starlingx/app-openbao
Code Issues Proposed changes

Initial Package Upload for Openbao

Browse Source 
Containing the initial package for Openbao application. Contains a
working package of openbao-helm, openbao-manager-helm,
python3-k8sapp-openbao, and stx-openbao-helm.

Test Plan:
PASS    Packages are successfully built, and the application tarball is
        created.
PASS    Application is uploaded and applied with no errors
PASS    Application is configured for sanity testing
PASS    Application passes aware/unaware test for sanity
PASS    Application functions when network access is restricted to
        internal registry

Story: 2011244
Task: 51378

Change-Id: I10910b3cc00c3e45ebce0df20bbee53af3d8543b
Signed-off-by: Tae Park <tae.park@windriver.com>
This commit is contained in:
Tae Park 2024-11-19 13:43:30 -05:00
parent 24feb3a833
commit dbbf5c7ec4
92 changed files with 6848 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored Normal file
View File

@ -0,0 +1,2 @@
.tox
venv/

66
.zuul.yaml
View File

@ -1,9 +1,71 @@
---
- project:
vars:
ensure_tox_version: '<4'
check:
jobs:
- noop
- openstack-tox-linters
- k8sapp-openbao-tox-pylint
- k8sapp-openbao-tox-flake8
- k8sapp-openbao-tox-metadata
gate:
jobs:
- noop
- openstack-tox-linters
- k8sapp-openbao-tox-pylint
- k8sapp-openbao-tox-flake8
- k8sapp-openbao-tox-metadata
- job:
name: k8sapp-openbao-tox-metadata
parent: tox
description: |
Run metadata test for k8sapp_openbao
nodeset: debian-bullseye
required-projects:
- starlingx/config
- starlingx/fault
- starlingx/update
- starlingx/utilities
- starlingx/root
vars:
tox_envlist: metadata
tox_extra_args: -c python3-k8sapp-openbao/k8sapp_openbao/tox.ini
tox_constraints_file: '{{ ansible_user_dir }}/src/opendev.org/starlingx/root/build-tools/requirements/debian/upper-constraints.txt'
- job:
name: k8sapp-openbao-tox-pylint
parent: tox
description: |
Run pylint test for k8sapp_openbao
nodeset: debian-bullseye
required-projects:
- starlingx/config
- starlingx/fault
- starlingx/update
- starlingx/utilities
- starlingx/root
files:
- python3-k8sapp-openbao/*
vars:
tox_envlist: pylint
tox_extra_args: -c python3-k8sapp-openbao/k8sapp_openbao/tox.ini
tox_constraints_file: '{{ ansible_user_dir }}/src/opendev.org/starlingx/root/build-tools/requirements/debian/upper-constraints.txt'
- job:
name: k8sapp-openbao-tox-flake8
parent: tox
description: |
Run flake8 test for k8sapp_openbao
nodeset: debian-bullseye
required-projects:
- starlingx/config
- starlingx/fault
- starlingx/update
- starlingx/utilities
- starlingx/root
files:
- python3-k8sapp-openbao/*
vars:
tox_envlist: flake8
tox_extra_args: -c python3-k8sapp-openbao/k8sapp_openbao/tox.ini
tox_constraints_file: '{{ ansible_user_dir }}/src/opendev.org/starlingx/root/build-tools/requirements/debian/upper-constraints.txt'

16
CONTRIBUTING.rst Normal file
View File

@ -0,0 +1,16 @@
If you would like to contribute to the development of OpenStack,
you must follow the steps in this page:
https://docs.openstack.org/infra/manual/developers.html
Once those steps have been completed, changes to OpenStack
should be submitted for review via the Gerrit tool, following
the workflow documented at:
https://docs.openstack.org/infra/manual/developers.html#development-workflow
Pull requests submitted through GitHub will be ignored.
Bugs should be filed in Launchpad:
https://bugs.launchpad.net/starlingx

17
HACKING.rst Normal file
View File

@ -0,0 +1,17 @@
StarlingX App-Openbao Style Commandments
================================================================
- Step 1: Read the OpenStack style commandments
https://docs.openstack.org/hacking/latest/
- Step 2: Read on
App-Openbao Specific Commandments
---------------------------------------------------------
None so far
Running tests
-------------
The approach to running tests is to simply run the command ``tox``. This will
create virtual environments, populate them with dependencies and run all of
the tests that OpenStack CI systems run.

