qhub-config.yaml as a secret (#905)

* qhub-config.yaml added as a configmap * read_only configmap * qhubconfigyaml now a secret
nebari-dev · Nov 16, 2021 · 1e86d99 · 1e86d99
1 parent a4e373d
commit 1e86d99
Show file tree

Hide file tree

Showing 6 changed files with 50 additions and 9 deletions.
diff --git a/qhub/render/__init__.py b/qhub/render/__init__.py
@@ -125,6 +125,7 @@ def patch_terraform_extensions(config):
             "oauth2client": ext.get("oauth2client", False),
             "logout": ext.get("logout", ""),
             "jwt": False,
+            "qhubconfigyaml": ext.get("qhubconfigyaml", False),
         }
         tf_ext["envs"] = []
         for env in ext.get("envs", []):
@@ -301,6 +302,8 @@ def render_template(output_directory, config_filename, force=False):
 
     patch_terraform_extensions(config)
 
+    config["qhub_config_yaml_path"] = str(filename.absolute())
+
     remove_existing_renders(
         dest_repo_dir=output_directory / repo_directory,
         verbosity=0,

diff --git a/qhub/schema.py b/qhub/schema.py
@@ -370,6 +370,7 @@ class QHubExtension(Base):
     urlslug: str
     private: bool = False
     oauth2client: bool = False
+    qhubconfigyaml: bool = False
     envs: typing.Optional[typing.List[QHubExtensionEnv]]
     logout: typing.Optional[str]
 

diff --git a/qhub/template/{{ cookiecutter.repo_directory }}/infrastructure/extensions.tf b/qhub/template/{{ cookiecutter.repo_directory }}/infrastructure/extensions.tf
@@ -5,14 +5,15 @@
 module "ext-{{ ext.name }}" {
   source = "./modules/kubernetes/qhubextension"
 
-  name          = "qhub-ext-{{ ext.name }}"
-  namespace     = var.environment
-  image         = "{{ ext.image }}"
-  urlslug       = "{{ ext.urlslug }}"
-  private       = {{ ext.private | jsonify }}
-  oauth2client  = {{ ext.oauth2client | jsonify }}
-  external-url  = var.endpoint
-  qhub-realm-id = module.kubernetes-keycloak-config.qhub-realm-id
+  name           = "qhub-ext-{{ ext.name }}"
+  namespace      = var.environment
+  image          = "{{ ext.image }}"
+  urlslug        = "{{ ext.urlslug }}"
+  private        = {{ ext.private | jsonify }}
+  oauth2client   = {{ ext.oauth2client | jsonify }}
+  qhubconfigyaml = {{ ext.qhubconfigyaml | jsonify }}
+  external-url   = var.endpoint
+  qhub-realm-id  = module.kubernetes-keycloak-config.qhub-realm-id
 
   envs = [
   {%- for env in ext.envs | default([]) %}
@@ -41,4 +42,4 @@ resource "random_password" "qhub-ext-{{ ext.name }}-jwt-secret" {
 }
 {% endif %}
 
-{%- endfor %}
+{%- endfor %}
diff --git a/qhub/template/{{ cookiecutter.repo_directory }}/infrastructure/kubernetes.tf b/qhub/template/{{ cookiecutter.repo_directory }}/infrastructure/kubernetes.tf
@@ -408,3 +408,14 @@ module "forwardauth" {
     module.kubernetes-initialization
   ]
 }
+
+resource "kubernetes_secret" "qhub_yaml_secret" {
+  metadata {
+    name      = "qhub-config-yaml"
+    namespace = var.environment
+  }
+
+  data = {
+    "qhub-config.yaml" = file({{ cookiecutter.qhub_config_yaml_path | jsonify }})
+  }
+}
diff --git a/...{{ cookiecutter.repo_directory }}/infrastructure/modules/kubernetes/qhubextension/main.tf b/...{{ cookiecutter.repo_directory }}/infrastructure/modules/kubernetes/qhubextension/main.tf
@@ -70,6 +70,25 @@ resource "kubernetes_deployment" "qhub-extension-deployment" {
             container_port = 80
           }
 
+          dynamic "volume_mount" {
+            for_each = var.qhubconfigyaml ? [true] : []
+            content {
+              name       = "qhubyamlsecret"
+              mount_path = "/etc/qhubyamlsecret/"
+              read_only  = true
+            }
+          }
+
+        }
+
+        dynamic "volume" {
+          for_each = var.qhubconfigyaml ? [true] : []
+          content {
+            name = "qhubyamlsecret"
+            secret {
+              secret_name = "qhub-config-yaml"
+            }
+          }
         }
 
       }

diff --git a/...okiecutter.repo_directory }}/infrastructure/modules/kubernetes/qhubextension/variables.tf b/...okiecutter.repo_directory }}/infrastructure/modules/kubernetes/qhubextension/variables.tf
@@ -41,6 +41,12 @@ variable "oauth2client" {
   default     = false
 }
 
+variable "qhubconfigyaml" {
+  description = "Mount qhub-config.yaml from configmap"
+  type        = bool
+  default     = false
+}
+
 variable "envs" {
   description = "List of env var objects"
   type        = list(map(any))