Initial code

sorrison · sorrison · commit 76338a7c9eaa · 2025-02-06T11:40:38.000+11:00
Change-Id: I9d616358e44b7a81ede8eda7d65d8f33e70d0faa
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -0,0 +1,12 @@
+name: 'Build Release'
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    uses: NeCTAR-RC/gh-actions/.github/workflows/build-release.yaml@master
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1 @@
+charts/*
diff --git a/.gitreview b/.gitreview
@@ -0,0 +1,5 @@
+[gerrit]
+host=review.rc.nectar.org.au
+port=29418
+project=NeCTAR-RC/keystone-helm.git
+defaultbranch=master
diff --git a/.helmignore b/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/Chart.lock b/Chart.lock
@@ -0,0 +1,9 @@
+dependencies:
+- name: common
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 2.29.1
+- name: nectarlib
+  repository: oci://registry.rc.nectar.org.au/nectar-helm
+  version: 3.0.2
+digest: sha256:cb1e27162273908127931b8a46792d0981d36bdbfdd48832a22390f0d4c19a59
+generated: "2025-02-06T11:39:56.006191974+11:00"
diff --git a/Chart.yaml b/Chart.yaml
@@ -0,0 +1,13 @@
+apiVersion: v2
+name: keystone
+description: A Helm chart for Openstack Keystone
+type: application
+version: 1.0.0
+appVersion: 25.0.0-14-g155f38a86-5-9
+dependencies:
+- name: common
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 2.29.1
+- name: nectarlib
+  version: 3.0.2
+  repository: oci://registry.rc.nectar.org.au/nectar-helm
diff --git a/renovate.json b/renovate.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}
diff --git a/templates/NOTES.txt b/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.api.ingress.enabled }}
+{{- range $host := .Values.api.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.api.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "nectarlib.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "nectarlib.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "nectarlib.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "nectarlib.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
@@ -0,0 +1,20 @@
+{{/*
+Vault annotations
+*/}}
+{{- define "keystone.vaultAnnotations" -}}
+vault.hashicorp.com/role: "{{ .Values.vault.role }}"
+vault.hashicorp.com/agent-inject: "true"
+vault.hashicorp.com/agent-pre-populate-only: "true"
+vault.hashicorp.com/agent-inject-status: "update"
+vault.hashicorp.com/secret-volume-path-secrets.conf: /etc/keystone/keystone.conf.d
+vault.hashicorp.com/agent-inject-secret-secrets.conf: "{{ .Values.vault.settings_secret }}"
+vault.hashicorp.com/agent-inject-template-secrets.conf: |
+  {{ print "{{- with secret \"" .Values.vault.settings_secret "\" -}}" }}
+  {{ print "[identity]" }}
+  {{ print "password_reset_token={{ .Data.data.password_reset_token }}" }}
+  {{ print "[rcshibboleth]" }}
+  {{ print "admin_token={{ .Data.data.rcshib_admin_token }}" }}
+  {{ print "[database]" }}
+  {{ print "connection={{ .Data.data.database_connection }}" }}
+  {{ print "{{- end -}}" }}
+{{- end }}
diff --git a/templates/_keystone_conf.tpl b/templates/_keystone_conf.tpl
@@ -0,0 +1,49 @@
+{{- define "keystone-conf" }}
+[DEFAULT]
+public_endpoint={{ .Values.conf.public_endpoint }}
+max_token_size=255
+
+[auth]
+methods=external,password,token,oauth1,mapped,application_credential,totp
+
+{{- if .Values.conf.cors.allowed_origin }}
+[cors]
+allowed_origin={{ .Values.conf.cors.allowed_origin }}
+allow_headers=Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token
