Add cron jobs to helm chart to purge and rotate secrets (#3460)

This adds jobs so we can purge sessions and rotate provider secrets in an automated fashion. Related-To: #3315 Signed-off-by: Juan Antonio Osorio <[email protected]> Co-authored-by: Don Browne <[email protected]>
mindersec · May 31, 2024 · 4bb3350 · 4bb3350
1 parent fee0d92
commit 4bb3350
Show file tree

Hide file tree

Showing 3 changed files with 178 additions and 0 deletions.
diff --git a/deployment/helm/templates/rotate_provider_tokens.yaml b/deployment/helm/templates/rotate_provider_tokens.yaml
@@ -0,0 +1,77 @@
+# Copyright 2024 Stacklok, Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note that this assumes read/write permissions to the provider_access_tokens database
+# table.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: rotate-provider-tokens
+spec:
+  schedule: {{ .Values.rotateProviderTokensJobSettings.schedule | quote }}
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: {{ .Values.serviceAccounts.rotateProviderTokensJob | default "minder" }}
+          containers:
+          - name: rotator
+            image: {{ .Values.rotateProviderTokensJobSettings.image }}
+            # restricted security context:
+            # https://kubernetes.io/docs/concepts/security/pod-security-standards/
+            securityContext:
+              allowPrivilegeEscalation: false
+              runAsNonRoot: true
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop:
+                  - ALL
+            args:
+              - encryption
+              - rotate-provider-tokens
+              - "--yes"
+              - "--config=/config/server-config.yaml"
+              # We use two config files, one with all the defaults, and one with
+              # additional override values from helm.  (This is a viper feature.)
+              - "--config=/config/overrides.yaml"
+            imagePullPolicy: {{ .Values.rotateProviderTokensJobSettings.imagePullPolicy }}
+            resources:
+              {{- toYaml .Values.rotateProviderTokensJobSettings.resources | nindent 14 }}
+            {{- if .Values.rotateProviderTokensJobSettings.extraEnv }}
+            env:
+              {{- toYaml .Values.rotateProviderTokensJobSettings.extraEnv | nindent 14 }}
+            {{- end }}
+            volumeMounts:
+              - name: config
+                mountPath: /config
+              {{- if .Values.rotateProviderTokensJobSettings.extraVolumeMounts }}
+              {{- toYaml .Values.rotateProviderTokensJobSettings.extraVolumeMounts | nindent 14 }}
+              {{- end }}
+          {{- if .Values.rotateProviderTokensJobSettings.sidecarContainers }}
+          {{- toYaml .Values.rotateProviderTokensJobSettings.sidecarContainers | nindent 10 }}
+          {{- end }}
+          restartPolicy: {{ .Values.rotateProviderTokensJobSettings.restartPolicy | quote }}
+          volumes:
+          - name: config
+            configMap:
+              name: db-update-config
+              items:
+              - key: server-config.yaml
+                path: server-config.yaml
+              - key: overrides.yaml
+                path: overrides.yaml
+          {{- if .Values.rotateProviderTokensJobSettings.extraVolumes }}
+          {{- toYaml .Values.rotateProviderTokensJobSettings.extraVolumes | nindent 10 }}
+          {{- end }}
diff --git a/deployment/helm/templates/session_expiration_purge_job.yaml b/deployment/helm/templates/session_expiration_purge_job.yaml
@@ -0,0 +1,77 @@
+# Copyright 2024 Stacklok, Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note that this assumes read/write permissions to the session_store database
+# table.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: session-expiration-purge
+spec:
+  schedule: {{ .Values.sessionExpirationPurgeJobSettings.schedule | quote }}
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: {{ .Values.serviceAccounts.sessionExpirationPurgeJob | default "minder" }}
+          containers:
+          - name: purger
+            image: {{ .Values.sessionExpirationPurgeJobSettings.image }}
+            # restricted security context:
+            # https://kubernetes.io/docs/concepts/security/pod-security-standards/
+            securityContext:
+              allowPrivilegeEscalation: false
+              runAsNonRoot: true
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop:
+                  - ALL
+            args:
+              - encryption
+              - purge-sessions
+              - "--yes"
+              - "--config=/config/server-config.yaml"
+              # We use two config files, one with all the defaults, and one with
+              # additional override values from helm.  (This is a viper feature.)
+              - "--config=/config/overrides.yaml"
+            imagePullPolicy: {{ .Values.sessionExpirationPurgeJobSettings.imagePullPolicy }}
+            resources:
+              {{- toYaml .Values.sessionExpirationPurgeJobSettings.resources | nindent 14 }}
+            {{- if .Values.sessionExpirationPurgeJobSettings.extraEnv }}
+            env:
+              {{- toYaml .Values.sessionExpirationPurgeJobSettings.extraEnv | nindent 14 }}
+            {{- end }}
+            volumeMounts:
+              - name: config
+                mountPath: /config
+              {{- if .Values.sessionExpirationPurgeJobSettings.extraVolumeMounts }}
+              {{- toYaml .Values.sessionExpirationPurgeJobSettings.extraVolumeMounts | nindent 14 }}
+              {{- end }}
+          {{- if .Values.sessionExpirationPurgeJobSettings.sidecarContainers }}
+          {{- toYaml .Values.sessionExpirationPurgeJobSettings.sidecarContainers | nindent 10 }}
+          {{- end }}
+          restartPolicy: {{ .Values.sessionExpirationPurgeJobSettings.restartPolicy | quote }}
+          volumes:
+          - name: config
+            configMap:
+              name: db-update-config
+              items:
+              - key: server-config.yaml
+                path: server-config.yaml
+              - key: overrides.yaml
+                path: overrides.yaml
+          {{- if .Values.sessionExpirationPurgeJobSettings.extraVolumes }}
+          {{- toYaml .Values.sessionExpirationPurgeJobSettings.extraVolumes | nindent 10 }}
+          {{- end }}
diff --git a/deployment/helm/values.yaml b/deployment/helm/values.yaml
@@ -58,6 +58,8 @@ serviceAccounts:
   migrate: ""
   # -- (string, optional) If non-empty, minder will use the named ServiceAccount resources rather than creating a ServiceAccount
   server: ""
+  sessionExpirationPurgeJob: ""
+  rotateProviderTokensJob: ""
 
 # ingress settings
 ingress:
@@ -139,6 +141,28 @@ deploymentSettings:
       # -- (int) Max surge pods during a rolling update
       maxSurge: 2
 
+sessionExpirationPurgeJobSettings:
+  schedule: "0 0 * * *"
+  image: ko://github.com/stacklok/minder/cmd/server
+  restartPolicy: "OnFailure"
+  imagePullPolicy: "IfNotPresent"
+  resources: {}
+  extraEnv: []
+  extraVolumeMounts: []
+  extraVolumes: []
+  sidecarContainers: []
+
+rotateProviderTokensJobSettings:
+  # Run daily a couple of hours after the session expiration purge job
+  schedule: "0 2 * * *"
+  image: ko://github.com/stacklok/minder/cmd/server
+  restartPolicy: "OnFailure"
+  imagePullPolicy: "IfNotPresent"
+  resources: {}
+  extraEnv: []
+  extraVolumeMounts: []
+  extraVolumes: []
+  sidecarContainers: []
 
 # -- (string) Additional configuration yaml beyond what's in server-config.yaml.example
 extra_config: |