Skip to content

Commit 3d1e72d

Browse files
soniquasoniqua
authored
fix: specify universal broker platform auth and credential references (#24)
1 parent 7b8d73a commit 3d1e72d

File tree

12 files changed

+339
-104
lines changed

12 files changed

+339
-104
lines changed

‎.circleci/config.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,12 +173,14 @@ workflows:
173173
# - deploy_and_test:
174174
# context:
175175
# - snyk-universal-broker-helm-chart
176+
# requires:
177+
# - validate_charts
176178
- publish:
177179
context:
178180
- team-broker-docker-hub
179181
requires:
180-
- validate_charts
181182
- validate_documentation
183+
# - deploy_and_test
182184
filters:
183185
branches:
184186
only:

‎README.md‎

Lines changed: 78 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,71 @@ If required, specify your [Snyk Region](https://docs.snyk.io/working-with-snyk/r
3131
region: "eu"
3232
```
3333
34+
### Credential References
35+
36+
Any Credential References (refer to the example provided on [docs.snyk.io](https://docs.snyk.io/enterprise-setup/snyk-broker/universal-broker/set-up-a-github-connection-using-the-api#id-3-create-your-credentials-references)) must be provided to the Universal Broker. This can be achieved directly through Helm, or via an external Kubernetes Secret.
37+
38+
For the following example, assume three credential references are created of the following `deployment_credential` types:
39+
- `github`
40+
- `gitlab`
41+
- `azure-repos`
42+
43+
An example data object is shown for the `github` type.
44+
```json
45+
{
46+
...
47+
"data":{
48+
"id": "uuidv4",
49+
"type": "deployment_credential",
50+
"attributes": {
51+
"comment": "",
52+
"deployment_id": "uuidv4",
53+
"environment_variable_name": "MY_GITHUB_TOKEN",
54+
"type": "github"
55+
}
56+
}
57+
}
58+
```
59+
The number of credential references will depend on the `type` of the `deployment_credential`; `github` holds just one (the GitHub PAT), whilst `azure-repos` holds three (the Azure Repos Org, Username and Password)
60+
61+
#### Via Helm
62+
63+
Provide the environment variable used when creating the credential reference, and the actual value of your credential.
64+
65+
For example, providing the Universal Broker with a GitHub, GitLab and Azure Repos credential:
66+
67+
```yaml
68+
credentialReferences:
69+
MY_GITHUB_TOKEN: <your-github-token>
70+
MY_GITLAB_TOKEN: <your-gitlab-token>
71+
AZURE_REPOS_PRODSEC_ORG: prodsec
72+
AZURE_REPOS_PRODSEC_USERNAME: <your-azure-repos-username>
73+
AZURE_REPOS_PRODSEC_PASSWORD: <your-azure-repos-password>
74+
```
75+
76+
The Universal Broker Helm Chart creates this secret for you.
77+
78+
#### Via External Secret
79+
80+
First create or otherwise ensure the secret exists:
81+
82+
```yaml
83+
kind: Secret
84+
apiVersion: v1
85+
metadata:
86+
name: my-universal-broker-secrets
87+
data:
88+
MY_GITHUB_TOKEN: <your-github-token>
89+
...
90+
```
91+
92+
Then set values within `.Values.credentialReferencesSecret` that match your external Secret:
93+
94+
```yaml
95+
credentialReferencesSecret:
96+
name: my-universal-broker-secrets
97+
```
98+
3499
## Advanced Configuration
35100

36101
### Certificate Trust
@@ -102,16 +167,24 @@ image:
102167

103168
### Snyk Broker parameters
104169

170+
Refer to documentation via [docs.snyk.io](https://docs.snyk.io/enterprise-setup/snyk-broker/universal-broker/initial-configuration-of-the-universal-broker) to obtain `deploymentId`, `clientId`, `clientSecret` values.
171+
172+
Credential References should contain one or more key/value pairs where each key matches the `environment_variable_name` of a `deployment_credential`, and the value provides the secret. For example:
