The command about how to automatically generate Helm secrets during updates. Below is the text from the author of the article — the CTO of Intoware, a SaaS solutions development company.
Containers are great. At first, I was a skeptic of containers (embarrassingly), but now I fully support the use of this technology. If you are reading this, I hope you have successfully navigated the waters of Docker, realized the benefits of Kubernetes, and made your life much easier with Helm.
However, some things are clearly more complicated than they need to be.
How to automatically generate secrets during updates?
A Kubernetes secret is a resource that contains key/value pairs that you want to use in your code. These can be database connection strings, email passwords, and so on. By using secrets, you create a clear separation between code and configuration, making it easy to configure different deployments without changing the codebase.
A common situation is when two modules need to interact using a shared key. No one outside the cluster should know this key, as it is intended for communication "from one to another" within the cluster.
Creating secrets
Typically, to create a secret in Helm, you need to:
- describe the secret in the values file;
- override it during the deployment process;
- reference it within the deployment/pod;
- … profit!
Typically, it looks something like this:
apiVersion: v1
kind: Secret
metadata:
name: my-super-awesome-api-key
type: Opaque
stringData:
apiKey: {{ .Values.MyApiKeySecret | quote }}
A simple Kubernetes secret using values from values.yml
But let's say you don’t want to specify your secret in the values file.
There are many scenarios where a shared key required for deployment needs to be generated during installation.
In the above example with module communication, it is undesirable to share the secret outside the deployment. Therefore, it is highly desirable for Helm to have mechanisms for automatically creating the secret without the need to explicitly specify it.
Hooks
Hooks allow you to run code at specific points in the installation process. There might be a setup task that needs to be run after the initial installation, or cleanup that must be done before any updates are applied.
To solve our problem of adding a key generated during installation, pre-installation hooks are ideal. But there's a catch: you cannot automatically generate a secret once during updates. Hooks will trigger at every update.
If you have generated your secret and your initial installation has not yet occurred, then stop reading; a pre-installation hook will work perfectly for you.
But if the secret is part of the update (perhaps a new feature that wasn’t present at installation), it’s unfortunate that it’s not possible to create a pre-installation hook that runs just once.
Features
Helm functions allow adding various script elements into deployment scripts.
apiVersion: v1
kind: Secret
metadata:
name: my-super-awesome-api-key
type: Opaque
stringData:
apiKey: {{ uuidv4 | quote }} #Generate a new UUID and quote it
In this example, the value of the secret apiKey will be a new UUID generated during installation.
Helm includes a truly extensive library of functions that utilize amazing features of GO templates and the Sprig function library for creating customizable deployments.
Lookup Function
In Helm 3.1, the , which allows querying an existing deployment and:
- checking for the existence of resources;
- returning the value of an existing resource for later use.
By utilizing both of these capabilities, we can create a one-time dynamically generated secret!
# 1. Запросить существование секрета и вернуть в переменной $secret
{{- $secret := (lookup "v1" "Secret" .Release.Namespace "some-awesome-secret" -}}
apiVersion: v1
kind: Secret
metadata:
name: some-awesome-secret
type: Opaque
# 2. Если секрет существует, взять его значение как apiKey (секрет использует кодирование Base64, так что используйте ключ "data")
{{ if $secret -}}
data:
apiKey: {{ $secret.data.apiKey }}
# 3. Если секрет не существует — создать его (в этот раз используйте "stringData", так как будет обычное значение)!
{{ else -}}
stringData:
apiKey: {{ uuidv4 | quote }}
{{ end }}
Whenever a new update is applied to the server, Helm will either generate a new value for the secret (if the secret does not yet exist) or reuse the existing value.
Good luck!
What else to read on the topic:
- .
- .
- .
Source: habr.com
