Sealed secrets

charts/coco-supported/kbs-access/insecure-policy.rego

@@ -0,0 +1,38 @@
+package agent_policy
+
+default AddARPNeighborsRequest := true
+default AddSwapRequest := true
+default CloseStdinRequest := true
+default CopyFileRequest := true
+default CreateContainerRequest := true
+default CreateSandboxRequest := true
+default DestroySandboxRequest := true
+default ExecProcessRequest := true
+default GetMetricsRequest := true
+default GetOOMEventRequest := true
+default GuestDetailsRequest := true
+default ListInterfacesRequest := true
+default ListRoutesRequest := true
+default MemHotplugByProbeRequest := true
+default OnlineCPUMemRequest := true
+default PauseContainerRequest := true
+default PullImageRequest := true
+default ReadStreamRequest := true
+default RemoveContainerRequest := true
+default RemoveStaleVirtiofsShareMountsRequest := true
+default ReseedRandomDevRequest := true
+default ResumeContainerRequest := true
+default SetGuestDateTimeRequest := true
+default SetPolicyRequest := true
+default SignalProcessRequest := true
+default StartContainerRequest := true
+default StartTracingRequest := true
+default StatsContainerRequest := true
+default StopTracingRequest := true
+default TtyWinResizeRequest := true
+default UpdateContainerRequest := true
+default UpdateEphemeralMountsRequest := true
+default UpdateInterfaceRequest := true
+default UpdateRoutesRequest := true
+default WaitProcessRequest := true
+default WriteStreamRequest := true

charts/coco-supported/kbs-access/sealed-secret.json

@@ -0,0 +1,8 @@
+{
+    "version": "0.1.0",
+    "type": "vault",
+    "name": "kbs:///default/kbsres1/key3",
+    "provider": "kbs",
+    "provider_settings": {},
+    "annotations": {}
+}

charts/coco-supported/kbs-access/templates/environment.yaml → charts/coco-supported/kbs-access/templates/curl-location-cm.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kbsref
+  name: kbsref-curl
   namespace: kbs-access
 data:
   FILEPATH: "/output/kbsres1.txt"

charts/coco-supported/kbs-access/templates/secure-pod.yaml → charts/coco-supported/kbs-access/templates/curl-pod.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: secure
+  name: curl
   labels:
-    app: secure
+    app: curl
   annotations:
     peerpods: "true"
 spec:
@@ -18,20 +18,14 @@ spec:
         mountPath: /output
       envFrom:
       - configMapRef:
-          name: kbsref
+          name: kbsref-curl
   initContainers:
   - name: curl
     image: registry.redhat.io/ubi9/ubi:latest # Lightweight image with curl installed
     command: ['sh', '-c', 'curl -s http://127.0.0.1:8006/cdh/resource/default/kbsres1/key3 > /output/kbsres1.txt']
     volumeMounts:
     - name: output-volume
       mountPath: /output
-  # - name: hi
-  #   image: registry.redhat.io/ubi9/ubi:latest # Lightweight image with curl installed
-  #   command: ['sh', '-c', 'echo "hi" > /output/kbsres1.txt']
-  #   volumeMounts:
-  #   - name: output-volume
-  #     mountPath: /output
   volumes:
   - name: output-volume
     emptyDir: {}

charts/coco-supported/kbs-access/templates/secure-route.yaml → charts/coco-supported/kbs-access/templates/curl-route.yaml

@@ -1,12 +1,12 @@
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: secure
+  name: curl
 spec:
   port:
     targetPort: 5000
   to:
     kind: Service
-    name: secure
+    name: curl
     weight: 100
   wildcardPolicy: None

charts/coco-supported/kbs-access/templates/secure-svc.yaml → charts/coco-supported/kbs-access/templates/curl-svc.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: secure
+  name: curl
 spec:
   ports:
   - name: 5000-tcp
     port: 5000
     protocol: TCP
     targetPort: 5000
   selector:
-    app: secure
+    app: curl
   sessionAffinity: None
   type: ClusterIP

charts/coco-supported/kbs-access/templates/sealed-location-cm.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kbsref-sealed
+  namespace: kbs-access
+data:
+  FILEPATH: "/sealed/myvalue"

charts/coco-supported/kbs-access/templates/sealed-pod.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: sealed
+  labels:
+    app: sealed
+  annotations:
+    peerpods: "true"
+    io.katacontainers.config.agent.policy: '{{ tpl ( .Files.Get "insecure-policy.rego") . | b64enc }}'
+spec:
+  runtimeClassName: kata-remote
+  containers:
+    - name: python-access
+      image: ghcr.io/butler54/kbs-access-app:latest
+      ports:
+        - containerPort: 5000
+      envFrom:
+      - configMapRef:
+          name: kbsref-sealed
+      volumeMounts:
+      - name: secret-volume
+        mountPath: "sealed/myvalue"
+      env:
+      - name: PROTECTED_SECRET
+        valueFrom:
+          secretKeyRef:
+            name: sealed-secret
+            key: secret
+  volumes:
+    - name: secret-volume
+      secret:
+        secretName: sealed-secret  

charts/coco-supported/kbs-access/templates/sealed-route.yaml

@@ -0,0 +1,12 @@
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: sealed
+spec:
+  port:
+    targetPort: 5000
+  to:
+    kind: Service
+    name: sealed
+    weight: 100
+  wildcardPolicy: None

charts/coco-supported/kbs-access/templates/sealed-secret.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sealed-secret
+
+data:
+  # Base64 encoding of install-config yaml
+  secret: "{{ printf "sealed.fakejwsheader.%s.fakesignature" (tpl ( .Files.Get "sealed-secret.json" ) . | b64enc ) | b64enc }}"
+type: Generic

charts/coco-supported/kbs-access/templates/sealed-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sealed
+spec:
+  ports:
+  - name: 5000-tcp
+    port: 5000
+    protocol: TCP
+    targetPort: 5000
+  selector:
+    app: sealed
+  sessionAffinity: None
+  type: ClusterIP

rhdp/wrapper.sh

@@ -66,7 +66,7 @@ fi
 echo "---------------------"
 echo "defining cluster"
 echo "---------------------"
-python3 rhdp/rhdp-cluster-define.py ${AZUREREGION}
+python rhdp/rhdp-cluster-define.py ${AZUREREGION}
 echo "---------------------"
 echo "cluster defined"
 echo "---------------------"

values-simple.yaml

@@ -95,7 +95,7 @@ clusterGroup:
       # Default to 'safe' for ARO
       overrides:
       - name: letsencrypt.enabled
-        value: false
+        value: true
     hello-openshift:
       name: hello-openshift
       namespace: hello-openshift