+{{- end }}
+
+[token]
+allow_expired_window=604800
+expiration=21600
+provider=fernet
+revoke_by_id=True
+
+{{- if .Values.conf.rcshib.allowed_hosts }}
+[rcshibboleth]
+allowed_hosts={{ join "," .Values.conf.rcshib.allowed_hosts }}
+{{- end }}
+
+[fernet_tokens]
+key_repository=/etc/keystone/fernet-keys
+max_active_keys=12
+
+[credential]
+key_repository=/etc/keystone/credential-keys
+
+{{- if .Values.conf.cache.memcached_servers }}
+[cache]
+backend=oslo_cache.memcache_pool
+enabled=True
+memcached_servers={{ join "," .Values.conf.cache.memcached_servers }}
+{{- end }}
+
+[oslo_policy]
+policy_file=/etc/keystone/policy.yaml
+
+[database]
+connection_recycle_time=60
+
+[oslo_messaging_notifications]
+driver=log
+
+{{- end }}
diff --git a/templates/api.yaml b/templates/api.yaml
@@ -0,0 +1 @@
+{{- include "nectarlib.openstack_api" (list $ . .Values.api) -}}
diff --git a/templates/bin/_fernet-manage.py.tpl b/templates/bin/_fernet-manage.py.tpl
@@ -0,0 +1,188 @@
+{{- define "fernet-manage" }}
+
+#!/usr/bin/env python
+
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+import argparse
+import base64
+import errno
+import grp
+import logging
+import os
+import pwd
+import re
+import subprocess  #nosec
+import sys
+import time
+
+import requests
+
+FERNET_DIR = os.environ['KEYSTONE_KEYS_REPOSITORY']
+KEYSTONE_USER = os.environ['KEYSTONE_USER']
+KEYSTONE_GROUP = os.environ['KEYSTONE_GROUP']
+NAMESPACE = os.environ['KUBERNETES_NAMESPACE']
+
+# k8s connection data
+KUBE_HOST = None
+KUBE_CERT = '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
+KUBE_TOKEN = None
+
+LOG_DATEFMT = "%Y-%m-%d %H:%M:%S"
+LOG_FORMAT = "%(asctime)s.%(msecs)03d - %(levelname)s - %(message)s"
+logging.basicConfig(format=LOG_FORMAT, datefmt=LOG_DATEFMT)
+LOG = logging.getLogger(__name__)
+LOG.setLevel(logging.INFO)
+
+
+def read_kube_config():
+    global KUBE_HOST, KUBE_TOKEN
+    KUBE_HOST = "https://%s:%s" % ('kubernetes.default',
+                                   os.environ['KUBERNETES_SERVICE_PORT'])
+    with open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r') as f:
+        KUBE_TOKEN = f.read()
+
+
+def get_secret_definition(name):
+    url = '%s/api/v1/namespaces/%s/secrets/%s' % (KUBE_HOST, NAMESPACE, name)
+    resp = requests.get(url,
+                        headers={'Authorization': 'Bearer %s' % KUBE_TOKEN},
+                        verify=KUBE_CERT)
+    if resp.status_code != 200:
+        LOG.error('Cannot get secret %s.', name)
+        LOG.error(resp.text)
+        return None
+    return resp.json()
+
+
+def update_secret(name, secret):
+    url = '%s/api/v1/namespaces/%s/secrets/%s' % (KUBE_HOST, NAMESPACE, name)
+    resp = requests.put(url,
+                        json=secret,
+                        headers={'Authorization': 'Bearer %s' % KUBE_TOKEN},
+                        verify=KUBE_CERT)
+    if resp.status_code != 200:
+        LOG.error('Cannot update secret %s.', name)
+        LOG.error(resp.text)
+        return False
+    return True
+
+
+def read_from_files():
+    keys = [name for name in os.listdir(FERNET_DIR) if os.path.isfile(FERNET_DIR + name)
+            and re.match("^\d+$", name)]
+    data = {}
+    for key in keys:
+        with open(FERNET_DIR + key, 'r') as f:
+            data[key] = f.read()
+    if len(list(keys)):
+        LOG.debug("Keys read from files: %s", keys)
+    else:
+        LOG.warning("No keys were read from files.")