10
bindep.txt Normal file
View File

@ -0,0 +1,10 @@
# This is a cross-platform list tracking distribution packages needed for install and tests;
# see https://docs.openstack.org/infra/bindep/ for additional information.
libffi-dev [platform:dpkg]
libldap2-dev [platform:dpkg]
libxml2-dev [platform:dpkg]
libxslt1-dev [platform:dpkg]
libsasl2-dev [platform:dpkg]
libffi-devel [platform:rpm]
python3-all-dev [platform:dpkg]

1
debian_build_layer.cfg Normal file
View File

@ -0,0 +1 @@
flock

2
debian_iso_image.inc Normal file
View File

@ -0,0 +1,2 @@
#stx-openbao-helm
stx-openbao-helm

4
debian_pkg_dirs Normal file
View File

@ -0,0 +1,4 @@
python3-k8sapp-openbao
stx-openbao-helm
helm-charts/upstream/openbao-helm
helm-charts/custom/openbao-manager-helm

5
helm-charts/custom/openbao-manager-helm/debian/deb_folder/changelog Normal file
View File

@ -0,0 +1,5 @@
openbao-manager-helm (1.0-1) unstable; urgency=medium
* Initial release.
-- Tae Park <tae.park@windriver.com> Thu, 10 Oct 2024 19:34:18 -0400

16
helm-charts/custom/openbao-manager-helm/debian/deb_folder/control Normal file
View File

@ -0,0 +1,16 @@
Source: openbao-manager-helm
Section: libs
Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
helm,
build-info,
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io
Package: openbao-manager-helm
Section: libs
Architecture: any
Depends: ${misc:Depends}
Description: StarlingX Openbao Manager Helm Charts
This package contains helm charts for the openbao manager application.

21
helm-charts/custom/openbao-manager-helm/debian/deb_folder/copyright Normal file
View File

@ -0,0 +1,21 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: openbao-manager-helm
Source: https://opendev.org/starlingx/app-openbao/
Files: *
Copyright: (c) 2024 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.

1
helm-charts/custom/openbao-manager-helm/debian/deb_folder/openbao-manager-helm.install Normal file
View File

@ -0,0 +1 @@
usr/lib/helm/*

26
helm-charts/custom/openbao-manager-helm/debian/deb_folder/rules Executable file
View File

@ -0,0 +1,26 @@
#!/usr/bin/make -f
export DH_VERBOSE = 1
export DEB_VERSION = $(shell dpkg-parsechangelog | egrep '^Version:' | cut -f 2 -d ' ')
export PATCH_VERSION = $(shell echo $(DEB_VERSION) | cut -f 4 -d '.')
export CHART_BASE_VERSION = $(shell echo $(DEB_VERSION) | sed 's/-/./' | cut -d '.' -f 1-3)
export CHART_VERSION = $(CHART_BASE_VERSION)+STX.$(PATCH_VERSION)
export ROOT = debian/tmp
export APP_FOLDER = $(ROOT)/usr/lib/helm
%:
dh $@
override_dh_auto_build:
mkdir -p openbao-manager
cp Chart.yaml values.yaml openbao-manager
cp -r templates/ openbao-manager
make CHART_VERSION=$(CHART_VERSION) openbao-manager
override_dh_auto_install:
# Install the app tar file.
install -d -m 755 $(APP_FOLDER)
install -p -D -m 755 openbao-manager*.tgz $(APP_FOLDER)
override_dh_auto_test:

1
helm-charts/custom/openbao-manager-helm/debian/deb_folder/source/format Normal file
View File

@ -0,0 +1 @@
3.0 (quilt)

14
helm-charts/custom/openbao-manager-helm/debian/meta_data.yaml Normal file
View File

