Helm: Allow using existing secrets for redis and mysql (#2156)

# What this PR does This PR adds the ability to use an existing secret for external Redis and external MySQL and it follows the same changes that PR #761 did for RabbitMQ (including the fix that was done for it later in #775) ## Checklist - [x] Unit, integration, and e2e (if applicable) tests updated - [x] Documentation added (or `pr:no public docs` PR label added if not required) - [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not required) --------- Co-authored-by: Ildar Iskhakov <Ildar.iskhakov@grafana.com>
2023-06-13 08:42:22 +03:00 · 2023-06-13 08:42:22 +03:00 · 40890e26ba
commit 40890e26ba
parent 30b8401f03
8 changed files with 201 additions and 9 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## Unreleased
+
+### Added
+
+- Add helm chart support for redis and mysql existing secrets [#2156](https://github.com/grafana/oncall/pull/2156)
+
 ## v1.2.43 (2023-06-12)

 ### Changed
--- a/helm/oncall/README.md
+++ b/helm/oncall/README.md
@ -182,6 +182,9 @@ externalMysql:
  db_name:
  user:
  password:
+  existingSecret: ""
+  usernameKey: username
+  passwordKey: password
 ```

 ### Connect external PostgreSQL
@ -246,6 +249,8 @@ redis:
 externalRedis:
  host:
  password:
+  existingSecret: ""
+  passwordKey: password
 ```

 ## Update
--- a/helm/oncall/templates/_env.tpl
+++ b/helm/oncall/templates/_env.tpl
@ -220,23 +220,41 @@ http://{{ include "oncall.grafana.fullname" . }}
  value: {{ include "snippet.mysql.port" . }}
 - name: MYSQL_DB_NAME
  value: {{ include "snippet.mysql.db" . }}
+{{- if and (not .Values.mariadb.enabled) .Values.externalMysql.existingSecret .Values.externalMysql.usernameKey (not .Values.externalMysql.user) }}
+- name: MYSQL_USER
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "snippet.mysql.password.secret.name" . }}
+      key: {{ .Values.externalMysql.usernameKey }}
+{{- else }}
 - name: MYSQL_USER
  value: {{ include "snippet.mysql.user" . }}
+{{- end }}
 - name: MYSQL_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ include "snippet.mysql.password.secret.name" . }}
-      key: mariadb-root-password
+      key: {{ include "snippet.mysql.password.secret.key" . }}
 {{- end }}

 {{- define "snippet.mysql.password.secret.name" -}}
 {{- if and (not .Values.mariadb.enabled) .Values.externalMysql.password -}}
 {{ include "oncall.fullname" . }}-mysql-external
+{{- else if and (not .Values.mariadb.enabled) .Values.externalMysql.existingSecret -}}
+{{ .Values.externalMysql.existingSecret }}
 {{- else -}}
 {{ include "oncall.mariadb.fullname" . }}
 {{- end -}}
 {{- end -}}

+{{- define "snippet.mysql.password.secret.key" -}}
+{{- if and (not .Values.mariadb.enabled) .Values.externalMysql.passwordKey -}}
+{{ .Values.externalMysql.passwordKey }}
+{{- else -}}
+mariadb-root-password
+{{- end -}}
+{{- end -}}
+
 {{- define "snippet.mysql.host" -}}
 {{- if and (not .Values.mariadb.enabled) .Values.externalMysql.host -}}
 {{- required "externalMysql.host is required if not mariadb.enabled" .Values.externalMysql.host | quote }}
@ -436,11 +454,21 @@ rabbitmq-password
 {{- define "snippet.redis.password.secret.name" -}}
 {{- if and (not .Values.redis.enabled) .Values.externalRedis.password -}}
 {{ include "oncall.fullname" . }}-redis-external
+{{- else if and (not .Values.redis.enabled) .Values.externalRedis.existingSecret -}}
+{{ .Values.externalRedis.existingSecret }}
 {{- else -}}
 {{ include "oncall.redis.fullname" . }}
 {{- end -}}
 {{- end -}}

