Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RND-676] Kubernetes Configuration for Meadowlark #337

Merged
merged 16 commits into from
Jan 9, 2024
Merged

Conversation

andonyns
Copy link
Contributor

@andonyns andonyns commented Jan 8, 2024

Add a set of configuration files to run Meadowlark in a Kubernetes cluster

Description

  • Migrate from docker compose using komposer.
  • Create ConfigMap to handle parameters, and Secret file to handle passwords
  • Add instructions to deploy locally.

name: app-secret
type: Opaque
data:
postgres-password: dG9wc2VjdXJl
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there an alternative to having a hard-coded secret here? Does this file truly belong in source control?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the equivalent of what we currently do in Docker Compose when setting the postgres password in the .env file, this is a minimal security configuration and will not actually be a secret, just a base64 encrypted script (in fact some blogs mention that the name secret is misleading)

https://kubernetes.io/docs/concepts/configuration/secret/ shows a warning about "thinking" that the secrets are actually a security measure.

I think that for the purpose of the demo we could keep the file, but add a notice in the readme to use a different security method for passwords

k8s/README.md Outdated Show resolved Hide resolved
- name: AUTHORIZATION_STORE_PLUGIN
value: '@edfi/meadowlark-postgresql-backend'
- name: DOCUMENT_STORE_PLUGIN
value: '@edfi/meadowlark-postgresql-backend'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make sense to standardize on ' or " rather than having both?

Do these value strings actually need to be delimited with one or the other? For example, docker compose doesn't need " around string values for the most part (maybe some exceptions though).

Copy link
Contributor Author

@andonyns andonyns Jan 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's true, this was done automatically from kompose, but according to the YAML specification can be done with double, single or no quotes. Some of the exceptions is true or false as strings to avoid converting to boolean and strings starting with a reserved character (like @)

k8s/meadowlark-api-deployment.yaml Outdated Show resolved Hide resolved
@bradbanister
Copy link
Contributor

Tested out on Ubuntu with minikube, works great!

@bradbanister bradbanister reopened this Jan 9, 2024
@bradbanister bradbanister merged commit 2e54fe6 into main Jan 9, 2024
15 checks passed
@bradbanister bradbanister deleted the RND-676 branch January 9, 2024 20:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants