chore(KIEM): move auth token to K8s secret

Signed-off-by: Rudraksh Pareek <[email protected]>
accuknox · Aug 27, 2024 · 8fb5584 · 8fb5584
1 parent 19edd10
commit 8fb5584
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 5 deletions.
diff --git a/kiem-job/templates/deployment.yaml b/kiem-job/templates/deployment.yaml
@@ -30,12 +30,19 @@ spec:
               name: accuknox-kiem-cronjob
               resources: {}
               env:
+                - name: AUTH_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      key: AUTH_TOKEN
+                      {{- if (.Values.accuknox.secretName | empty) }}
+                      name: kiem-job-auth-token
+                      {{- else }}
+                      name: {{ .Values.accuknox.secretName }}
+                      {{- end }}
                 - name: URL
                   value: {{ .Values.accuknox.URL }}
                 - name: TENANT_ID
                   value: {{ .Values.accuknox.tenantID | quote }}
-                - name: AUTH_TOKEN
-                  value: {{ .Values.accuknox.authToken }}
                 - name: CLUSTER_NAME
                   value: {{ .Values.accuknox.clusterName }}
                 - name: LABEL_NAME

diff --git a/kiem-job/templates/job.yaml b/kiem-job/templates/job.yaml
@@ -25,12 +25,19 @@ spec:
           name: accuknox-kiem-job
           resources: {}
           env:
+            - name: AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: AUTH_TOKEN
+                  {{- if (.Values.accuknox.secretName | empty) }}
+                  name: kiem-job-auth-token
+                  {{- else }}
+                  name: {{ .Values.accuknox.secretName }}
+                  {{- end }}
             - name: URL
               value: {{ .Values.accuknox.URL }}
             - name: TENANT_ID
               value: {{ .Values.accuknox.tenantID | quote }}
-            - name: AUTH_TOKEN
-              value: {{ .Values.accuknox.authToken }}
             - name: CLUSTER_NAME
               value: {{ .Values.accuknox.clusterName }}
             - name: LABEL_NAME
@@ -42,4 +49,4 @@ spec:
         - name: datapath
           emptyDir: {}
       restartPolicy: OnFailure
-      serviceAccount: kiem-service-account
+      serviceAccount: kiem-service-account
diff --git a/kiem-job/templates/secret.yaml b/kiem-job/templates/secret.yaml
@@ -0,0 +1,10 @@
+{{- if (.Values.accuknox.secretName | empty) }}
+# if user didn't specify a secretName, use the default
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kiem-job-auth-token
+  namespace: {{ .Release.Namespace }}
+data:
+  AUTH_TOKEN: {{ .Values.accuknox.authToken | b64enc }}
+{{- end }}
diff --git a/kiem-job/values.yaml b/kiem-job/values.yaml
@@ -11,3 +11,4 @@ accuknox:
   cronTab: "30 9 * * *"
   clusterName: ""
   label: ""
+  secretName: ""