CH-232 support cross-application secrets

Author: filippomc

application-templates/django-fastapi/backend/README.md

@@ -15,7 +15,7 @@ Python >= 3
 # store the accounts api admin password on the local disk
 
 mkdir -p /opt/cloudharness/resources/auth/
-kubectl -n mnp get secrets accounts -o yaml|grep api_user_password|cut -d " " -f 4|base64 -d > /opt/cloudharness/resources/auth/api_user_password
+kubectl -n mnp get secrets accounts -o yaml|grep api_user_password|cut -d " " -f 4|base64 -d > /opt/cloudharness/resources/accounts/api_user_password
 
 # Make the cloudharness application configuration available on your local machine
 cp deployment/helm/values.yaml /opt/cloudharness/resources/allvalues.yaml

applications/accounts/scripts/create_api_user.sh

@@ -1,9 +1,10 @@
 #!/bin/bash
 
 export API_USERNAME="admin_api"
-export API_PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password 2>/dev/null || echo "")
+export API_PASSWORD=$(cat /opt/cloudharness/resources/accounts/api_user_password 2>/dev/null || echo "")
 export TMP_CLIENT="tmp_api_client"
 export TMP_CLIENT_SECRET="${KC_BOOTSTRAP_ADMIN_USERNAME}"
+export ACCOUNTS_SERVICE_PORT=8080
 
 check_kc_ready() {
     if echo >/dev/tcp/127.0.0.1/${ACCOUNTS_SERVICE_PORT}; then

deployment-configuration/helm/templates/_helpers.tpl

@@ -10,12 +10,8 @@ Create chart name and version as used by the chart label.
 For custom images: if images are coming from local(e.g minikube) registry, image pull policy is "Never". Otherwise it is "IfNotPresent"
 */}}
 {{- define "deploy_utils.pullpolicy" -}}
-{{- if and .Values.local (not .Values.registry.name) -}}
-{{- print "Never" -}}
-{{- else -}}
 {{- print "IfNotPresent" -}}
 {{- end -}}
-{{- end -}}
 {{/*
 Add environmental variables to all containers
 */}}

deployment-configuration/helm/templates/auto-deployments.yaml

@@ -112,11 +112,22 @@ spec:
           - name: cloudharness-allvalues
             mountPath: /opt/cloudharness/resources
             readOnly: true
-          {{- if or (has  "accounts" .app.harness.dependencies.hard) (eq .app.harness.name "accounts") }}
-          - name: cloudharness-kc-accounts
+          {{- $root := .root }}
+          {{- range $dep := concat .app.harness.dependencies.hard .app.harness.dependencies.soft }}
+          {{- $depApp := index $root.Values.apps $dep }}
+          {{- if $depApp.harness.secrets }}
+          - name: cloudharness-{{ $dep }}
+            mountPath: /opt/cloudharness/resources/secrets/{{ $dep }}
+            readOnly: true
+          {{- end }}
+          {{- if or (has  "accounts" .app.harness.dependencies.hard) (eq .app.harness.name "accounts") }} 
+          {{/* legacy path for accounts auth resources mount */}}
+          {{- if eq $dep "accounts" }}
+          - name: cloudharness-accounts
             mountPath: /opt/cloudharness/resources/auth
             readOnly: true
           {{- end }}
+          {{- end }}
           {{- if  .app.harness.deployment.volume }}
           - name: {{ .app.harness.deployment.volume.name }}
             mountPath: {{ .app.harness.deployment.volume.mountpath }}
@@ -131,17 +142,21 @@ spec:
           {{- end}}
           {{- if .app.harness.secrets }}
           - name: secrets
-            mountPath: "/opt/cloudharness/resources/secrets"
+            mountPath: "/opt/cloudharness/resources/secrets/{{ .app.harness.name }}"
             readOnly: true
           {{- end }}
       volumes:
         - name: cloudharness-allvalues
           configMap:
             name: cloudharness-allvalues
-        {{- if or (has  "accounts" .app.harness.dependencies.hard) (eq .app.harness.name "accounts") }}
-        - name: cloudharness-kc-accounts
+        {{- $root := .root }}
+        {{- range $dep := concat .app.harness.dependencies.hard .app.harness.dependencies.soft }}
+        {{- $depApp := index $root.Values.apps $dep }}
+        {{- if $depApp.harness.secrets }}
+        - name: cloudharness-{{ $dep }}
           secret:
-            secretName: accounts
+            secretName: {{ $dep }}
+        {{- end }}
         {{- end }}
         {{- if .app.harness.deployment.volume }}
         - name: {{ .app.harness.deployment.volume.name }}