8000 add authentication to http variable source · Issue #1143 · kluctl/kluctl · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

add authentication to http variable source #1143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
6 of 13 tasks
selfisch opened this issue Jul 20, 2024 · 0 comments
Open
6 of 13 tasks

add authentication to http variable source #1143

selfisch opened this issue Jul 20, 2024 · 0 comments

Comments

@selfisch
Copy link
selfisch commented Jul 20, 2024 •
edited
Loading

Command

  • check-image-updates
  • delete
  • deploy
  • diff
  • helm-pull
  • helm-update
  • list-images
  • list-targets
  • poke-images
  • prune
  • render
  • validate
  • version

Who are you?

Platform Engineer at E3DC/Hagerenergy

What do you want to do?

We have several teams, developing applications and managing their code via git(Gitlab). These application getting deployed to kubernetes more and more and we want to implement the kluctl-controller for pull based deployments more and more.
To enable the application teams to decide about this deployments and the versions for each environment on their own, we somehow need a solution, to pin the docker image tag to the kubernetes deployment in this pull based scenario.

We want to configure the kluctldeployments, to pull the application deployment from the application repo, where we also store the application specific kubernetes manifest files, so the kluctldeployment is using the git source and as ref a git tag in the application repo.
This git tag inside the application repo, is named like the kubernetes target/environment and points to the commit, the application teams wants to be deployed to the environment. During the build process, the commit sha will be added to the docker image in the registry.

In the kubernetes deployment, we define the http variable source, to pull the gitlab tag manifest from the api, to use the commit sha as docker image tag. Currently it looks like this:

deployments:
  - path: deployment
    vars:
      - http:
          url: https://gitlab.com/api/v4/projects/114/repository/tags/{{ args.target_name }}?private_token={{ args.gitlab_token }}
        targetPath: gitInfo

and the kubernetes deployment image definition like this:

spec:
  template:
    spec:
      containers:
	- name: <application>
	  image: <docker-registry>/<application>:{{ gitInfo.target }}

As you can see, we are templating the target and token already and injecting this through the kluctldeployment from sops secrets. But in this case, the token is deployed or shown plaintext somewhere.

Why do you need that?

Long story short, it would be nice, to have some kind of authentication method added to the http variable source. Maybe a kind of secretRef, so the token is obfiscated in pipelines and during deployments.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@selfisch
0