@ -0,0 +1,14 @@
---
debname: openbao-manager-helm
debver: 1.0-1
src_path: openbao-manager-helm
src_files:
- openbao-manager-helm/Makefile
- openbao-manager-helm/openbao-manager/templates/
- openbao-manager-helm/openbao-manager/Chart.yaml
- openbao-manager-helm/openbao-manager/values.yaml
revision:
dist: $STX_DIST
SRC_GITREVCOUNT:
SRC_DIR: ${MY_REPO}/stx/app-openbao/helm-charts/custom/openbao-manager-helm
SRC_BASE_SRCREV: 0144b018a6a592860dace539e9fb937af7b2d26f

41
helm-charts/custom/openbao-manager-helm/openbao-manager-helm/Makefile Normal file
View File

@ -0,0 +1,41 @@
#
# Copyright 2017 The Openstack-Helm Authors.
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# It's necessary to set this because some environments don't link sh -> bash.
SHELL := /bin/bash
TASK := build
EXCLUDES := doc tests tools logs tmp
CHARTS := $(filter-out $(EXCLUDES), $(patsubst %/.,%,$(wildcard */.)))
.PHONY: $(EXCLUDES) $(CHARTS)
all: $(CHARTS)
$(CHARTS):
@if [ -d $@ ]; then \
echo; \
echo "===== Processing [$@] chart ====="; \
make $(TASK)-$@; \
fi
init-%:
if [ -f $*/Makefile ]; then make -C $*; fi
lint-%: init-%
if [ -d $* ]; then helm lint $*; fi
build-%: lint-%
if [ -d $* ]; then helm package --version $(CHART_VERSION) $*; fi
clean:
@echo "Clean all build artifacts"
rm -f */templates/_partials.tpl */templates/_globals.tpl
rm -rf */charts */tmpcharts
%:
@:

4
helm-charts/custom/openbao-manager-helm/openbao-manager-helm/README Normal file
View File

@ -0,0 +1,4 @@
This directory contains the helm chart for Openbao Manager. Rather than
being installed on the Starlingx cluster, this Openbao-Manager chart is
included within the Openbao application tarball in the stx-openbao-helm
package.

10
helm-charts/custom/openbao-manager-helm/openbao-manager-helm/openbao-manager/Chart.yaml Normal file
View File

@ -0,0 +1,10 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: v2
appVersion: "1.0.1"
description: Openbao manager helm chart
name: openbao-manager
version: 1.0.1

4008
helm-charts/custom/openbao-manager-helm/openbao-manager-helm/openbao-manager/templates/vault-init.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

184
helm-charts/custom/openbao-manager-helm/openbao-manager-helm/openbao-manager/values.yaml Normal file
View File

