fix keycloak-configure secrets drift #506
Conversation
dosubot
bot
added
the
size:L
WalkthroughThe pull request modifies the Changes
Possibly related PRs
Suggested labels
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
klinch0
force-pushed
the
bugfix/fix-draft
branch
from
9ea2b25 to
142790d
Compare
dosubot
bot
added
size:XS
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's limits when posting large numbers of comments.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (2)
packages/system/keycloak-configure/templates/configure-kk.yaml (2)
33-62: Enhance secret security configurationConsider adding the following security improvements to the secret definitions:
- Add
immutable: trueto prevent accidental updates- Add labels for secret rotation management
- Consider using a more specific secret type than
OpaqueExample enhancement:
apiVersion: v1 kind: Secret metadata: name: k8s-client namespace: {{ .Release.Namespace }} + labels: + secret-rotation: enabled + secret-rotation-period: "30d" type: Opaque +immutable: true data: client-secret-key: {{ $k8sClient | b64enc }}
Line range hint
154-161: Security: Address insecure configuration settingsSeveral security concerns in the auth configuration:
--ssl-insecure-skip-verifydisables SSL certificate verification, which is unsafe--cookie-secure=falseallows cookies over non-HTTPS connections- Sensitive auth configuration in ConfigMap instead of Secret
Recommendations:
- Remove
--ssl-insecure-skip-verifyand properly configure SSL certificates- Enable secure cookies unless there's a specific requirement for HTTP
- Consider moving sensitive auth configuration to a Secret
extraFlags: - - --ssl-insecure-skip-verify - - --cookie-secure=false + - --cookie-secure=true - --scope=openid email groups
🛑 Comments failed to post (1)
packages/system/keycloak-configure/templates/configure-kk.yaml (1)
10-29:
⚠️ Potential issueCritical: Fix variable assignment in secret generation logic
The current implementation has a serious issue with variable scoping that will result in empty secrets. The
:=operator creates new variables in the if/else blocks instead of assigning values to the outer variables.Apply this fix to all three secret blocks:
-{{ $k8sClient := "" }} +{{ $k8sClient := "" -}} {{- if $existingK8sSecret }} - {{- $k8sClient := index $existingK8sSecret.data "client-secret-key" | b64dec }} + {{- $k8sClient = index $existingK8sSecret.data "client-secret-key" | b64dec }} {{- else }} - {{- $k8sClient := randAlphaNum 32 }} + {{- $k8sClient = randAlphaNum 32 }} {{- end }}Similar changes needed for
$kubeappsClientand$cookieSecretblocks. Use=for assignment instead of:=to modify the existing variables.Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 14-14: wrong indentation: expected 0 but found 2
(indentation)
[warning] 19-19: wrong indentation: expected 0 but found 2
(indentation)
[warning] 21-21: wrong indentation: expected 0 but found 2
(indentation)
[warning] 26-26: wrong indentation: expected 0 but found 2
(indentation)
[warning] 28-28: wrong indentation: expected 0 but found 2
(indentation)
dosubot
bot
added
size:M
klinch0
force-pushed
the
bugfix/fix-draft
branch
from
ad37315 to
13d01c6
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (2)
packages/system/keycloak-configure/templates/configure-kk.yaml (2)
10-29: Consider refactoring duplicated secret handling logicThe secret handling logic is duplicated three times with slight variations. Consider creating a template helper function to reduce duplication and standardize the approach.
Example helper function:
{{- define "getOrGenerateSecret" }} {{- $existing := index . 0 }} {{- $length := index . 1 }} {{- $result := "" }} {{- if $existing }} {{- $result = index $existing.data "client-secret-key" | b64dec }} {{- else }} {{- $result = randAlphaNum $length }} {{- end }} {{- $result }} {{- end }}Then use it like:
{{- $k8sClient := include "getOrGenerateSecret" (list $existingK8sSecret 32) }}🧰 Tools
🪛 yamllint (1.35.1)
[warning] 14-14: wrong indentation: expected 0 but found 2
(indentation)
[warning] 19-19: wrong indentation: expected 0 but found 2
(indentation)
[warning] 21-21: wrong indentation: expected 0 but found 2
(indentation)
[warning] 26-26: wrong indentation: expected 0 but found 2
(indentation)
[warning] 28-28: wrong indentation: expected 0 but found 2
(indentation)
33-63: Enhance secret management with metadata and immutabilityConsider adding the following improvements to the Secret resources:
- Add labels for better resource management
- Consider setting
immutable: trueto prevent accidental updates- Add annotations to document the purpose of each secret
Example enhancement for k8s-client secret:
apiVersion: v1 kind: Secret metadata: name: k8s-client namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: keycloak + app.kubernetes.io/component: client-secret + annotations: + description: "Secret for Kubernetes client authentication with Keycloak" type: Opaque +immutable: true data: client-secret-key: {{ $k8sClient | b64enc }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
packages/system/keycloak-configure/templates/configure-kk.yaml(2 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
packages/system/keycloak-configure/templates/configure-kk.yaml
[warning] 14-14: wrong indentation: expected 0 but found 2
(indentation)
[warning] 19-19: wrong indentation: expected 0 but found 2
(indentation)
[warning] 21-21: wrong indentation: expected 0 but found 2
(indentation)
[warning] 26-26: wrong indentation: expected 0 but found 2
(indentation)
[warning] 28-28: wrong indentation: expected 0 but found 2
(indentation)
🔇 Additional comments (1)
packages/system/keycloak-configure/templates/configure-kk.yaml (1)
6-8: Verify impact on existing deployments
The new secret lookup logic changes how secrets are managed. Please ensure this change doesn't affect existing deployments during upgrades.
