Secrets

Overview

openDesk derives the credentials of its components from MASTER_PASSWORD and provisions them as Kubernetes Secrets through the opendesk-secrets release. Instead, a deployment can bring its own Secrets (existing secrets) and have openDesk reference them.

The secrets are defined in the following files of helmfile/environments/default/, each under its own root key: secrets.yaml.gotmpl (secrets), database.yaml.gotmpl (databases), objectstores.yaml.gotmpl (objectstores), cache.yaml.gotmpl (cache), smtp.yaml.gotmpl (smtp), ai.yaml.gotmpl (ai) and sip.yaml.gotmpl (sip). Every secret there is documented inline; these comments are the source of the list below, which is generated with dev/secrets-doc.py:

    # Purpose: Redis access of Notes.
    # Existing secret: `create: false` is supported.
    # Rotation: TBD.
    # Limitation: The password has to be URL-safe or percent-encoded.

Structure of a secret

secrets:
  minio:
    rootPassword:
      value: "..."                       # The secret itself, derived from MASTER_PASSWORD by default.
      create: true                       # true: openDesk creates the Secret from `value`.
      name: "minio-root-password"        # Name of the Kubernetes Secret.
      key: "root-password"               # Key holding the secret within the Kubernetes Secret.
      extraData:                         # Optional: further keys of the same Secret some consumers need.
        root-user: "admin"

Only simple secrets are supported: one key holding the secret string, plus optional further simple keys (extraData, listed in the column “Special”). Structured content, e.g. JSON documents, is not supported as a secret.

Bringing your own Secret

1. Create the Kubernetes Secret in the openDesk namespace before deploying, with the key named in key and the keys listed in the column “Special”, if any.

2. Set create: false and point name and key to it in your environment’s values, e.g.:

   secrets:
     keycloak:
       adminPassword:
         create: false
         name: "my-keycloak-admin"
         key: "password"

For secrets with partial support, some consumers still read the literal value (see “Limitations”): set value to the same string as your Secret as well, or the components end up with different credentials.

Status of all secrets

Legend

“Special” lists a key the consumer does not allow to change, further keys the Secret has to carry, or a deviating structure.

List

135 secrets - existing secret: 99 🟢, 19 🟡, 17 🔴 - rotation: 1 🟢, 3 🟡, 2 🔴, 0 ⚪, 129 TBD.

Out of scope

• certificate.selfSignedOverrides.caCertificate in certificate.yaml.gotmpl: a certificate bundle (certificate, key, trust and key store) rather than a simple secret. It can reference an existing Secret through its own secret.name.