From ee98b028d716e9964bd88ece19295a7cb1ced058 Mon Sep 17 00:00:00 2001 From: Thomas Lovett Date: Thu, 20 Jun 2019 11:26:50 -0500 Subject: [PATCH] feat(stable/prometheus-mysql-exporter): store MySQL password in a k8s Secret (#14712) The DATA_SOURCE_NAME environment variable contains a secret key for authenticating to th MySQL instance (.Values.mysql.pass). This secret should be stored in a K8s Secret object rather than directly on the Deployment. Kubernetes RBAC requires more elevated permissions for viewing Secret data than for viewing Deployment configuration. Signed-off-by: Thomas Lovett --- stable/prometheus-mysql-exporter/Chart.yaml | 2 +- stable/prometheus-mysql-exporter/templates/deployment.yaml | 6 +++--- stable/prometheus-mysql-exporter/templates/secret-env.yaml | 7 +++++++ 3 files changed, 11 insertions(+), 4 deletions(-) create mode 100644 stable/prometheus-mysql-exporter/templates/secret-env.yaml diff --git a/stable/prometheus-mysql-exporter/Chart.yaml b/stable/prometheus-mysql-exporter/Chart.yaml index eee90d8fdc..f6627178d6 100644 --- a/stable/prometheus-mysql-exporter/Chart.yaml +++ b/stable/prometheus-mysql-exporter/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for prometheus mysql exporter with cloudsqlproxy name: prometheus-mysql-exporter -version: 0.3.4 +version: 0.4.0 home: https://github.com/prometheus/mysqld_exporter appVersion: v0.11.0 sources: diff --git a/stable/prometheus-mysql-exporter/templates/deployment.yaml b/stable/prometheus-mysql-exporter/templates/deployment.yaml index 5b163b1dd7..3639220146 100644 --- a/stable/prometheus-mysql-exporter/templates/deployment.yaml +++ b/stable/prometheus-mysql-exporter/templates/deployment.yaml @@ -48,9 +48,9 @@ spec: {{- end }} ] {{- end }} - env: - - name: DATA_SOURCE_NAME - value: "{{ .Values.mysql.user }}:{{ .Values.mysql.pass }}@{{ if .Values.mysql.protocol }}{{ .Values.mysql.protocol }}{{ end }}({{ .Values.mysql.host }}:{{ .Values.mysql.port }})/{{ if .Values.mysql.db }}{{ .Values.mysql.db }}{{ end }}{{ if .Values.mysql.param }}?{{ .Values.mysql.param }}{{ end }}" + envFrom: + - secretRef: + name: {{ template "prometheus-mysql-exporter.fullname" . }} ports: - containerPort: {{ .Values.service.internalPort }} livenessProbe: diff --git a/stable/prometheus-mysql-exporter/templates/secret-env.yaml b/stable/prometheus-mysql-exporter/templates/secret-env.yaml new file mode 100644 index 0000000000..bd3914937b --- /dev/null +++ b/stable/prometheus-mysql-exporter/templates/secret-env.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "prometheus-mysql-exporter.fullname" . }} +type: Opaque +stringData: + DATA_SOURCE_NAME: "{{ .Values.mysql.user }}:{{ .Values.mysql.pass }}@{{ if .Values.mysql.protocol }}{{ .Values.mysql.protocol }}{{ end }}({{ .Values.mysql.host }}:{{ .Values.mysql.port }})/{{ if .Values.mysql.db }}{{ .Values.mysql.db }}{{ end }}{{ if .Values.mysql.param }}?{{ .Values.mysql.param }}{{ end }}"