@ -0,0 +1,184 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# Values migrated from openbao helm chart
openbao:
name: openbao
fullname: stx-openbao
server:
version: 2.1.0
ha:
replicas: 1
# Openbao Manager specific values
manager:
image:
repository: starlingx/stx-vault-manager
tag: stx.10.0-v1.29.6-1
pullPolicy: IfNotPresent
chart: openbao_1.0.1
imagePullSecrets: []
# Rate at which openbao-manager checks status of openbao servers.
# After initialization of the raft, Openbao manager will loop forever
# checking the pods for openbao servers that need to be unsealed.
# This value is the sleep, in seconds, between intervals. Value
# must be a positive integer
statusCheckRate: 5
# After initial configuration, in combination with statusCheckRate,
# the amount of time to wait before unsealing a recovering openbao
# server. The option is intended to allow the active openbao server
# time to start sending heartbeats to the recovering pod before
# unsealing the server.
#
# A value of 0 indicates no wait time: unseal the openbao server without
# delay. The wait time is statusCheckRate * unsealWaitIntervals.
# Default is 5 s/interval * 3 intervals == 15 seconds.
#
unsealWaitIntervals: 3
api:
# Network timeout for queries to openbao server /sys/health endpoint
#
# The maximum time in seconds to wait for a server to respond to
# health query. This applies for the HA recovery situations, not the
# initialization of openbao cluster. Unsetting the value is not
# recommended, and defaults to timeout of 120 seconds.
#
# openbao-manager will appear to hang if healthQueryTimeout is
# over-large. This setting affects the logs, since openbao-manager will
# issue a log when the 'sealed' status toggles between true/false and
# the 'unknown' value
healthQueryTimeout: 2
# Network timeout for openbao API operations against /sys/unseal
#
# The maximum time in seconds to wait for a server to respond to
# the unseal request.
unsealOpTimeout: 10
# Network timeout for queries to openbao server /sys/rekey/init
# and /sys/rekey/verify
#
# The maximum time in seconds to wait for a server to respond to
# the query.
rekeyStatusTimeout: 2
# Network timeout for openbao API operations against /sys/rekey/init
# and /sys/rekey/verify
#
# The maximum time in seconds to wait for a server to respond to
# the request.
rekeyOpTimeout: 10
rekey:
# During upgrade of the application from PVC storage to storage
# using kubernetes, enable openbao rekey to run automatically to
# resecure the openbao with new shards.
# See also openbao documentation:
# https://openbao.org/docs/concepts/seal/#rekeying
# https://openbao.org/api-docs/system/rekey
#
enableOnPVCConversion: true
k8s:
# The major/minor version of kubectl client binary to use. Must
# exist within the openbao manager image for example
# client_version: v1.28
client_version: ""
waitTermination:
# During upgrade of the application from PVC storage to storage
# using kubernetes, wait for previous version of openbao manager
# to terminate before proceding with the conversion of storage from PVC to
# kubernetes secrets.
#
# The maximum tries before proceding with the conversion of storage
# from PVC to kubernetes secrets.
maxTries: 12
# Number of seconds slept between each tries before proceding with
# the conversion of storage from PVC to kubernetes secrets.
sleepTime: 5
# Labeling pods for StarlingX core management. Setting 'true' will schedule pods to be run on
# application cores, while setting 'false' will schedule pods to be run on platform cores.
labels:
isApplication: false
# Request openbao-manager to pause on startup.
#
# The pause feature allows execution of openbao-manager to be suspended
# for external operations or for debugging. A pause_on_trap file will
# be created with the content of this value. Values may include a
# positive integer matching a call of exit_on_trap
#
# pause: 1
# Debugging option to improve log reading, allow more verbose logging
# DEBUG: 1
# INFO: 2
# WARNING: 3
# ERROR: 4
# FATAL: 5
log:
defaultLogLevel: 2
# All options related to openbao manager healthcheck funtion
healthcheck:
# Disables the healthcheck function. It will always return as "healthy"
# When this is set to true
disableHC: false
# Enables the network excuse of the healthcheck function. When enabled,
# healthcheck function will always return as "healthy" when openbao manager
# is accessing openbao REST API
enableNetwork: true
# Enables the initialization excuse of the healthcheck funtion. When
# enabled, healthcheck function will always return as "healthy" when openbao
# manager is initializing
enableInit: true
# Enables the pause excuse of the healthcheck function. when enabled,
# healthcheck function will always return as "healthy" when openbao manager
# is paused during exit_on_trap by the pause option.
enablePause: true
# Maximum threshold in seconds, between the last heartbeat and healthcheck.
# If the time passed between the last heartbeat and the latest healthcheck
# passes the threshold value, then the healthcheck will fail if no excuses
# were found.
heartbeatThreshold: 30
# All options related to openbao manager liveness probe. Consult the kubernetes
# documentation to find more details on each options.
livenessProbe:
# Number of seconds before the first probe is initiated
initialDelaySeconds: 0
# Number of seconds between each probe
periodSeconds: 10
# Number of seconds before the probe times out
timeoutSeconds: 1
# Number of successful probes required for the pod to be considered
# successful.
successThreshold: 1
# Number of failed probes required for the pod to be considered failed
failureThreshold: 3
# Number of seconds to wait from triggering the shutdown on the container,
# and the forced stop of the container by the container runtime.
terminationGracePeriodSeconds: 30

5
helm-charts/upstream/openbao-helm/debian/deb_folder/changelog Normal file
View File

@ -0,0 +1,5 @@
openbao-helm (0.7-0) unstable; urgency=medium
* Initial release.
-- Tae Park <tae.park@windriver.com> Thu, 10 Oct 2024 19:34:18 -0400

16
helm-charts/upstream/openbao-helm/debian/deb_folder/control Normal file
View File

@ -0,0 +1,16 @@
Source: openbao-helm
Section: libs
Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
helm,
build-info,
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io
Package: openbao-helm
Section: libs
Architecture: any
Depends: ${misc:Depends}
Description: StarlingX Openbao Helm Charts
This package contains helm charts for the openbao application.

