Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix keycloak secrets drift #507

Closed
wants to merge 3 commits into from
+61 −22
Closed

fix keycloak secrets drift #507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
992db51
fix kk secrets draft
klinch0 Dec 4, 2024
13d01c6
fix
klinch0 Dec 4, 2024
f91cc56
fix draft password
klinch0 Dec 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 56 additions & 22 deletions packages/system/keycloak-configure/templates/configure-kk.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,61 @@
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
{{- $host := index $cozyConfig.data "root-host" }}
{{- $k8sClient := randAlphaNum 32 -}}
{{- $kubeappsClient := randAlphaNum 32 -}}
{{- $rootSaConfigMap := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }}
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}

{{- $existingK8sSecret := lookup "v1" "Secret" .Release.Namespace "k8s-client" }}
{{- $existingKubeappsSecret := lookup "v1" "Secret" .Release.Namespace "kubeapps-client" }}
{{- $existingAuthConfig := lookup "v1" "Secret" "cozy-dashboard" "kubeapps-auth-config" }}

{{ $k8sClient := randAlphaNum 32 }}
{{- if $existingK8sSecret }}
{{- $k8sClient = index $existingK8sSecret.data "client-secret-key" | b64dec }}
{{- end }}

{{ $kubeappsClient := randAlphaNum 32 }}
{{- if $existingKubeappsSecret }}
{{- $kubeappsClient = index $existingKubeappsSecret.data "client-secret-key" | b64dec }}
{{- end }}

{{ $cookieSecret := randAlphaNum 16 }}
{{- if $existingAuthConfig }}
{{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
{{- end }}
Comment on lines +20 to +23
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Increase cookie secret length

For cookie signing, 16 characters might not provide sufficient entropy. Consider increasing the length to 32 characters to align with security best practices.

-{{ $cookieSecret := randAlphaNum 16 }}
+{{ $cookieSecret := randAlphaNum 32 }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{{ $cookieSecret := randAlphaNum 16 }}
{{- if $existingAuthConfig }}
{{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
{{- end }}
{{ $cookieSecret := randAlphaNum 32 }}
{{- if $existingAuthConfig }}
{{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
{{- end }}
🧰 Tools
🪛 yamllint (1.35.1)

[warning] 22-22: wrong indentation: expected 0 but found 2

(indentation)


---

apiVersion: v1
kind: Secret
metadata:
name: k8s-client
namespace: {{ .Release.Namespace }}
type: Opaque
data:
client-secret-key: {{ $k8sClient | b64enc }}

---

apiVersion: v1
kind: Secret
metadata:
name: kubeapps-client
namespace: {{ .Release.Namespace }}
type: Opaque
data:
client-secret-key: {{ $kubeappsClient | b64enc }}

---

apiVersion: v1
kind: Secret
metadata:
name: kubeapps-auth-config
namespace: cozy-dashboard
type: Opaque
data:
cookieSecret: {{ $cookieSecret | b64enc }}

---

apiVersion: v1.edp.epam.com/v1alpha1
kind: ClusterKeycloak
Expand Down Expand Up @@ -54,14 +106,6 @@ spec:

---

apiVersion: v1
kind: Secret
metadata:
name: k8s-client
type: Opaque
stringData:
client-secret-key: {{ $k8sClient }}

---

apiVersion: v1.edp.epam.com/v1
Expand Down Expand Up @@ -119,16 +163,6 @@ spec:

---

apiVersion: v1
kind: Secret
metadata:
name: kubeapps-client
type: Opaque
stringData:
client-secret-key: {{ $kubeappsClient }}

---

apiVersion: v1.edp.epam.com/v1
kind: KeycloakClient
metadata:
Expand Down Expand Up @@ -168,7 +202,7 @@ data:
provider: "oidc"
clientID: "kubeapps"
clientSecret: {{ $kubeappsClient }}
cookieSecret: {{ randAlphaNum 16 | b64enc | quote }}
cookieSecret: {{ $cookieSecret }}
extraFlags:
- --ssl-insecure-skip-verify
- --cookie-secure=false
Expand Down
5 changes: 5 additions & 0 deletions packages/system/keycloak/templates/sts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
{{- $host := index $cozyConfig.data "root-host" }}

{{- $existingPassword := lookup "v1" "Secret" "cozy-keycloak" "{{ .Release.Name }}-credentials" }}
{{- $password := randAlphaNum 16 -}}
{{- if $existingPassword }}
{{- $password = index $existingPassword.data "password" | b64dec }}
{{- end }}

apiVersion: v1
kind: Secret
Expand Down