diff --git a/stable/hoard/Chart.yaml b/stable/hoard/Chart.yaml index 86ae54f405..f962ed7580 100644 --- a/stable/hoard/Chart.yaml +++ b/stable/hoard/Chart.yaml @@ -1,6 +1,6 @@ name: hoard -version: 0.6.2 -appVersion: 2.0.0 +version: 0.6.5 +appVersion: 3.0.0 description: Hoard is a stateless, deterministically encrypted, content-addressed object store home: https://github.com/monax/hoard icon: https://pbs.twimg.com/profile_images/781959787856687105/76s1CJER_400x400.jpg diff --git a/stable/hoard/README.md b/stable/hoard/README.md index 6de4a2eea2..6bdde1bfa0 100644 --- a/stable/hoard/README.md +++ b/stable/hoard/README.md @@ -32,14 +32,14 @@ The following table lists the configurable parameters of the Hoard chart and its | --------- | ----------- | ------- | | `replicaCount` | number of daemons | `1` | | `image.repository` | docker image | `"quay.io/monax/hoard"` | -| `image.tag` | version | `"2.0.0"` | +| `image.tag` | version | `"3.0.0"` | | `image.pullPolicy` | pull policy | `"IfNotPresent"` | | `storage.type` | backend object store (aws, azure, filesystem, gcp, ipfs)| `"filesystem"` | | `storage.remote` | remote api location (ipfs only) | `""` | | `storage.region` | object store location (cloud only) | `""` | | `storage.bucket` | object storage container (cloud only) | `""` | | `storage.prefix` | bucket folder (cloud only) | `""` | -| `storage.credentialsSecret` | required secret for cloud providers | `""` | +| `storage.secret` | required secret for cloud providers | `""` | | `persistence.size` | size of local store | `"10Gi"` | | `persistence.storageClass` | pvc type | `"standard"` | | `persistence.accessMode` | pvc access | `"ReadWriteOnce"` | @@ -74,20 +74,28 @@ For each of the supported cloud back-ends, please ensure you have the appropriat ```bash kubectl create secret generic cloud-credentials --from-literal access-key-id=${AWS_ACCESS_KEY_ID} --from-literal secret-access-key=${AWS_SECRET_ACCESS_KEY} -helm install --name my-release stable/hoard --set storage.type=aws,storage.region="eu-central-1",storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials" +helm install --name my-release stable/hoard --set storage.type=aws,storage.region="eu-central-1",storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials" ``` ### [Azure](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-manage) ```bash kubectl create secret generic cloud-credentials --from-literal storage-account-name=${AZURE_STORAGE_ACCOUNT_NAME} --from-literal storage-account-key=${AZURE_STORAGE_ACCOUNT_KEY} -helm install --name my-release stable/hoard --set storage.type=azure,storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials" +helm install --name my-release stable/hoard --set storage.type=azure,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials" ``` ### [GCP](https://cloud.google.com/iam/docs/creating-managing-service-account-keys) ```bash kubectl create secret generic cloud-credentials --from-literal service-key=${GCLOUD_SERVICE_KEY} -helm install --name my-release stable/hoard --set storage.type=gcp,storage.bucket="my-bucket",storage.prefix="folder",storage.credentialsSecret="cloud-credentials" +helm install --name my-release stable/hoard --set storage.type=gcp,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials" ``` +## OpenPGP Grants + +Once configured, hoard can share access to a secret file by encrypting it with the public key of the recipient: + +``` +kubectl create secret generic private-keyring --from-file ${GOPATH}/src/github.com/monax/hoard/grant/private.key.asc +helm install --name my-release stable/hoard --set openpgp.id="10449759736975846181",openpgp.secret=private-keyring +``` \ No newline at end of file diff --git a/stable/hoard/templates/configmap.yaml b/stable/hoard/templates/configmap.yaml index 75616546f1..ea8b01b055 100644 --- a/stable/hoard/templates/configmap.yaml +++ b/stable/hoard/templates/configmap.yaml @@ -22,4 +22,22 @@ data: [Logging] LoggingType = "{{ .Values.logging.type }}" - Channels = [{{- range .Values.logging.channels }}{{ . | quote }},{{- end }}] \ No newline at end of file + Channels = [{{- range .Values.logging.channels }}{{ . | quote }},{{- end }}] + +{{- if .Values.openpgp }} + + [Secrets.OpenPGP] + ID = "{{ .Values.openpgp.id }}" + File = "/secrets/keyring" + +{{- end }} + +{{- range $key, $val := .Values.secrets }} + + [[Secrets.Symmetric]] + ID = {{ $key | quote }} + Passphrase = {{ $val | quote }} + +{{- end }} + + diff --git a/stable/hoard/templates/deployment.yaml b/stable/hoard/templates/deployment.yaml index 87ae79e4cc..2206b04d2f 100644 --- a/stable/hoard/templates/deployment.yaml +++ b/stable/hoard/templates/deployment.yaml @@ -30,6 +30,11 @@ spec: {{- if eq .Values.storage.type "filesystem" }} - mountPath: /data name: data-dir +{{- end }} +{{- if .Values.openpgp }} + - mountPath: /secrets + subPath: keyring + name: key-ring {{- end }} ports: - containerPort: {{ .Values.service.port }} @@ -39,31 +44,31 @@ spec: - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: - name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }} + name: {{ required "A valid storage credential is required." .Values.storage.secret }} key: access-key-id - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: - name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }} + name: {{ required "A valid storage credential is required." .Values.storage.secret }} key: secret-access-key {{- end }} {{- if eq .Values.storage.type "azure" }} - name: AZURE_STORAGE_ACCOUNT_NAME valueFrom: secretKeyRef: - name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }} + name: {{ required "A valid storage credential is required." .Values.storage.secret }} key: storage-account-name - name: AZURE_STORAGE_ACCOUNT_KEY valueFrom: secretKeyRef: - name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }} + name: {{ required "A valid storage credential is required." .Values.storage.secret }} key: storage-account-key {{- end }} {{- if eq .Values.storage.type "gcp" }} - name: GCLOUD_SERVICE_KEY valueFrom: secretKeyRef: - name: {{ required "A valid storage credential is required." .Values.storage.credentialsSecret }} + name: {{ required "A valid storage credential is required." .Values.storage.secret }} key: service-key {{- end }} livenessProbe: @@ -85,6 +90,11 @@ spec: persistentVolumeClaim: claimName: {{ template "hoard.fullname" $ }} {{- end }} +{{- if .Values.openpgp }} + - name: key-ring + secret: + secretName: {{ required "A valid keyring is required." .Values.openpgp.secret }} +{{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/stable/hoard/values.yaml b/stable/hoard/values.yaml index 48f131ac60..d902619efa 100644 --- a/stable/hoard/values.yaml +++ b/stable/hoard/values.yaml @@ -2,7 +2,7 @@ replicaCount: 1 image: repository: quay.io/monax/hoard - tag: 2.0.0 + tag: 3.0.0 pullPolicy: IfNotPresent storage: @@ -12,7 +12,7 @@ storage: bucket: "" prefix: "" region: "" - credentialsSecret: "" + secret: "" encoding: base64 logging: @@ -30,6 +30,13 @@ persistence: annotations: "helm.sh/resource-policy": keep +# openpgp: +# id: "10449759736975846181" +# secret: "private-keyring" +# secrets: +# key1: passphrase1 +# key2: passphrase2 + service: type: ClusterIP port: 53431