173+
```bash
174+
helm install ... --set credentialReferences.MY_GITHUB_TOKEN=<gh-pat>
175+
```
176+
105177
| Name | Description | Value |
106178
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
107179
| `brokerClientUrl` | is the address of the broker. This needs to be the address of itself. In the case of Kubernetes, you need to ensure that you are pointing to the cluster ingress you have setup. | `""` |
108180
| `region` | Optionally specify a Snyk Region - e.g. "eu" for "SNYK-EU-01". Defaults to "SNYK-US-01", app.snyk.io | `""` |
109181
| `preflightChecks.enabled` | broker client preflight checks | `true` |
110-
| `deploymentId` | is obtained by installing the Broker App at the Organization level | `""` |
111-
| `clientId` | is obtained by installing the Broker App at the Organization level | `""` |
112-
| `clientSecret` | is obtained by installing the Broker App at the Organization level | `""` |
113-
| `existingAuthSecret` | Name of existing secret with Snyk platform auth and scm credential reference data | `""` |
114-
| `credentialReferences` | SCM token credential reference | `{}` |
182+
| `deploymentId` | Obtained by installing the Broker App | `""` |
183+
| `clientId` | Obtained by installing the Broker App | `""` |
184+
| `clientSecret` | Obtained by installing the Broker App | `""` |
185+
| `platformAuthSecret.name` | Optionally provide an external secret containing three keys: `DEPLOYMENT_ID`, `CLIENT_ID` and `CLIENT_SECRET` | `""` |
186+
| `credentialReferences` | Credential References to pass to Broker | `{}` |
187+
| `credentialReferencesSecret.name` | Optionally provide a pre-existing secret with SCM credential reference data | `""` |
115188
| `acceptCode` | Set to false to block Broker rules relating to Snyk Code analysis | `true` |
116189
| `acceptAppRisk` | Set to false to block Broker rules relating to AppRisk | `true` |
117190
| `acceptIaC` | Defaults to "tf,yaml,yml,json,tpl". Optionally remove any extensions not required. Must be comma separated. Set to "" to block Broker rules relating to Snyk IaC analysis | `""` |

‎snyk-universal-broker/templates/_helpers.tpl‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,40 @@ Create a name for the CA Cert secret, using a provided override if present
6767
{{- .Values.caCertSecret.name | default ( include "snyk-broker.genericSecretName" (dict "Context" . "secretName" "cacert-secret" ) ) -}}
6868
{{- end }}
6969

70-
{{/*}}
70+
{{/*
71+
Create a name for the Credentials Reference secret, using a provided override if present
72+
*/}}
73+
{{- define "snyk-broker.credentialReferencesSecretName" -}}
74+
{{- .Values.credentialReferencesSecret.name | default ( include "snyk-broker.genericSecretName" (dict "Context" . "secretName" "creds-secret" ) ) -}}
75+
{{- end }}
76+
77+
{{/*
78+
Create a name for the Platform Auth secret, using a provided override if present
79+
*/}}
80+
{{- define "snyk-broker.snykPlatformSecretName" -}}
81+
{{- .Values.platformAuthSecret.name | default ( include "snyk-broker.genericSecretName" (dict "Context" . "secretName" "platform-secret" ) ) -}}
82+
{{- end }}
83+
84+
{{/*
85+
Credential References
86+
87+
Each credential must be a valid env var, with associated string value
88+
*/}}
89+
{{- define "snyk-broker.credentialReferences" -}}
90+
{{- $failedKeys := list -}}
91+
{{- with .Values.credentialReferences -}}
92+
{{- range ( . | keys ) }}
93+
{{- if not (regexMatch "^[a-zA-Z_]{1,}[a-zA-Z0-9_]{0,}$" .) -}}
94+
{{- $failedKeys = append $failedKeys . -}}