+    return data
+
+
+def get_keys_data():
+    keys = read_from_files()
+    return dict([(key, base64.b64encode(value.encode()).decode())
+                for (key, value) in keys.items()])
+
+
+def write_to_files(data):
+    if not os.path.exists(os.path.dirname(FERNET_DIR)):
+        try:
+            os.makedirs(os.path.dirname(FERNET_DIR))
+        except OSError as exc: # Guard against race condition
+            if exc.errno != errno.EEXIST:
+                raise
+        uid = pwd.getpwnam(KEYSTONE_USER).pw_uid
+        gid = grp.getgrnam(KEYSTONE_GROUP).gr_gid
+        os.chown(FERNET_DIR, uid, gid)
+
+    for (key, value) in data.items():
+        with open(FERNET_DIR + key, 'w') as f:
+            decoded_value = base64.b64decode(value).decode()
+            f.write(decoded_value)
+            LOG.debug("Key %s: %s", key, decoded_value)
+    LOG.info("%s keys were written", len(data))
+
+
+def execute_command(cmd):
+    LOG.info("Executing 'keystone-manage %s --keystone-user=%s "
+             "--keystone-group=%s' command.",
+             cmd, KEYSTONE_USER, KEYSTONE_GROUP)
+    subprocess.call(['keystone-manage', cmd,  #nosec
+                     '--keystone-user=%s' % KEYSTONE_USER,
+                     '--keystone-group=%s' % KEYSTONE_GROUP])
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('command', choices=['fernet_setup', 'fernet_rotate',
+                                            'credential_setup',
+                                            'credential_rotate'])
+    args = parser.parse_args()
+
+    is_credential = args.command.startswith('credential')
+
+    SECRET_NAME = ('keystone-credential-keys' if is_credential else
+                   'keystone-fernet-keys')
+
+    read_kube_config()
+    secret = get_secret_definition(SECRET_NAME)
+    if not secret:
+        LOG.error("Secret '%s' does not exist.", SECRET_NAME)
+        sys.exit(1)
+
+    if args.command in ('fernet_rotate', 'credential_rotate'):
+        LOG.info("Copying existing %s keys from secret '%s' to %s.",
+                 'credential' if is_credential else 'fernet', SECRET_NAME,
+                 FERNET_DIR)
+        write_to_files(secret['data'])
+
+    if args.command in ('credential_setup', 'fernet_setup'):
+        if secret.get('data', False):
+            LOG.info('Keys already exist, skipping setup...')
+            sys.exit(0)
+
+    execute_command(args.command)
+
+    LOG.info("Updating data for '%s' secret.", SECRET_NAME)
+    updated_keys = get_keys_data()
+    secret['data'] = updated_keys
+    if not update_secret(SECRET_NAME, secret):
+        sys.exit(1)
+    LOG.info("%s fernet keys have been placed to secret '%s'",
+             len(updated_keys), SECRET_NAME)
+    LOG.debug("Placed keys: %s", updated_keys)
+    LOG.info("%s keys %s has been completed",
+             "Credential" if is_credential else 'Fernet',
+             "rotation" if args.command.endswith('_rotate') else "generation")
+
+    if args.command == 'credential_rotate':
+        # `credential_rotate` needs doing `credential_migrate` as well once all
+        # of the nodes have the new keys. So we'll sleep configurable amount of
+        # time to make sure k8s reloads the secrets in all pods and then
+        # execute `credential_migrate`.
+
+        migrate_wait = int(os.getenv('KEYSTONE_CREDENTIAL_MIGRATE_WAIT', "60"))
+        LOG.info("Waiting %d seconds to execute `credential_migrate`.",
+                 migrate_wait)
+        time.sleep(migrate_wait)
+
+        execute_command('credential_migrate')
+
+if __name__ == "__main__":
+    main()
+{{- end }}
diff --git a/templates/config-map.yaml b/templates/config-map.yaml
@@ -0,0 +1,4 @@
+{{- include "nectarlib.configmap" (list . "keystone.configmap") -}}
+{{- define "keystone.configmap" -}}
+data: {}
+{{- end -}}
diff --git a/templates/configmap-bin.yaml b/templates/configmap-bin.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keystone-bin
+data:
+  fernet-manage.py: |
+{{ include "fernet-manage" . | indent 4 }}
diff --git a/templates/cronjob-fernet-rotate.yaml b/templates/cronjob-fernet-rotate.yaml
diff --git a/templates/job-sync-db.yaml b/templates/job-sync-db.yaml
diff --git a/templates/serviceaccount.yaml b/templates/serviceaccount.yaml
diff --git a/values.yaml b/values.yaml

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+{`
	`2`	`+ "$schema": "https://docs.renovatebot.com/renovate-schema.json"`
	`3`	`+}`