Skip to content

[refresh-credential] rotate the AWS ECR credential by schedule #15313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
roboquat merged 14 commits into from
Dec 15, 2022
Merged

[refresh-credential] rotate the AWS ECR credential by schedule #15313

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
db80e26
installer: update volume mount when Secret updates
jenting Dec 6, 2022
4762c65
installer: add registry-credential component
jenting Dec 6, 2022
101469b
A new component: registry-credential
jenting Dec 12, 2022
42c5372
installer: use container image from leeway built
jenting Dec 12, 2022
8c15093
registry-credential: load from config file
jenting Dec 12, 2022
2f7ebf9
installer: update according to load from config
jenting Dec 12, 2022
3ebe4f9
[installer]: add registry-credential as leeway dependency (#15306)
Dec 12, 2022
329f631
registry-credential: support public AWS ECR credential rotation
jenting Dec 12, 2022
d0d0cb4
installer: add create secrets permission
jenting Dec 14, 2022
fe1542d
Add README for registry-credential
jenting Dec 14, 2022
ae4f39d
Address review comment
jenting Dec 14, 2022
397b18d
Rename from registry-credential to refresh-credential
jenting Dec 15, 2022
c09d2f9
Check secret key credentials
jenting Dec 15, 2022
7aedf1c
Forbid job to run concurrency
jenting Dec 15, 2022
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
installer: update volume mount when Secret updates 
According to Kubernetes doc, a container using a Secret as a subPath volume mount will not receive Secret updates. Signed-off-by: JenTing Hsiao <hsiaoairplane@gmail.com>
  • Loading branch information
@jenting
jenting committed Dec 12, 2022
commit db80e26b09613a652048eb3dca6fb2281acd272a
2 changes: 1 addition & 1 deletion install/installer/pkg/components/blobserve/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
MaxSize: MaxSizeBytes,
},
},
AuthCfg: "/mnt/pull-secret.json",
AuthCfg: "/mnt/pull-secret/pull-secret.json",
Copy link
Contributor

@kylos101 kylos101 Dec 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I forget, but, nesting the secret within a sub-directory was necessary, so that we can watch it for changes, right?
Copy link
Contributor Author

@jenting jenting Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right 💯
Copy link
Contributor Author

@jenting jenting Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYR https://kubernetes.io/docs/concepts/configuration/secret/#:~:text=A%20container%20using%20a%20Secret%20as%20a%20subPath%20volume%20mount%20does%20not%20receive%20automated%20Secret%20updates
PProfAddr: common.LocalhostAddressFromPort(baseserver.BuiltinDebugPort),
PrometheusAddr: common.LocalhostPrometheusAddr(),
ReadinessProbeAddr: fmt.Sprintf(":%v", ReadinessPort),
Expand Down
4 changes: 2 additions & 2 deletions install/installer/pkg/components/blobserve/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
Name: volumeName,
VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{
SecretName: secretName,
Items: []corev1.KeyToPath{{Key: ".dockerconfigjson", Path: "pull-secret.json"}},
}},
}},
Containers: []corev1.Container{{
Expand Down Expand Up @@ -126,8 +127,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
MountPath: "/mnt/cache",
}, {
Name: volumeName,
MountPath: "/mnt/pull-secret.json",
SubPath: ".dockerconfigjson",
MountPath: "/mnt/pull-secret",
}},

ReadinessProbe: &corev1.Probe{
Expand Down
2 changes: 1 addition & 1 deletion install/installer/pkg/components/image-builder-mk3/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
},
},
PullSecret: secretName,
PullSecretFile: PullSecretFile,
PullSecretFile: "/config/pull-secret/pull-secret.json",
BaseImageRepository: fmt.Sprintf("%s/base-images", registryName),
BuilderImage: ctx.ImageName(ctx.Config.Repository, BuilderImage, ctx.VersionManifest.Components.ImageBuilderMk3.BuilderImage.Version),
WorkspaceImageRepository: fmt.Sprintf("%s/workspace-images", registryName),
Expand Down
9 changes: 4 additions & 5 deletions install/installer/pkg/components/image-builder-mk3/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,8 @@ package image_builder_mk3
import "github.com/gitpod-io/gitpod/installer/pkg/common"

const (
PullSecretFile = "/config/pull-secret.json"
BuilderImage = "image-builder-mk3/bob"
Component = common.ImageBuilderComponent
RPCPort = common.ImageBuilderRPCPort
RPCPortName = "service"
BuilderImage = "image-builder-mk3/bob"
Component = common.ImageBuilderComponent
RPCPort = common.ImageBuilderRPCPort
RPCPortName = "service"
)
4 changes: 2 additions & 2 deletions install/installer/pkg/components/image-builder-mk3/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: secretName,
Items: []corev1.KeyToPath{{Key: ".dockerconfigjson", Path: "pull-secret.json"}},
Copy link
Contributor

@Pothulapati Pothulapati Dec 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Is pull-secret the right name? as we would also use it for pushes here. Could be tackled with https://github.com/gitpod-io/security/issues/89
Copy link
Contributor Author

@jenting jenting Dec 14, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name is pull-secret.json now, ref code.
I updated the https://github.com/gitpod-io/security/issues/89 to track it.
},
},
},
Expand All @@ -100,8 +101,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
},
{
Name: "pull-secret",
MountPath: PullSecretFile,
SubPath: ".dockerconfigjson",
MountPath: "/config/pull-secret",
},
}
if vol, mnt, _, ok := common.CustomCACertVolume(ctx); ok {
Expand Down
2 changes: 1 addition & 1 deletion install/installer/pkg/components/registry-facade/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
IPFSCache: ipfsCache,
RedisCache: redisCache,
},
AuthCfg: "/mnt/pull-secret.json",
AuthCfg: "/mnt/pull-secret/pull-secret.json",
PProfAddr: common.LocalhostAddressFromPort(baseserver.BuiltinDebugPort),
PrometheusAddr: common.LocalhostPrometheusAddr(),
ReadinessProbeAddr: fmt.Sprintf(":%v", ReadinessPort),
Expand Down
4 changes: 2 additions & 2 deletions install/installer/pkg/components/registry-facade/daemonset.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,8 +264,7 @@ func daemonset(ctx *common.RenderContext) ([]runtime.Object, error) {
},
{
Name: name,
MountPath: "/mnt/pull-secret.json",
SubPath: ".dockerconfigjson",
MountPath: "/mnt/pull-secret",
},
},
volumeMounts...,
Expand Down Expand Up @@ -357,6 +356,7 @@ func daemonset(ctx *common.RenderContext) ([]runtime.Object, error) {
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: secretName,
Items: []corev1.KeyToPath{{Key: ".dockerconfigjson", Path: "pull-secret.json"}},
},
},
}, {
Expand Down