Skip to content

Commit b583ede

Browse files
hypery2khypery2k
committed
feat(Config): Seed users via API
ref #OSS-1
1 parent 8235c77 commit b583ede

File tree

6 files changed

+130
-0
lines changed

6 files changed

+130
-0
lines changed

‎chart/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,15 @@ A Helm chart for deploying Automatisch
2020
|-----|------|---------|-------------|
2121
| affinity | object | `{}` | |
2222
| app.config.APP_ENV | string | `"production"` | Automatisch Environment |
23+
| app.config.DISABLE_SEED_USER | bool | `true` | Don't use hardcoded initial admin user by default, see [here](https://automatisch.co/docs/advanced-configuration#disable-seed-user) for more information |
2324
| app.config.LOG_LEVEL | string | `"info"` | Can be used to configure log level such as error, warn, info, http, debug |
2425
| app.config.PROTOCOL | string | `"http"` | HTTP Protocol |
2526
| app.credentials.APP_SECRET_KEY | string | `nil` | Secret Key to authenticate the user |
2627
| app.credentials.ENCRYPTION_KEY | string | `nil` | Encryption Key to store credentials |
2728
| app.credentials.WEBHOOK_SECRET_KEY | string | `nil` | Webhook Secret Key to verify webhook requests |
29+
| app.seed | object | `{"admin":{"email":"admin@automatisch.io","fullName":"Admin User"}}` | Seed configuration, only done once! |
30+
| app.seed.admin | object | `{"email":"admin@automatisch.io","fullName":"Admin User"}` | admin user to configure during installation |
31+
| app.seed.admin.email | string | `"admin@automatisch.io"` | Admin User |
2832
| autoscaling.enabled | bool | `false` | |
2933
| autoscaling.maxReplicas | int | `100` | |
3034
| autoscaling.minReplicas | int | `1` | |

‎chart/templates/NOTES.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,7 @@ Get the application URL by running these commands:
77
echo "Visit http://127.0.0.1:8080 to use your application"
88
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
99
{{- end }}
10+
{{- if .Values.app.config.DISABLE_SEED_USER }}
11+
To get the generated admin user credentials for user {{ .Values.app.seed.admin.fullName }} ({{ .Values.app.seed.admin.email }}), run the following command:
12+
kubectl --namespace {{ .Release.Namespace }} get secret {{ include "ah.fullname" . }}-admin -o jsonpath="{.data.password}" | base64 --decode
13+
{{- end }}

‎chart/templates/config-job.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: {{ include "ah.fullname" . }}-config
5+
labels:
6+
{{- include "ah.labels" . | nindent 4 }}
7+
app.kubernetes.io/component: automatisch-config
8+
annotations:
9+
helm.sh/hook: "post-install,post-upgrade,post-rollback"
10+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
11+
helm.sh/hook-weight: "5"
12+
spec:
13+
backoffLimit: 3
14+
{{- /* kubernetes secret to hold user details */}}
15+
{{- $secretName := printf "%s-config" ( include "ah.fullname" . ) }}
16+
template:
17+
metadata:
18+
labels:
19+
app.kubernetes.io/component: automatisch-config
20+
{{- include "ah.labels" . | nindent 8 }}
21+
annotations:
22+
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace $secretName ) | default dict }}
23+
{{- $secretData := (get $secretObj "data") | default dict }}
24+
checksum/configuration: {{ ( printf "%s" $secretData | toJson ) | sha256sum }}
25+
{{- with .Values.podAnnotations }}
26+
{{- toYaml . | nindent 8 }}
27+
{{- end }}
28+
spec:
29+
serviceAccountName: {{ include "ah.serviceAccountName" . }}
30+
securityContext:
31+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
32+
restartPolicy: Never
33+
containers:
34+
- name: init-config
35+
image: alpine/k8s:1.30.0
36+
imagePullPolicy: {{ .Values.image.pullPolicy }}
37+
command:
38+
- /bin/sh
39+
- -c
40+
- |
41+
function wait_for_it() {
42+
host=${1}
43+
prot=${2:-http}
44+
port=${3:-3000}
45+
code=${4:-200}
46+
max_attempts=${5:-10}
47+
opts=${6}
48+
echo "Waiting for $host:$port"
49+
no_proxy=$host,$no_proxy
50+
attempt_counter=0
51+
# shellcheck disable=SC2053
52+
until [[ "$(curl --output /dev/null --silent --head -w '%{http_code}' --fail ${opts} ${prot}://${host}:${port})" == $code ]]; do
53+
if [ ${attempt_counter} -eq ${max_attempts} ];then
54+
echo "Max attempts reached"
55+
curl -isv http://${host}:${port}
56+
exit 1
57+
fi
58+
59+
echo -n '.'
60+
attempt_counter=$((attempt_counter+1))
61+
sleep 30
62+
done
63+
}
64+
wait_for_it "{{ include "ah.fullname" . }}"
65+
66+
echo "Setting up users ..."
67+
{{- $user := .Values.app.seed.admin }}
68+
{{- $password := randAlphaNum 20 }}
69+
curl -d '{"email":"{{ $user.email }}", "fullName":"{{ $user.fullName }}", "password": "{{ $password }}"}' -H "Content-Type: application/json" -X POST http://automatisch:3000/api/v1/installation/users
70+
71+
{{/* Save generated passwords in kubernetes secret */}}
72+
echo "email={{ $user.email }}" > credentials.txt
73+
echo "password={{ $password }}" >> credentials.txt
74+
kubectl --namespace {{ .Release.Namespace }} create secret generic {{ .Release.Name }}-admin --from-env-file=credentials.txt

‎chart/templates/role-binding.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "ah.serviceAccountName" . }}
6+
labels:
7+
{{- include "ah.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: Role
15+
name: {{ include "ah.serviceAccountName" . }}
16+
subjects:
17+
- kind: ServiceAccount
18+
name: {{ include "ah.serviceAccountName" . }}
19+
namespace: {{ .Release.Namespace }}
20+
{{- end }}

‎chart/templates/role.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "ah.serviceAccountName" . }}
6+
labels:
7+
{{- include "ah.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
rules:
13+
- apiGroups: [""]
14+
resources: ["pods"]
15+
verbs: ["get", "watch", "list"]
16+
- apiGroups: [""]
17+
resources: ["secrets"]
18+
verbs: ["get", "watch", "create", "list", "update"]
19+
{{- end }}

‎chart/values.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,13 +139,22 @@ ingress:
139139
tls: []
140140

141141
app:
142+
# -- Seed configuration, only done once!
143+
seed:
144+
# -- admin user to configure during installation
145+
admin:
146+
# -- Admin User
147+
email: admin@automatisch.io
148+
fullName: Admin User
142149
config:
143150
# -- Automatisch Environment
144151
APP_ENV: production
145152
# -- Can be used to configure log level such as error, warn, info, http, debug
146153
LOG_LEVEL: info
147154
# -- HTTP Protocol
148155
PROTOCOL: http
156+
# -- Don't use hardcoded initial admin user by default, see [here](https://automatisch.co/docs/advanced-configuration#disable-seed-user) for more information
157+
DISABLE_SEED_USER: true
149158
credentials:
150159
# -- Encryption Key to store credentials
151160
ENCRYPTION_KEY:

0 commit comments

Comments
 (0)