Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: read DB secrets and API key from vault #35

Merged
merged 9 commits into from
Apr 23, 2024
Merged

feat: read DB secrets and API key from vault #35

merged 9 commits into from
Apr 23, 2024

Conversation

paullatzelsperger
Copy link
Contributor

@paullatzelsperger paullatzelsperger commented Apr 22, 2024 •
edited
Loading

WHAT

This PR adds several linked features:

  • adds Hashicorp Vault runtime modules to the standard distribution
  • DB user and password are now taken from the Vault instead of application config/env-vars
  • the Mgmt API auth token is now taken from the Vault instead of the application config/env-vars, only the alias can be configured (default="mgmt-api-key")
  • a new test values file (system-tests/helm/values-vault-test.yaml) configures the vault accordingly
  • a helm-test to reach the management API was dropped, as that is part of the deployment test

WHY

Security

FURTHER NOTES

  • please note that going forward, the Vault must be deployed independently to avoid race conditions with the BDRS server deployment
  • uses EDC 0.6.2-SNAPSHOT - we should pin the version again once a 0.6.2 or a nightly is available

Closes # <-- insert Issue number if one exists

@paullatzelsperger paullatzelsperger added the enhancement New feature or request label Apr 22, 2024
@paullatzelsperger paullatzelsperger force-pushed the feat/read_secrets_from_vault branch from b2a3780 to d353ac2 Compare April 22, 2024 12:52
@paullatzelsperger paullatzelsperger force-pushed the feat/read_secrets_from_vault branch from 0006278 to b387216 Compare April 22, 2024 13:37
@paullatzelsperger paullatzelsperger force-pushed the feat/read_secrets_from_vault branch from da3e1fd to 8fbf381 Compare April 22, 2024 14:14
@paullatzelsperger paullatzelsperger marked this pull request as ready for review April 22, 2024 14:25
evegufy
evegufy approved these changes Apr 23, 2024
View reviewed changes
Copy link
Contributor

@evegufy evegufy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm and tested successfully, could you please also release a new version?

@evegufy evegufy mentioned this pull request Apr 23, 2024
Closed
2 tasks
@paullatzelsperger paullatzelsperger merged commit f4f1696 into main Apr 23, 2024
2 checks passed
@paullatzelsperger paullatzelsperger deleted the feat/read_secrets_from_vault branch April 23, 2024 06:42
paullatzelsperger added a commit that referenced this pull request Apr 25, 2024
@github-actions @eclipse-tractusx-bot
@paullatzelsperger @dependabot
Release version 0.0.3 (#38)
8788f60 
* chore(build): adapt to latest upstream EDC

* feat: add ingress example + tests (#28)

* build(deps): bump aquasecurity/trivy-action from 0.18.0 to 0.19.0 (#26)

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@0.18.0...0.19.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump flyway from 10.10.0 to 10.11.0 (#27)

Bumps `flyway` from 10.10.0 to 10.11.0.

Updates `org.flywaydb:flyway-core` from 10.10.0 to 10.11.0
- [Release notes](https://github.com/flyway/flyway/releases)
- [Commits](flyway/flyway@flyway-10.10.0...flyway-10.11.0)

Updates `org.flywaydb:flyway-database-postgresql` from 10.10.0 to 10.11.0

---
updated-dependencies:
- dependency-name: org.flywaydb:flyway-core
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.flywaydb:flyway-database-postgresql
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add Authorization header validation (#29)

* feat: add auth service

* checkstyle

* DEPENDENCIES

* update gradle task dependencies

* expect 401 on directory ingress

* DEPENDENCIES

* chore: bump EDC to 0.6.1

* feat: add K8s ingress for Mgmt API (#33)

* feat: read DB secrets and API key from vault (#35)

* feat: read db config and api key from vault

* helm docs, lint

* DEPENDENCIES

* separate vault deployment in test

* wait for ready pods

* add hashicorp rep

* change readiness condition

* change wait condition again

* added comment [skip ci]

* build(deps): bump azure/setup-helm from 3.5 to 4 (#30)

Bumps [azure/setup-helm](https://github.com/azure/setup-helm) from 3.5 to 4.
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-helm@v3.5...v4)

---
updated-dependencies:
- dependency-name: azure/setup-helm
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump azure/setup-kubectl from 3.2 to 4 (#31)

Bumps [azure/setup-kubectl](https://github.com/azure/setup-kubectl) from 3.2 to 4.
- [Release notes](https://github.com/azure/setup-kubectl/releases)
- [Changelog](https://github.com/Azure/setup-kubectl/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-kubectl@v3.2...v4)

---
updated-dependencies:
- dependency-name: azure/setup-kubectl
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump checkmarx/kics-github-action from 1.6 to 2 (#36)

Bumps [checkmarx/kics-github-action](https://github.com/checkmarx/kics-github-action) from 1.6 to 2.
- [Release notes](https://github.com/checkmarx/kics-github-action/releases)
- [Commits](Checkmarx/kics-github-action@v1.6...v2)

---
updated-dependencies:
- dependency-name: checkmarx/kics-github-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump flyway from 10.11.0 to 10.11.1 (#37)

* build(deps): bump flyway from 10.11.0 to 10.11.1

Bumps `flyway` from 10.11.0 to 10.11.1.

Updates `org.flywaydb:flyway-core` from 10.11.0 to 10.11.1
- [Release notes](https://github.com/flyway/flyway/releases)
- [Commits](flyway/flyway@flyway-10.11.0...flyway-10.11.1)

Updates `org.flywaydb:flyway-database-postgresql` from 10.11.0 to 10.11.1

---
updated-dependencies:
- dependency-name: org.flywaydb:flyway-core
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.flywaydb:flyway-database-postgresql
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* DEPENDENCIES

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Paul Latzelsperger <[email protected]>

* chore: pin EDC version to 0.6.2

* chore: add debug lines for auth

* fix: use correct image in chart

* Prepare release 0.0.3

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: eclipse-tractusx-bot <[email protected]>
Co-authored-by: Paul Latzelsperger <[email protected]>
Co-authored-by: Paul Latzelsperger <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@evegufy evegufy evegufy approved these changes

@jimmarino jimmarino Awaiting requested review from jimmarino

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@paullatzelsperger @evegufy