95+
{{- end }}
96+
{{- end }}
97+
{{- end }}
98+
{{- if gt ($failedKeys | len) 0 -}}
99+
{{- fail (printf "Key(s) \"%s\" in .Values.credentialReferences are unsupported. All keys must be valid environment variable names." ($failedKeys | sortAlpha | join ", ") ) -}}
100+
{{- end }}
101+
{{- end }}
102+
103+
{{/*
71104
Snyk Broker ACCEPT_ vars
72105
*/}}
73106
{{- define "snyk-broker.accepts" -}}

‎snyk-universal-broker/templates/secret.yaml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,28 @@
1-
{{- if not .Values.existingAuthSecret }}
1+
{{- if not .Values.credentialReferencesSecret.name }}
2+
{{- include "snyk-broker.credentialReferences" . }}
23
apiVersion: v1
34
kind: Secret
45
metadata:
5-
name: {{ printf "%s-platform-auth" (include "common.names.fullname" .) }}
6+
name: {{ include "snyk-broker.credentialReferencesSecretName" . }}
67
namespace: {{ .Release.Namespace }}
78
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
89
type: Opaque
910
stringData:
10-
deploymentId: {{ .Values.deploymentId | quote }}
11-
clientId: {{ .Values.clientId | quote }}
12-
clientSecret: {{ .Values.clientSecret | quote }}
1311
{{- range $key, $value := .Values.credentialReferences }}
1412
{{ $key }}: {{ $value | quote }}
1513
{{- end }}
1614
{{- end }}
17-
---
15+
---
16+
{{- if not .Values.platformAuthSecret.name }}
17+
apiVersion: v1
18+
kind: Secret
19+
metadata:
20+
name: {{ include "snyk-broker.snykPlatformSecretName" . }}
21+
namespace: {{ .Release.Namespace }}
22+
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
23+
type: Opaque
24+
stringData:
25+
DEPLOYMENT_ID: {{ .Values.deploymentId | quote }}
26+
CLIENT_ID: {{ .Values.clientId | quote }}
27+
CLIENT_SECRET: {{ .Values.clientSecret | quote }}
28+
{{- end }}

‎snyk-universal-broker/templates/statefulset.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,15 @@ spec:
8282
{{- toYaml .Values.readinessProbe.config | nindent 12 }}
8383
{{- end }}
8484
envFrom:
85+
{{- if eq (include "snyk-broker.snykPlatformSecretName" . ) (include "snyk-broker.credentialReferencesSecretName" . ) }}
8586
- secretRef:
86-
name: {{ ternary .Values.existingAuthSecret (printf "%s-platform-auth" (include "common.names.fullname" .)) (not (empty .Values.existingAuthSecret)) }}
87+
name: {{ include "snyk-broker.snykPlatformSecretName" . }}
88+
{{- else }}
89+
- secretRef:
90+
name: {{ include "snyk-broker.snykPlatformSecretName" . }}
91+
- secretRef:
92+
name: {{ include "snyk-broker.credentialReferencesSecretName" . }}
93+
{{- end }}
8794
volumeMounts:
8895
{{- if or .Values.caCert .Values.caCertSecret.name }}
8996
- name: {{ .Release.Name }}-cacert-volume

‎snyk-universal-broker/tests/__snapshot__/secret_test.yaml.snap‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎snyk-universal-broker/tests/credential_test.yaml‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎snyk-universal-broker/tests/fixtures/default_values.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ highAvailabilityMode:
99
enabled: false
1010

1111
##### Snyk Platform Server Auth #####
12-
deploymentId: 8B338A3B-424A-497E-836E-5E0F9486605A
13-
clientId: 8B338A3B-424A-497E-836E-5E0F9486605A
14-
clientSecret: 8B338A3B-424A-497E-836E-5E0F9486605A
12+
deploymentId: 8b338a3b-424a-497e-836e-5e0f9486605a
13+
clientId: 8b338a3b-424a-497e-836e-5e0f9486605a
14+
clientSecret: super-secret-secret
1515

1616
##### SCM Tokens #####
17-
credentialReferences:
18-
mygithubtoken: "8B338A3B-424A-497E-836E-5E0F9486605A"
17+
credentialReferences:
18+
MY_GITHUB_TOKEN: "not_a_real_token"

0 commit comments

Comments
 (0)