Skip to content

Commit e8d4538

Browse files
SkarlsoSkarlso
authored
Merge pull request #51 from Skarlso/add-helm-authentications
add authentication to private helm repos
2 parents b87ba8b + 7723894 commit e8d4538

File tree

7 files changed

+300
-178
lines changed

7 files changed

+300
-178
lines changed

‎README.md

Lines changed: 83 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -104,46 +104,6 @@ the last applied version in its status. Once there is a new one, it applies it t
104104
It also saves attempted versions. If a version is failed to apply, it will still record it as attempted version in its
105105
status.
106106

107-
## Validation
108-
109-
Before applying a new CRD there are options to make sure that it doesn't break anything by defining a template to check
110-
against. It would be awesome if it could list all Objects that belong to a CRD but that's just not possible because of various
111-
security reasons.
112-
113-
To work around that, the user can define a `template` section in the Bootstrap object. It will use that template and
114-
validate the CRD it's trying to apply to the cluster first against that template:
115-
116-
```yaml
117-
apiVersion: delivery.crd-bootstrap/v1alpha1
118-
kind: Bootstrap
119-
metadata:
120-
name: bootstrap-sample
121-
namespace: crd-bootstrap-system
122-
spec:
123-
interval: 10s
124-
template:
125-
KrokEvent:
126-
apiVersion: delivery.krok.app/v1alpha1
127-
kind: KrokEvent
128-
metadata:
129-
name: krokevent-sample
130-
spec:
131-
thisfield: bla
132-
source:
133-
configMap:
134-
name: crd-bootstrap-sample
135-
namespace: crd-bootstrap-system
136-
version:
137-
semver: 1.0.0
138-
```
139-
140-
The template is a map of `Kind`: `Template Yaml`. Here, we have a KrokEvent CRD kind. This fails validation because the
141-
spec field doesn't have `thisfield` in it. A failed validation will immediately stop reconciliation of the bootstrap
142-
object. User intervention is required to kick it off again to prevent messing up the cluster.
143-
144-
If it's desired to continue on failures, there is a setting for that. Simply set `continueOnValidationError: true` in the
145-
Bootstrap's spec.
146-
147107
## Helm Charts
148108

149109
Helm Charts can have CRDs in them according to the [specification](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/).
@@ -152,8 +112,6 @@ Helm Charts can have CRDs in them according to the [specification](https://helm.
152112

153113
After that, the bootstrapper will keep them in sync similar to the other sources.
154114

155-
At the moment, only public repos are supported... I'll add authentication with https://github.com/Skarlso/crd-bootstrap/issues/49.
156-
157115
There are two sources. With regular HTTP:
158116

159117
```yaml
@@ -190,6 +148,89 @@ spec:
190148
semver: v0.4.2
191149
```
192150

151+
To add access credentials provide a secret that could contain the following keys:
152+
153+
```go
154+
const (
155+
// Helm security access keys.
156+
CaFileKey = "caFile"
157+
CertFileKey = "certFile"
158+
UsernameKey = "username"
159+
PasswordKey = "password"
160+
)
161+
```
162+
163+
For example:
164+
165+
```yaml
166+
source:
167+
helm:
168+
chartReference: oci://ghcr.io/private/helm-chart
169+
chartName: helm-chart
170+
secretRef:
171+
name: access-creds
172+
```
173+
174+
### Authentication
175+
176+
There are two ways to authenticate with Helm.
177+
178+
For OCI repositories, `docker-registry` type secrets are required. To create one, use:
179+
180+
```bash
181+
kubectl create secret docker-registry git-secret -n crd-bootstrap-system \
182+
--docker-server=ghcr.io \
183+
--docker-username=$GITHUB_USER \
184+
--docker-password=$GITHUB_TOKEN \
185+
--docker-email=$GITHUB_EMAIL
186+
```
187+
188+
For regular repositories use an Opaque secret:
189+
190+
```bash
191+
kubectl create secret generic git-secret --from-literal=username=Skarlso --from-literal=password=$GITHUB_TOKEN -n crd-bootstrap-system
192+
```
193+
194+
## Validation
195+
196+
Before applying a new CRD there are options to make sure that it doesn't break anything by defining a template to check
197+
against. It would be awesome if it could list all Objects that belong to a CRD but that's just not possible because of various
198+
security reasons.
199+
200+
To work around that, the user can define a `template` section in the Bootstrap object. It will use that template and
201+
validate the CRD it's trying to apply to the cluster first against that template:
202+
203+
```yaml
204+
apiVersion: delivery.crd-bootstrap/v1alpha1
205+
kind: Bootstrap
206+
metadata:
207+
name: bootstrap-sample
208+
namespace: crd-bootstrap-system
209+
spec:
210+
interval: 10s
211+
template:
212+
KrokEvent:
213+
apiVersion: delivery.krok.app/v1alpha1
214+
kind: KrokEvent
215+
metadata:
216+
name: krokevent-sample
217+
spec:
218+
thisfield: bla
219+
source:
220+
configMap:
221+
name: crd-bootstrap-sample
222+
namespace: crd-bootstrap-system
223+
version:
224+
semver: 1.0.0
225+
```
226+
227+
The template is a map of `Kind`: `Template Yaml`. Here, we have a KrokEvent CRD kind. This fails validation because the
228+
spec field doesn't have `thisfield` in it. A failed validation will immediately stop reconciliation of the bootstrap
229+
object. User intervention is required to kick it off again to prevent messing up the cluster.
230+
231+
If it's desired to continue on failures, there is a setting for that. Simply set `continueOnValidationError: true` in the
232+
Bootstrap's spec.
233+
193234
## Multiple CRDs in a single file
194235

195236
A single Bootstrap CRD will point to a single file of ConfigMap. But that file, or ConfigMap may contain multiple CRDs.