48
helm-charts/upstream/openbao-helm/debian/deb_folder/copyright Normal file
View File

@ -0,0 +1,48 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Openbao-helm
Source: https://opendev.org/starlingx/app-openbao/
Files: *
Copyright: (c) 2024 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.
# If you want to use GPL v2 or later for the /debian/* files use
# the following clauses, or change it to suit. Delete these two lines
Files: debian/*
Copyright: 2024 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.
Files: usr/lib/helm/*
Copyright: 2024 Openbao
License: MPL 2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.

1
helm-charts/upstream/openbao-helm/debian/deb_folder/openbao-helm.install Normal file
View File

@ -0,0 +1 @@
usr/lib/helm/*

33
helm-charts/upstream/openbao-helm/debian/deb_folder/patches/0001-Add-yaml-for-Starlingx-image-handling.patch Normal file
View File

@ -0,0 +1,33 @@
From e1040978fd030a5d2b8f623c59adf3a3764c9c33 Mon Sep 17 00:00:00 2001
From: Tae Park <tae.park@windriver.com>
Date: Mon, 21 Oct 2024 09:30:07 -0400
Subject: [PATCH] Add yaml for Starlingx image handling
Add values yaml compatible with Starlingx platform's image pull and
service parameter registry override handling. The platform will pull
the image and populate registry.local, and the injector agent will
pull from registry.local.
Signed-off-by: Tae Park <tae.park@windriver.com>
---
charts/openbao/values.yaml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/charts/openbao/values.yaml b/charts/openbao/values.yaml
index d9c59a6..bc82fc8 100644
--- a/charts/openbao/values.yaml
+++ b/charts/openbao/values.yaml
@@ -79,6 +79,10 @@ injector:
# containers. This should be set to the official OpenBao image. OpenBao 1.3.1+ is
# required.
agentImage:
+ image:
+ registry: "quay.io"
+ repository: "openbao/openbao"
+ tag: "2.1.0"
# -- image registry to use for agent image
registry: "quay.io"
# -- image repo to use for agent image
--
2.34.1

74
helm-charts/upstream/openbao-helm/debian/deb_folder/patches/0002-update-includeConfigAnnotation-to-match-README-value.patch Normal file
View File

