Use Secret for st2.docker.conf instead of ConfigMap #408

Activity

1. cognifloyd commented on Apr 11, 2024

   

   cognifloyd

   on Apr 11, 2024

   Member

   More actions

   This is supported via st2.existingConfigSecret. You create a secret with your st2.conf contents, and then pass that secret name to the chart. It then gets mounted like this:
   

   stackstorm-k8s/templates/_helpers.tpl

   Lines 167 to 171 in fabbea9

   	{{- if $.Values.st2.existingConfigSecret }}
   	- name: st2-config-secrets-vol
   	mountPath: /etc/st2/st2.secrets.conf
   	subPath: st2.secrets.conf
   	{{- end }}

   
   

   stackstorm-k8s/templates/_helpers.tpl

   Lines 177 to 181 in fabbea9

   	{{- if $.Values.st2.existingConfigSecret }}
   	- name: st2-config-secrets-vol
   	secret:
   	secretName: {{ $.Values.st2.existingConfigSecret }}
   	{{- end }}

   The value is described here:
   

   stackstorm-k8s/values.yaml

   Lines 112 to 116 in fabbea9

   	# Custom StackStorm config (st2.secrets.conf) which will be created from the key 'st2.secrets.conf' within this secret.
   	# If this is defined, '--config-file=/etc/st2/st2.secrets.conf' will be added to the end of the command line arguments
   	# for all pods, superseding all other configuration values.
   	# This secret must be populated outside of this chart.
   	# existingConfigSecret: stackstorm-config-secret

   Does that resolve your concerns?
2. cognifloyd

   added

   enhancementNew feature or requestNew feature or request

   status:under discussion

   security

   proposal

   on Apr 11, 2024
3. akshat-rubrik commented on Aug 14, 2024

   

   akshat-rubrik

   on Aug 14, 2024

   More actions

   Can we add this to docs please?
4. fdrab commented on Aug 15, 2024

   

   fdrab

   on Aug 15, 2024

   Last edited by fdrab

   More actions

   I'm using the existingConfig and now I have a secret called st2-secrets-conf that contains the DB / LDAP / RabbitMQ connection info and also a configMap called -st2-config that contains both st2.docker.conf that contains redis and rabbitMQ connection info in clear text.

   And I think that the only reason I don't have Mongo connection info there as well is that I'm not using the mongo chart.

   imo there should be a way to force the installation to only accept credentials from secrets.