Merge pull request #3 from nais/secrets

Secrets
nais · Feb 22, 2024 · 793e029 · 793e029
2 parents 10ae983 + 2ef3098
commit 793e029
Show file tree

Hide file tree

Showing 35 changed files with 3,477 additions and 336 deletions.
diff --git a/.configs/flake.lock b/.configs/flake.lock
diff --git a/.configs/flake.nix b/.configs/flake.nix
@@ -0,0 +1,36 @@
+{
+  description = "Example Go development environment for Zero to Nix";
+
+  # Flake inputs
+  inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; };
+
+  # Flake outputs
+  outputs = { self, nixpkgs }:
+    let
+      # Systems supported
+      allSystems = [
+        "x86_64-linux" # 64-bit Intel/AMD Linux
+        "aarch64-linux" # 64-bit ARM Linux
+        "x86_64-darwin" # 64-bit Intel macOS
+        "aarch64-darwin" # 64-bit ARM macOS
+      ];
+
+      # Helper to provide system-specific attributes
+      forAllSystems = f:
+        nixpkgs.lib.genAttrs allSystems
+        (system: f { pkgs = import nixpkgs { inherit system; }; });
+    in {
+      # Development environment output
+      devShells = forAllSystems ({ pkgs }: {
+        default = pkgs.mkShell {
+          # The Nix packages provided in the environment
+          packages = with pkgs; [
+            go
+            gotools # Go tools like goimports, godoc, and others
+            gopls
+            asdf
+          ];
+        };
+      });
+    };
+}
diff --git a/.gitignore b/.gitignore
@@ -8,3 +8,4 @@ values.json
 .DS_Store
 .direnv
 __debug_bin*
+.envrc
diff --git a/data/k8s/dev/devteam/deploy-canary.yaml b/data/k8s/dev/devteam/deploy-canary.yaml
@@ -13,6 +13,83 @@ metadata:
   resourceVersion: "3701834314"
   uid: 91ba6c9d-0199-4123-aff6-aa27ce5d2056
 spec:
+  envFrom:
+    - secret: my-secret
+    - secret: other-secret
+    - configMap: my-config-map
+  filesFrom:
+    - secret: my-secret
+      mountPath: /var/secret
+  env:
+    - name: DEPLOY_START
+      value: "1704981602000000000"
+  image: ghcr.io/nais/testapp/testapp:2020-02-25-f61e7b7
+  liveness:
+    path: /ping
+  port: 8080
+  prometheus:
+    enabled: true
+    path: /metrics
+  readiness:
+    path: /ping
+  replicas:
+    max: 1
+    min: 1
+  resources:
+    limits:
+      cpu: 250m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  skipCaBundle: true
+status:
+  conditions:
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "True"
+      type: Ready
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "False"
+      type: Stalled
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "False"
+      type: Reconciling
+  correlationID: f8c04f82-6a84-4a8e-9f8b-563b5894d0cf
+  deploymentRolloutStatus: complete
+  rolloutCompleteTime: 1704981612597504354
+  synchronizationHash: 7fc5fa83f2ae4eaa
+  synchronizationState: RolloutComplete
+  synchronizationTime: 1704981603962494011
+---
+apiVersion: nais.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    deploy.nais.io/client-version: 2023-01-23-7071cd7
+    nais.io/deploymentCorrelationID: f8c04f82-6a84-4a8e-9f8b-563b5894d0cf
+    nais.io/skipDeploymentMessage: "true"
+  creationTimestamp: "2023-01-20T10:51:47Z"
+  finalizers:
+    - naiserator.nais.io/finalizer
+  generation: 407981
+  name: nais-deploy-chicken
+  resourceVersion: "3701834314"
+  uid: 91ba6c9d-0199-4123-aff6-aa27ce5d2056
+spec:
+  envFrom:
+    - secret: my-secret
+    - secret: other-secret
+    - configMap: my-config-map
+
+  filesFrom:
+    - secret: my-secret
+      mountPath: /var/secret
   env:
     - name: DEPLOY_START
       value: "1704981602000000000"

