hoard symmetric & openpgp grant config (#11746)

Signed-off-by: Gregory Hill <greg.hill@monax.io>

stable/hoard/Chart.yaml

@@ -1,6 +1,6 @@
 name: hoard
-version: 0.6.2
-appVersion: 2.0.0
+version: 0.6.5
+appVersion: 3.0.0
 description: Hoard is a stateless, deterministically encrypted, content-addressed object store
 home: https://github.com/monax/hoard
 icon: https://pbs.twimg.com/profile_images/781959787856687105/76s1CJER_400x400.jpg

stable/hoard/README.md

@@ -32,14 +32,14 @@ The following table lists the configurable parameters of the Hoard chart and its
 | --------- | ----------- | ------- |
 | `replicaCount` | number of daemons | `1` |
 | `image.repository` | docker image | `"quay.io/monax/hoard"` |
-| `image.tag` | version | `"2.0.0"` |
+| `image.tag` | version | `"3.0.0"` |
 | `image.pullPolicy` | pull policy | `"IfNotPresent"` |
 | `storage.type` | backend object store (aws, azure, filesystem, gcp, ipfs)| `"filesystem"` |
 | `storage.remote` | remote api location (ipfs only) | `""` |
 | `storage.region` | object store location (cloud only) | `""` |
 | `storage.bucket` | object storage container (cloud only) | `""` |
 | `storage.prefix` | bucket folder (cloud only) | `""` |
-| `storage.credentialsSecret` | required secret for cloud providers | `""` |
+| `storage.secret` | required secret for cloud providers | `""` |
 | `persistence.size` | size of local store | `"10Gi"` |
 | `persistence.storageClass` | pvc type | `"standard"` |
 | `persistence.accessMode` | pvc access | `"ReadWriteOnce"` |
@@ -74,20 +74,28 @@ For each of the supported cloud back-ends, please ensure you have the appropriat
 
 ```bash
 kubectl create secret generic cloud-credentials --from-literal access-key-id=${AWS_ACCESS_KEY_ID} --from-literal secret-access-key=${AWS_SECRET_ACCESS_KEY}
-helm install --name my-release stable/hoard --set storage.type=aws,storage.region="eu-central-1",storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials"
+helm install --name my-release stable/hoard --set storage.type=aws,storage.region="eu-central-1",storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"
 ```
 
 ### [Azure](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-manage)
 
 ```bash
 kubectl create secret generic cloud-credentials --from-literal storage-account-name=${AZURE_STORAGE_ACCOUNT_NAME} --from-literal storage-account-key=${AZURE_STORAGE_ACCOUNT_KEY}
-helm install --name my-release stable/hoard --set storage.type=azure,storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials"
+helm install --name my-release stable/hoard --set storage.type=azure,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"
 ```
 
 ### [GCP](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
 
 ```bash
 kubectl create secret generic cloud-credentials --from-literal service-key=${GCLOUD_SERVICE_KEY}
-helm install --name my-release stable/hoard --set storage.type=gcp,storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials"
+helm install --name my-release stable/hoard --set storage.type=gcp,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"
 ```
 
+## OpenPGP Grants
+
+Once configured, hoard can share access to a secret file by encrypting it with the public key of the recipient:
+
+```
+kubectl create secret generic private-keyring --from-file ${GOPATH}/src/github.com/monax/hoard/grant/private.key.asc
+helm install --name my-release stable/hoard --set openpgp.id="10449759736975846181",openpgp.secret=private-keyring
+```

stable/hoard/templates/configmap.yaml

@@ -22,4 +22,22 @@ data:
 
     [Logging]
       LoggingType = "{{ .Values.logging.type }}"
-      Channels = [{{- range .Values.logging.channels }}{{ . | quote }},{{- end }}]
+      Channels = [{{- range .Values.logging.channels }}{{ . | quote }},{{- end }}]
+
+{{- if .Values.openpgp }}
+
+    [Secrets.OpenPGP]
+      ID = "{{ .Values.openpgp.id }}"
+      File = "/secrets/keyring"
+
+{{- end }}
+
+{{- range $key, $val := .Values.secrets }}
+
+    [[Secrets.Symmetric]] 
+      ID = {{ $key | quote }}
+      Passphrase = {{ $val | quote }} 
+
+{{- end }}
+
+    

stable/hoard/templates/deployment.yaml

@@ -30,6 +30,11 @@ spec:
 {{- if eq .Values.storage.type "filesystem" }}
         - mountPath: /data
           name: data-dir
+{{- end }}
+{{- if .Values.openpgp }}
+        - mountPath: /secrets
+          subPath: keyring
+          name: key-ring
 {{- end }}
         ports:
           - containerPort: {{ .Values.service.port }}
@@ -39,31 +44,31 @@ spec:
         - name: AWS_ACCESS_KEY_ID
           valueFrom:
             secretKeyRef:
-              name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }}
+              name: {{ required "A valid storage credential is required." .Values.storage.secret }}
               key: access-key-id
         - name: AWS_SECRET_ACCESS_KEY
           valueFrom:
             secretKeyRef:
-              name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }}
+              name: {{ required "A valid storage credential is required." .Values.storage.secret }}
               key: secret-access-key
 {{- end }}
 {{- if eq .Values.storage.type "azure" }}
         - name: AZURE_STORAGE_ACCOUNT_NAME
           valueFrom:
             secretKeyRef:
-              name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }}
+              name: {{ required "A valid storage credential is required." .Values.storage.secret }}
               key: storage-account-name
         - name: AZURE_STORAGE_ACCOUNT_KEY
           valueFrom:
             secretKeyRef:
-              name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }}
+              name: {{ required "A valid storage credential is required." .Values.storage.secret }}
               key: storage-account-key
 {{- end }}
 {{- if eq .Values.storage.type "gcp" }}
         - name: GCLOUD_SERVICE_KEY
           valueFrom:
             secretKeyRef:
-              name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }}
+              name: {{ required "A valid storage credential is required." .Values.storage.secret }}
               key: service-key
 {{- end }}
         livenessProbe:
@@ -85,6 +90,11 @@ spec:
         persistentVolumeClaim:
           claimName: {{ template "hoard.fullname" $ }}
 {{- end }}
+{{- if .Values.openpgp }}
+      - name: key-ring
+        secret:
+          secretName: {{ required "A valid keyring is required." .Values.openpgp.secret }}
+{{- end }}
 {{- with .Values.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}

stable/hoard/values.yaml

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: quay.io/monax/hoard
-  tag: 2.0.0
+  tag: 3.0.0
   pullPolicy: IfNotPresent
 
 storage:
@@ -12,7 +12,7 @@ storage:
   bucket: ""
   prefix: ""
   region: ""
-  credentialsSecret: ""
+  secret: ""
   encoding: base64
 
 logging:
@@ -30,6 +30,13 @@ persistence:
   annotations:
     "helm.sh/resource-policy": keep
 
+# openpgp:
+#   id: "10449759736975846181"
+#   secret: "private-keyring"
+# secrets:
+#   key1: passphrase1
+#   key2: passphrase2
+
 service:
   type: ClusterIP
   port: 53431