+{{- define "snippet.redis.password.secret.key" -}}
+{{- if and (not .Values.redis.enabled) .Values.externalRedis.passwordKey -}}
+{{ .Values.externalRedis.passwordKey }}
+{{- else -}}
+redis-password
+{{- end -}}
+{{- end -}}
+
 {{- define "snippet.redis.env" -}}
 - name: REDIS_HOST
  value: {{ include "snippet.redis.host" . }}
@ -449,8 +477,8 @@ rabbitmq-password
 - name: REDIS_PASSWORD
  valueFrom:
    secretKeyRef:
-      name: {{ template "snippet.redis.password.secret.name" . }}
-      key: redis-password
+      name: {{ include "snippet.redis.password.secret.name" . }}
+      key: {{ include "snippet.redis.password.secret.key" . }}
 {{- end }}

 {{- define "snippet.oncall.smtp.env" -}}
--- a/helm/oncall/templates/secrets.yaml
+++ b/helm/oncall/templates/secrets.yaml
@ -11,14 +11,14 @@ data:
  {{ template "snippet.oncall.secret.mirageSecretKey" . }}: {{ randAlphaNum 40 | b64enc | quote }}
 {{- end }}
 ---
-{{ if and (not .Values.mariadb.enabled) (eq .Values.database.type "mysql") -}}
+{{ if and (not .Values.mariadb.enabled) (eq .Values.database.type "mysql") (not .Values.externalMysql.existingSecret) -}}
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "oncall.fullname" . }}-mysql-external
 type: Opaque
 data:
-  mariadb-root-password: {{ required "externalMysql.password is required if not mariadb.enabled" .Values.externalMysql.password | b64enc | quote }}
+  mariadb-root-password: {{ required "externalMysql.password is required if not mariadb.enabled and not externalMysql.existingSecret" .Values.externalMysql.password | b64enc | quote }}
 {{- end }}
 ---
 {{ if and (eq .Values.broker.type "rabbitmq") (not .Values.rabbitmq.enabled) (not .Values.externalRabbitmq.existingSecret) -}}
@ -31,14 +31,14 @@ data:
  rabbitmq-password: {{ required "externalRabbitmq.password is required if not rabbitmq.enabled and not externalRabbitmq.existingSecret" .Values.externalRabbitmq.password | b64enc | quote }}
 {{- end }}
 ---
-{{ if not .Values.redis.enabled -}}
+{{ if and (not .Values.redis.enabled) (not .Values.externalRedis.existingSecret) -}}
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "oncall.fullname" . }}-redis-external
 type: Opaque
 data:
-  redis-password: {{ required "externalRedis.password is required if not redis.enabled" .Values.externalRedis.password | b64enc | quote }}
+  redis-password: {{ required "externalRedis.password is required if not redis.enabled and not externalRedis.existingSecret" .Values.externalRedis.password | b64enc | quote }}
 {{- end }}
 ---
 {{ if and .Values.oncall.smtp.enabled .Values.oncall.smtp.password -}}
--- a/helm/oncall/tests/mysql_password_env_test.yaml
+++ b/helm/oncall/tests/mysql_password_env_test.yaml
@ -12,7 +12,7 @@ tests:
      mariadb.enabled: false
    asserts:
      - failedTemplate:
-          errorMessage: externalMysql.password is required if not mariadb.enabled
+          errorMessage: externalMysql.password is required if not mariadb.enabled and not externalMysql.existingSecret
        template: secrets.yaml