diff --git a/data/k8s/dev/devteam/secrets.yaml b/data/k8s/dev/devteam/secrets.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    foo: bar
+    bar: baz
+    console.nais.io/last-modified-at: "2021-01-01T00:00:00Z"
+    console.nais.io/last-modified-by: "[email protected]"
+  labels:
+    nais.io/managed-by: console
+    foo: bar
+    bar: baz
+  name: my-secret
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    hunter2.nais.io/last-modified: "2021-01-01T00:00:00Z"
+    hunter2.nais.io/last-modified-by: "[email protected]"
+    hunter2.nais.io/secret-version: "1"
+  labels:
+    nais.io/created-by: hunter2
+  name: my-secret-hunter2
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  name: my-kubectl-secret
+type: Opaque
diff --git a/data/k8s/dev/devteam/topic.yaml b/data/k8s/dev/devteam/topic.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kafka.nais.io/v1
+kind: Topic
+metadata:
+  name: aura
+spec:
+  acl:
+    - access: read
+      team: aura
+      application: aura
+  pool: aiven
diff --git a/data/k8s/dev/nais/deploy-canary.yaml b/data/k8s/dev/nais/deploy-canary.yaml
@@ -13,6 +13,84 @@ metadata:
   resourceVersion: "3701834314"
   uid: 91ba6c9d-0199-4123-aff6-aa27ce5d2056
 spec:
+  envFrom:
+    - secret: my-secret
+    - secret: other-secret
+    - configMap: my-config-map
+
+  filesFrom:
+    - secret: my-secret
+      mountPath: /var/secret
+  env:
+    - name: DEPLOY_START
+      value: "1704981602000000000"
+  image: ghcr.io/nais/testapp/testapp:2020-02-25-f61e7b7
+  liveness:
+    path: /ping
+  port: 8080
+  prometheus:
+    enabled: true
+    path: /metrics
+  readiness:
+    path: /ping
+  replicas:
+    max: 1
+    min: 1
+  resources:
+    limits:
+      cpu: 250m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  skipCaBundle: true
+status:
+  conditions:
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "True"
+      type: Ready
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "False"
+      type: Stalled
+    - lastTransitionTime: "2024-01-11T14:00:04Z"
+      message: complete
+      reason: RolloutComplete
+      status: "False"
+      type: Reconciling
+  correlationID: f8c04f82-6a84-4a8e-9f8b-563b5894d0cf
+  deploymentRolloutStatus: complete
+  rolloutCompleteTime: 1704981612597504354
+  synchronizationHash: 7fc5fa83f2ae4eaa
+  synchronizationState: RolloutComplete
+  synchronizationTime: 1704981603962494011
+---
+apiVersion: nais.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    deploy.nais.io/client-version: 2023-01-23-7071cd7
+    nais.io/deploymentCorrelationID: f8c04f82-6a84-4a8e-9f8b-563b5894d0cf
+    nais.io/skipDeploymentMessage: "true"
+  creationTimestamp: "2023-01-20T10:51:47Z"
+  finalizers:
+    - naiserator.nais.io/finalizer
+  generation: 407981
+  name: nais-deploy-chicken
+  resourceVersion: "3701834314"
+  uid: 91ba6c9d-0199-4123-aff6-aa27ce5d2056
+spec:
+  envFrom:
+    - secret: my-secret
+    - secret: other-secret
+    - configMap: my-config-map
+
+  filesFrom:
+    - secret: my-secret
+      mountPath: /var/secret
   env:
     - name: DEPLOY_START
       value: "1704981602000000000"

diff --git a/data/k8s/dev/nais/secrets.yaml b/data/k8s/dev/nais/secrets.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    foo: bar
+    bar: baz
+    console.nais.io/last-modified-at: "2021-01-01T00:00:00Z"
+    console.nais.io/last-modified-by: "[email protected]"
+  labels:
+    nais.io/managed-by: console
+    foo: bar
+    bar: baz
+  name: my-secret
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    hunter2.nais.io/last-modified: "2021-01-01T00:00:00Z"
+    hunter2.nais.io/last-modified-by: "[email protected]"
+    hunter2.nais.io/secret-version: "1"
+  labels:
+    nais.io/created-by: hunter2
+  name: my-secret-hunter2
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  name: my-kubectl-secret
+type: Opaque
diff --git a/data/k8s/superprod/nais/deploy-canary.yaml b/data/k8s/superprod/nais/deploy-canary.yaml
@@ -13,6 +13,9 @@ metadata:
   resourceVersion: "3701834314"
   uid: 91ba6c9d-0199-4123-aff6-aa27ce5d2056
 spec:
+  envFrom:
+    - secret: my-secret
+    - secret: other-secret
   env:
     - name: DEPLOY_START
       value: "1704981602000000000"

diff --git a/data/k8s/superprod/nais/secrets.yaml b/data/k8s/superprod/nais/secrets.yaml
@@ -0,0 +1,42 @@
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    console.nais.io/last-modified-at: "2024-01-13T13:37:00Z"
+    console.nais.io/last-modified-by: "[email protected]"
+  labels:
+    nais.io/managed-by: console
+  name: my-secret
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    console.nais.io/last-modified-at: "2024-02-01T09:13:00Z"
+    console.nais.io/last-modified-by: "[email protected]"
+  labels:
+    nais.io/managed-by: console
+  name: my-other-secret
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFyCg==
+  bar: YmFyCg==
+kind: Secret
+metadata:
+  annotations:
+    console.nais.io/last-modified-at: "2024-02-01T12:59:59Z"
+    console.nais.io/last-modified-by: "[email protected]"
+  labels:
+    nais.io/managed-by: console
+  name: other-secret
+type: Opaque
+---