 +319,11 @@ spec: - name: concourse-keys mountPath: /concourse-keys readOnly: true + {{- if .Values.credentialManager.vault }} + - name: vault-keys + mountPath: /concourse-vault + readOnly: true + {{- end }} affinity: {{- if .Values.web.additionalAffinities }} {{ toYaml .Values.web.additionalAffinities | indent 8 }} @@ -283,3 +340,16 @@ spec: path: session_signing_key - key: worker-key-pub path: worker_key.pub + {{- if .Values.credentialManager.vault }} + - name: vault-keys + secret: + secretName: {{ template "concourse.concourse.fullname" . }} + defaultMode: 0400 + items: + - key: vault-ca-cert + path: ca.cert + - key: vault-client-cert + path: client.cert + - key: vault-client-key + path: client.key + {{- end }} diff --git a/stable/concourse/values.yaml b/stable/concourse/values.yaml index c8316e5081..978c4b7794 100644 --- a/stable/concourse/values.yaml +++ b/stable/concourse/values.yaml @@ -518,3 +518,57 @@ postgresql: ## Enable PostgreSQL persistence using Persistent Volume Claims. ## enabled: true + +## Configuration values for the Credential Manager. +## ref: https://concourse.ci/creds.html +## +credentialManager: + ## Enable Credential Manager using below configuration. + ## + enabled: false + + ## use Hashicorp Vault for Credential Manager. + ## + # vault: + ## URL pointing to vault addr (i.e. http://vault:8200). + ## + # url: + + ## vault path under which to namespace credential lookup, defaults to /concourse. + ## + # pathPrefix: + + ## if the Vault server is using a self-signed certificate, provide the CA public key. + ## the value will be written to /concourse-vault/ca.cert + ## + # caCert: |- + + ## vault authentication backend, leave this blank if using an intial periodic token + ## currently supported backends: token, approle, cert + ## + # authBackend: + + ## initial periodic token issued for concourse + ## ref: https://www.vaultproject.io/docs/concepts/tokens.html#periodic-tokens + ## + # clientToken: + + ## set role_id for [AppRole](https://www.vaultproject.io/docs/auth/approle.html) backend + ## make sure to also set authBackend to `approle`. + ## + # appRoleId: + + ## set secret_id for [AppRole](https://www.vaultproject.io/docs/auth/approle.html) backend + ## make sure to also set authBackend to `approle`. + ## + # appRoleSecretId: + + ## provide the client certificate for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend + ## the value will be written to /concourse-vault/client.cert + ## make sure to also set authBackend to `cert` + # clientCert: |- + + ## provide the client key for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend + ## the value will be written to /concourse-vault/client.key + ## make sure to also set authBackend to `cert` + # clientKey: |-