  - it: externalMySQL.password -> should create a Secret -mariadb-external
@ -23,8 +23,14 @@ tests:
    set:
      mariadb.enabled: false
      externalMysql:
+        user: user123
        password: abcd123
    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MYSQL_USER
+            value: user123
      - contains:
          path: spec.template.spec.containers[0].env
          content:
@ -44,3 +50,56 @@ tests:
          decodeBase64: true
        documentIndex: 1
        template: secrets.yaml
+
+  - it: externalMysql.existingSecret -> should use existing secret
+    templates:
+      - engine/deployment.yaml
+      - engine/job-migrate.yaml
+      - celery/deployment-celery.yaml
+    set:
+      mariadb.enabled: false
+      externalMysql:
+        existingSecret: some-mysql-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MYSQL_USER
+            value: root
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MYSQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: some-mysql-secret
+                key: mariadb-root-password
+
+  - it: externalMysql.usernameKey and externalMysql.passwordKey -> should be used for existing secret
+    templates:
+      - engine/deployment.yaml
+      - engine/job-migrate.yaml
+      - celery/deployment-celery.yaml
+    set:
+      mariadb.enabled: false
+      externalMysql:
+        existingSecret: some-mysql-secret
+        usernameKey: mysql.user
+        passwordKey: mysql.key
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MYSQL_USER
+            valueFrom:
+              secretKeyRef:
+                name: some-mysql-secret
+                key: mysql.user
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MYSQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: some-mysql-secret
+                key: mysql.key
--- a/helm/oncall/tests/postgres_password_env_test.yaml
+++ b/helm/oncall/tests/postgres_password_env_test.yaml
@ -109,4 +109,3 @@ tests:
              secretKeyRef:
                name: oncall-postgresql
                key: password
-
--- a/helm/oncall/tests/redis_password_env_test.yaml
+++ b/helm/oncall/tests/redis_password_env_test.yaml
@ -0,0 +1,85 @@
+suite: test Redis password envs for deployments
+release:
+  name: oncall
+templates:
+  - engine/deployment.yaml
+  - engine/job-migrate.yaml
+  - celery/deployment-celery.yaml
+  - secrets.yaml
+tests:
+  - it: secrets -> should fail if externalRedis.password not set
+    set:
+      redis.enabled: false
+    asserts:
+      - failedTemplate:
+          errorMessage: externalRedis.password is required if not redis.enabled and not externalRedis.existingSecret
+        template: secrets.yaml
+
+  - it: externalRedis.password -> should create a Secret -redis-external
+    templates:
+      - engine/deployment.yaml
+      - engine/job-migrate.yaml
+      - celery/deployment-celery.yaml
+    set:
+      redis.enabled: false
+      externalRedis:
+        password: abcd123
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: oncall-redis-external
+                key: redis-password
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: oncall-redis-external
+        template: secrets.yaml
+      - equal:
+          path: data.redis-password
+          value: abcd123
+          decodeBase64: true
+        documentIndex: 1
+        template: secrets.yaml
+
+  - it: externalRedis.existingSecret -> should use existing secret
+    templates:
+      - engine/deployment.yaml
+      - engine/job-migrate.yaml
+      - celery/deployment-celery.yaml
+    set:
+      redis.enabled: false
+      externalRedis:
+        existingSecret: some-redis-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: some-redis-secret
+                key: redis-password
+
+  - it: externalRedis.passwordKey -> should be used for existing secret
+    templates:
+      - engine/deployment.yaml
+      - engine/job-migrate.yaml
+      - celery/deployment-celery.yaml
+    set:
+      redis.enabled: false
+      externalRedis:
+        existingSecret: some-redis-secret
+        passwordKey: redis.key
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: some-redis-secret
+                key: redis.key
--- a/helm/oncall/values.yaml
+++ b/helm/oncall/values.yaml
@ -273,6 +273,12 @@ externalMysql:
  db_name:
  user:
  password:
+  # use an existing secret for the mysql password
+  existingSecret: ""
+  # the key in the secret containing the mysql username
+  usernameKey:
+  # the key in the secret containing the mysql password
+  passwordKey:

 # PostgreSQL is included into this release for the convenience.
 # It is recommended to host it separately from this release
@ -326,6 +332,10 @@ redis:
 externalRedis:
  host:
  password:
+  # use an existing secret for the redis password
+  existingSecret: ""
+  # the key in the secret containing the redis password
+  passwordKey:

 # Grafana is included into this release for the convenience.
 # It is recommended to host it separately from this release