✅ Verification successful
Based on the search results, I can now provide a final response about the secret lookup changes:
Secret lookups are used safely with proper fallback handling
The code changes are safe for existing deployments because:
- The lookups are used in a read-only manner to check for existing secrets
- The code has proper conditional logic after the lookups (
{{- if $existingK8sSecret }}) - These secrets are referenced consistently across the codebase in
packages/apps/tenant/templates/kubeconfig.yamlandpackages/system/keycloak-configure/templates/configure-kk.yaml - The namespaces are explicitly specified, preventing any unintended cross-namespace access
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check for existing secrets in the cluster that might be affected
kubectl get secrets -A | grep -E 'k8s-client|kubeapps-client|kubeapps-auth-config'
# Check if any pods are using these secrets
kubectl get pods -A -o json | jq '.items[] | select(.spec.volumes[]?.secret?.secretName | select(. == "k8s-client" or . == "kubeapps-client" or . == "kubeapps-auth-config")) | {namespace: .metadata.namespace, pod: .metadata.name, secret: .spec.volumes[].secret.secretName}'
Length of output: 556
Script:
#!/bin/bash
# Let's analyze the Helm chart to understand the impact of these secret lookups
# First, check if these secrets are referenced in other templates
fd -e yaml -e tpl | xargs rg -l "k8s-client|kubeapps-client|kubeapps-auth-config"
# Check for any conditional logic or default values related to these secrets
fd -e yaml -e tpl | xargs rg -A 5 -B 5 "lookup.*Secret.*k8s-client|lookup.*Secret.*kubeapps-client|lookup.*Secret.*kubeapps-auth-config"
# Check values.yaml for any related configurations
fd "values.yaml" | xargs cat
Length of output: 65817
| @@ -168,7 +208,7 @@ data: | |||
| provider: "oidc" | |||
| clientID: "kubeapps" | |||
| clientSecret: {{ $kubeappsClient }} | |||
| cookieSecret: {{ randAlphaNum 16 | b64enc | quote }} | |||
| cookieSecret: {{ $cookieSecret }} | |||
There was a problem hiding this comment.
Security concern: Plain text secrets in ConfigMap
The cookieSecret is stored as plain text in the ConfigMap. Consider using a Secret resource or a secure external secret management solution for sensitive values.
Consider using one of these approaches:
- Use Kubernetes Secrets and mount them as environment variables
- Implement HashiCorp Vault integration
- Use Sealed Secrets for encrypted secret management
Would you like me to provide an example implementation for any of these approaches?
| {{- $rootSaConfigMap := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }} | ||
| {{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }} | ||
| {{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }} |
There was a problem hiding this comment.
Add null check for CA certificate
The code assumes $rootSaConfigMap exists and contains ca.crt. Add a null check to handle cases where the ConfigMap might not exist.
-{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
+{{- $k8sCa := "" }}
+{{- if and $rootSaConfigMap (hasKey $rootSaConfigMap.data "ca.crt") }}
+ {{- $k8sCa = index $rootSaConfigMap.data "ca.crt" | b64enc }}
+{{- end }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| {{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }} | |
| {{- $k8sCa := "" }} | |
| {{- if and $rootSaConfigMap (hasKey $rootSaConfigMap.data "ca.crt") }} | |
| {{- $k8sCa = index $rootSaConfigMap.data "ca.crt" | b64enc }} | |
| {{- end }} |
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced management of Kubernetes secrets for `k8s-client`, `kubeapps-client`, and `kubeapps-auth-config`. - Improved handling of client secrets by reusing existing configurations when available. - **Bug Fixes** - Addressed issues with static secret definitions, streamlining the configuration process. - **Chores** - Removed outdated secret and Keycloak client definitions for cleaner configuration management. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Summary by CodeRabbit
New Features
k8s-client,kubeapps-client, andkubeapps-auth-config.Bug Fixes
Chores