-
Notifications
You must be signed in to change notification settings - Fork 0
APS-4720: Stage edge signing secrets separately from Kong restart #15
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Elson9
wants to merge
5
commits into
dev
Choose a base branch
from
feature/aps-4720-sdx-edge-key-staging
base: dev
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
f70d175
APS-4720: Stage edge signing secrets separately from Kong restart
Elson9 8355b12
APS-4720: Hide promote Job comments unless rotation.promote is set
Elson9 10ea7cb
APS-4720: Clear the bootstrap token on promote and reset rotation.pro…
Elson9 1dabf11
APS-4720: Clear the bootstrap token with an empty string and document…
Elson9 96414b6
APS-4720: Default new rotation flags so --reuse-values from 0.3.5 doe…
Elson9 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| {{- if and .Values.rotation .Values.rotation.promote }} | ||
| rotation.promote is true. After the promote Job succeeds, reset it so later | ||
| --reuse-values upgrades do not copy {{ include "sdx-edge.fullname" . }}-client-next | ||
| over the live TLS secrets and restart Kong: | ||
|
|
||
| helm upgrade {{ .Release.Name }} oci://ghcr.io/bcgov/aps-devops/sdx-edge \ | ||
| --reuse-values \ | ||
| --set rotation.promote=false | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| {{ if and .Values.rotation .Values.rotation.promote }} | ||
| # Promote a staged runtime-group TLS secret ({release}-client-next) to the live | ||
| # client and server secrets, then rolling-restart Kong so trust-sign mounts the | ||
| # new private key. Run only after sdx-keys.r1 operation=rotate has published | ||
| # the matching public key. | ||
| # | ||
| # One-shot: Helm stores rotation.promote in release values. Reset it to false | ||
| # after this hook succeeds; otherwise the next --reuse-values upgrade renders | ||
| # the hook again, overwrites live secrets from client-next, and restarts Kong. | ||
| apiVersion: batch/v1 | ||
| kind: Job | ||
| metadata: | ||
| name: "{{ include "sdx-edge.fullname" . }}-promote-{{ .Values.rotation.nonce | default "1" }}" | ||
| labels: | ||
| app.kubernetes.io/name: sdx-edge | ||
| app.kubernetes.io/component: job-cert-promote | ||
| app.kubernetes.io/instance: "{{ include "sdx-edge.fullname" . }}" | ||
| data-plane: "{{ include "sdx-edge.fullname" . }}" | ||
| annotations: | ||
| helm.sh/hook: post-upgrade | ||
| helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded | ||
| spec: | ||
| parallelism: 1 | ||
| completions: 1 | ||
| backoffLimit: 0 | ||
| ttlSecondsAfterFinished: 604800 | ||
| template: | ||
| metadata: | ||
| labels: | ||
| DataClass: Low | ||
| app.kubernetes.io/name: sdx-edge | ||
| app.kubernetes.io/component: job-cert-promote | ||
| app.kubernetes.io/instance: "{{ include "sdx-edge.fullname" . }}" | ||
| data-plane: "{{ include "sdx-edge.fullname" . }}" | ||
| spec: | ||
| restartPolicy: Never | ||
| serviceAccountName: sdx-job-cert-bootstrap | ||
| schedulerName: default-scheduler | ||
| enableServiceLinks: true | ||
| terminationGracePeriodSeconds: 30 | ||
| containers: | ||
| - name: cert-promote | ||
| image: 'docker.io/smallstep/step-cli:0.23.0' | ||
| imagePullPolicy: IfNotPresent | ||
| command: | ||
| - /bin/bash | ||
| - +x | ||
| - -e | ||
| - -c | ||
| - |- | ||
| cd /tmp | ||
| export PATH=$PATH:/tmp | ||
|
|
||
| curl -sLO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" | ||
| chmod +x kubectl | ||
|
|
||
| kubectl get secret ${EDGE_NAME}-client-next -o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt | ||
| kubectl get secret ${EDGE_NAME}-client-next -o jsonpath='{.data.tls\.key}' | base64 -d > tls.key | ||
|
|
||
| kubectl create secret \ | ||
| --save-config --dry-run=client -o yaml \ | ||
| tls ${EDGE_NAME}-client \ | ||
| --cert=./tls.crt \ | ||
| --key=./tls.key | kubectl apply -f - | ||
|
|
||
| kubectl create secret \ | ||
| --save-config --dry-run=client -o yaml \ | ||
| tls ${EDGE_NAME}-server \ | ||
| --cert=./tls.crt \ | ||
| --key=./tls.key | kubectl apply -f - | ||
|
|
||
| {{- if .Values.kong.enabled }} | ||
| kubectl rollout restart deployment $EDGE_NAME | ||
| {{- end }} | ||
| env: | ||
| - name: EDGE_NAME | ||
| value: "{{ include "sdx-edge.fullname" . }}" | ||
| {{- if .Values.https_proxy }} | ||
| - name: HTTPS_PROXY | ||
| value: "{{ .Values.https_proxy }}" | ||
| - name: NO_PROXY | ||
| value: ".cluster.local,.svc,10.91.0.0/16,10.93.0.0/16,172.30.0.0/16,127.0.0.1,localhost,.gov.bc.ca" | ||
| {{- end }} | ||
| volumeMounts: | ||
| - name: working-dir | ||
| mountPath: /tmp | ||
| - name: kube-cache | ||
| mountPath: .kube | ||
| automountServiceAccountToken: true | ||
| volumes: | ||
| - name: working-dir | ||
| emptyDir: {} | ||
| - name: kube-cache | ||
| emptyDir: {} | ||
| dnsPolicy: ClusterFirst | ||
| {{ end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could we clear
bootstrap.tls.tokenas part of this promotion upgrade, or otherwise remove and recreate the bootstrap Job?--reuse-valueskeeps the staged token, so the same*-boot-<token hash>Job remains rendered whilestageSecretchanges its pod template from staging to live-secret writes. Kubernetes Job pod templates are immutable, so a stage-to-promote upgrade will be rejected while that completed Job still exists. If TTL has already removed it, Helm can instead recreate the bootstrap Job with the consumed one-time token. A consecutive stage/promote test would help pin this down.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for tackling this. I traced the
--reuse-valuesmerge in Helm 3.20, andnullunfortunately does not clear a value stored by the previous release: the null entry is removed during coalescing, then the old token is supplied again when Helm renders. That means this command still renders the same bootstrap Job withstageSecret=falseand runs into the immutable pod template. Could we use an explicit empty string instead (--set-string bootstrap.tls.token="") and cover a real stage-to-promote reuse-values sequence? An empty string remains an explicit override and rendered correctly in my check.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@phowells Thanks — promote now uses
--set-string bootstrap.tls.token=""so--reuse-valuesdrops the bootstrap Job instead of mutating it (nulldoes not clear on Helm 3).Ran consecutive stage → promote on Gold dev (
pzgw/b8840c-dev, local chart). Stage wrotesdx-edge-pzgw-client-nextwith Kong still at gen 100. Promote cleared the token with no immutable-spec error, copied next → live, and rolled Kong to gen 101. Then--set rotation.promote=false.Live provisioner has no
operation=rotate, so JWKS stayed a single:0kid. Helm path is what this PR covers.