Parameterize the initdb passwords so they're not in plain text in the…

… ConfigMap

Signed-off-by: Pato Arvizu <patoarvizu@gmail.com>

helm/sql/mysql-initdb.d/initial-notaryserver.sql

@@ -1,6 +1,6 @@
 CREATE DATABASE IF NOT EXISTS `notaryserver`;
 
-CREATE USER "{{ .Values.server.storageCredentials.user }}"@"%" IDENTIFIED BY "{{ .Values.server.storageCredentials.password }}";
+CREATE USER "{{ .Values.server.storageCredentials.user }}"@"%" IDENTIFIED BY "%% .Env.SERVERPASSWORD %%";
 
 GRANT
 	ALL PRIVILEGES ON `notaryserver`.* 

helm/sql/mysql-initdb.d/initial-notarysigner.sql

@@ -1,6 +1,6 @@
 CREATE DATABASE IF NOT EXISTS `notarysigner`;
 
-CREATE USER "{{ .Values.signer.storageCredentials.user }}"@"%" IDENTIFIED BY "{{ .Values.server.storageCredentials.password }}";
+CREATE USER "{{ .Values.signer.storageCredentials.user }}"@"%" IDENTIFIED BY "%% .Env.SIGNERPASSWORD %%";
 
 GRANT
 	ALL PRIVILEGES ON `notarysigner`.* 

helm/sql/postgresql-initdb.d/initial-notaryserver.sql

@@ -1,3 +1,3 @@
 CREATE DATABASE notaryserver;
-CREATE USER {{ .Values.server.storageCredentials.user }};
+CREATE USER {{ .Values.server.storageCredentials.user }} WITH PASSWORD '%% .Env.SERVERPASSWORD %%';
 GRANT ALL PRIVILEGES ON DATABASE notaryserver TO {{ .Values.server.storageCredentials.user }};

helm/sql/postgresql-initdb.d/initial-notarysigner.sql

@@ -1,3 +1,3 @@
 CREATE DATABASE notarysigner;
-CREATE USER {{ .Values.signer.storageCredentials.user }};
+CREATE USER {{ .Values.signer.storageCredentials.user }} WITH PASSWORD '%% .Env.SIGNERPASSWORD %%';
 GRANT ALL PRIVILEGES ON DATABASE notarysigner TO {{ .Values.signer.storageCredentials.user }};

helm/templates/deployments.yaml

@@ -15,6 +15,49 @@ spec:
         app.kubernetes.io/name: notary
         app.kubernetes.io/component: notary-db
     spec:
+      initContainers:
+      - command:
+        - /gomplate
+        - --left-delim
+        - '%%'
+        - --right-delim
+        - '%%'
+        - --input-dir
+        - /sql-init-templates
+        - --output-dir
+        - /docker-entrypoint-initdb.d
+        image: hairyhenderson/gomplate:v3
+        name: gomplate
+        env:
+        - name: SERVERPASSWORD
+          {{- if .Values.server.storageCredentials.password }}
+          valueFrom:
+            secretKeyRef:
+              name: server-password
+              key: password
+          {{- else }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.server.storageCredentials.passwordSecretName }}
+              key: {{ .Values.server.storageCredentials.passwordSecretKey }}
+          {{- end }}
+        - name: SIGNERPASSWORD
+          {{- if .Values.signer.storageCredentials.password }}
+          valueFrom:
+            secretKeyRef:
+              name: signer-password
+              key: password
+          {{- else }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.signer.storageCredentials.passwordSecretName }}
+              key: {{ .Values.signer.storageCredentials.passwordSecretKey }}
+          {{- end }}
+        volumeMounts:
+        - mountPath: /docker-entrypoint-initdb.d
+          name: sql-init
+        - mountPath: /sql-init-templates
+          name: notarysql
       containers:
       {{- if eq .Values.storage.flavor "mysql" }}
       - args:
@@ -51,6 +94,8 @@ spec:
           name: notary-data
       {{- end }}
         - mountPath: /docker-entrypoint-initdb.d
+          name: sql-init
+        - mountPath: /sql-init-templates
           name: notarysql
       volumes:
       - name: notary-data
@@ -59,6 +104,8 @@ spec:
       - name: notarysql
         configMap:
           name: notarysql
+      - name: sql-init
+        emptyDir: {}
 
 ---