‎api/v1alpha1/constants.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
package v1alpha1
2+
3+
const (
4+
// Helm security access keys.
5+
CaFileKey = "caFile"
6+
CertFileKey = "certFile"
7+
UsernameKey = "username"
8+
PasswordKey = "password"
9+
DockerJSONConfigKey = ".dockerconfigjson"
10+
)

‎config/samples/delivery_v1alpha1_bootstrap_helm_url.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,7 @@ spec:
99
helm:
1010
chartReference: https://ibm.github.io/helm101/
1111
chartName: guestbook
12+
secretRef:
13+
name: access-creds
1214
version:
1315
semver: 0.2.1

‎docs/release_notes/v0.5.3.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Release v0.5.3
2+
3+
Add authentication to private helm chart resources.

‎go.mod

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ go 1.21
44

55
require (
66
github.com/Masterminds/semver/v3 v3.2.1
7+
github.com/docker/cli v25.0.2+incompatible
78
github.com/fluxcd/cli-utils v0.36.0-flux.3
89
github.com/fluxcd/pkg/apis/meta v1.3.0
910
github.com/fluxcd/pkg/runtime v0.44.1
@@ -24,11 +25,7 @@ require (
2425
require (
2526
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
2627
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
27-
github.com/BurntSushi/toml v1.3.2 // indirect
2828
github.com/MakeNowJust/heredoc v1.0.0 // indirect
29-
github.com/Masterminds/goutils v1.1.1 // indirect
30-
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
31-
github.com/Masterminds/squirrel v1.5.4 // indirect
3229
github.com/Microsoft/hcsshim v0.11.4 // indirect
3330
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
3431
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
@@ -41,7 +38,6 @@ require (
4138
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
4239
github.com/davecgh/go-spew v1.1.1 // indirect
4340
github.com/distribution/reference v0.5.0 // indirect
44-
github.com/docker/cli v25.0.2+incompatible // indirect
4541
github.com/docker/distribution v2.8.3+incompatible // indirect
4642
github.com/docker/docker v25.0.2+incompatible // indirect
4743
github.com/docker/docker-credential-helpers v0.8.1 // indirect
@@ -51,19 +47,16 @@ require (
5147
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
5248
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
5349
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
54-
github.com/fatih/color v1.16.0 // indirect
5550
github.com/felixge/httpsnoop v1.0.4 // indirect
5651
github.com/fsnotify/fsnotify v1.7.0 // indirect
5752
github.com/go-errors/errors v1.5.1 // indirect
58-
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
5953
github.com/go-logr/logr v1.4.1 // indirect
6054
github.com/go-logr/stdr v1.2.2 // indirect
6155
github.com/go-logr/zapr v1.3.0 // indirect
6256
github.com/go-openapi/jsonpointer v0.20.2 // indirect
6357
github.com/go-openapi/jsonreference v0.20.4 // indirect
6458
github.com/go-openapi/swag v0.22.9 // indirect
6559
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
66-
github.com/gobwas/glob v0.2.3 // indirect
6760
github.com/gogo/protobuf v1.3.2 // indirect
6861
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
6962
github.com/golang/protobuf v1.5.3 // indirect
@@ -77,25 +70,14 @@ require (
7770
github.com/google/uuid v1.6.0 // indirect
7871
github.com/gorilla/mux v1.8.1 // indirect
7972
github.com/gorilla/websocket v1.5.1 // indirect
80-
github.com/gosuri/uitable v0.0.4 // indirect
8173
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
82-
github.com/hashicorp/errwrap v1.1.0 // indirect
83-
github.com/hashicorp/go-multierror v1.1.1 // indirect
84-
github.com/huandu/xstrings v1.4.0 // indirect
8574
github.com/imdario/mergo v0.3.16 // indirect
8675
github.com/inconshreveable/mousetrap v1.1.0 // indirect
87-
github.com/jmoiron/sqlx v1.3.5 // indirect
8876
github.com/josharian/intern v1.0.0 // indirect
8977
github.com/json-iterator/go v1.1.12 // indirect
9078
github.com/klauspost/compress v1.17.5 // indirect
91-
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
92-
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
93-
github.com/lib/pq v1.10.9 // indirect
9479
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
9580
github.com/mailru/easyjson v0.7.7 // indirect
96-
github.com/mattn/go-colorable v0.1.13 // indirect
97-
github.com/mattn/go-isatty v0.0.20 // indirect
98-
github.com/mattn/go-runewidth v0.0.15 // indirect
9981
github.com/mitchellh/copystructure v1.2.0 // indirect
10082
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
10183
github.com/mitchellh/reflectwalk v1.0.2 // indirect
@@ -115,12 +97,8 @@ require (
11597
github.com/prometheus/client_model v0.5.0 // indirect
11698
github.com/prometheus/common v0.46.0 // indirect
11799
github.com/prometheus/procfs v0.12.0 // indirect
118-
github.com/rivo/uniseg v0.4.6 // indirect
119-
github.com/rubenv/sql-migrate v1.6.1 // indirect
120100
github.com/russross/blackfriday/v2 v2.1.0 // indirect
121-
github.com/shopspring/decimal v1.3.1 // indirect
122101
github.com/sirupsen/logrus v1.9.3 // indirect
123-
github.com/spf13/cast v1.6.0 // indirect
124102
github.com/spf13/cobra v1.8.0 // indirect
125103
github.com/spf13/pflag v1.0.5 // indirect
126104
github.com/stoewer/go-strcase v1.3.0 // indirect

0 commit comments

Comments
 (0)