@ -0,0 +1,74 @@
From 51bbb43dd02b0be89b05549ebae6107fb5ab4e29 Mon Sep 17 00:00:00 2001
From: Michel Thebeau <michel.thebeau@windriver.com>
Date: Mon, 13 Jan 2025 16:01:08 -0500
Subject: [PATCH] update includeConfigAnnotation to match README/values
The value of server.includeConfigAnnotation is presented in the
README.md and values.yaml as server.configAnnotation.
Update the server configmap, _helpers.tpl and unit tests to align with
the documentation.
Signed-off-by: Michel Thebeau <michel.thebeau@windriver.com>
---
charts/openbao/templates/_helpers.tpl | 2 +-
charts/openbao/templates/server-config-configmap.yaml | 2 +-
test/unit/server-configmap.bats | 2 +-
test/unit/server-statefulset.bats | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/charts/openbao/templates/_helpers.tpl b/charts/openbao/templates/_helpers.tpl
index 2650db5..08c71ee 100644
--- a/charts/openbao/templates/_helpers.tpl
+++ b/charts/openbao/templates/_helpers.tpl
@@ -448,7 +448,7 @@ Sets extra pod annotations
*/}}
{{- define "openbao.annotations" }}
annotations:
- {{- if .Values.server.includeConfigAnnotation }}
+ {{- if .Values.server.configAnnotation }}
openbao.hashicorp.com/config-checksum: {{ include "openbao.config" . | sha256sum }}
{{- end }}
{{- if .Values.server.annotations }}
diff --git a/charts/openbao/templates/server-config-configmap.yaml b/charts/openbao/templates/server-config-configmap.yaml
index 585ae7a..57c4b0e 100644
--- a/charts/openbao/templates/server-config-configmap.yaml
+++ b/charts/openbao/templates/server-config-configmap.yaml
@@ -18,7 +18,7 @@ metadata:
app.kubernetes.io/name: {{ include "openbao.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.server.includeConfigAnnotation }}
+{{- if .Values.server.configAnnotation }}
annotations:
vault.hashicorp.com/config-checksum: {{ include "openbao.config" . | sha256sum }}
{{- end }}
diff --git a/test/unit/server-configmap.bats b/test/unit/server-configmap.bats
index 55d67e9..aa34edc 100755
--- a/test/unit/server-configmap.bats
+++ b/test/unit/server-configmap.bats
@@ -153,7 +153,7 @@ load _helpers
cd `chart_dir`
local actual=$(helm template \
--show-only templates/server-config-configmap.yaml \
- --set 'server.includeConfigAnnotation=true' \
+ --set 'server.configAnnotation=true' \
. | tee /dev/stderr |
yq '.metadata.annotations["vault.hashicorp.com/config-checksum"] == null' | tee /dev/stderr)
[ "${actual}" = "false" ]
diff --git a/test/unit/server-statefulset.bats b/test/unit/server-statefulset.bats
index 9a4bf3e..f089252 100755
--- a/test/unit/server-statefulset.bats
+++ b/test/unit/server-statefulset.bats
@@ -1636,7 +1636,7 @@ load _helpers
cd `chart_dir`
local actual=$(helm template \
--show-only templates/server-statefulset.yaml \
- --set 'server.includeConfigAnnotation=true' \
+ --set 'server.configAnnotation=true' \
. | tee /dev/stderr |
yq '.spec.template.metadata.annotations["openbao.hashicorp.com/config-checksum"] == null' | tee /dev/stderr)
[ "${actual}" = "false" ]
--
2.34.1

33
helm-charts/upstream/openbao-helm/debian/deb_folder/patches/0003-Fix-helm-template-for-server-annotations.patch Normal file
View File

@ -0,0 +1,33 @@
From d92aafc376d718d1b0cd802b51129839c9f5b01a Mon Sep 17 00:00:00 2001
From: Tae Park <tae.park@windriver.com>
Date: Mon, 16 Dec 2024 14:51:11 -0500
Subject: [PATCH] Fix helm template for server annotations
The current version of openbao-helm has bug in the server annotation
template. A values.yaml with empty server annotation produces a
server-statefulset.yaml containing a key
spec.template.metadata.annotations with no assigned value. This patch
updates the logic in the template to not create empty yaml key.
Signed-off-by: Tae Park <tae.park@windriver.com>
---
charts/openbao/templates/_helpers.tpl | 2 ++
1 file changed, 2 insertions(+)
diff --git a/charts/openbao/templates/_helpers.tpl b/charts/openbao/templates/_helpers.tpl
index 08c71ee..1fecef9 100644
--- a/charts/openbao/templates/_helpers.tpl
+++ b/charts/openbao/templates/_helpers.tpl
@@ -447,7 +447,9 @@ Sets the injector deployment update strategy
Sets extra pod annotations
*/}}
{{- define "openbao.annotations" }}
+ {{- if or (.Values.server.annotations) (.Values.server.configAnnotation) }}
annotations:
+ {{- end }}
{{- if .Values.server.configAnnotation }}
openbao.hashicorp.com/config-checksum: {{ include "openbao.config" . | sha256sum }}
{{- end }}
--
2.34.1

31
helm-charts/upstream/openbao-helm/debian/deb_folder/patches/0004-Fix-agent-image-registry-in-injector-deployment.patch Normal file
View File

@ -0,0 +1,31 @@
From b98367b9f629c42fae00e4288127d7559943c2a4 Mon Sep 17 00:00:00 2001
From: Tae Park <tae.park@windriver.com>
Date: Fri, 10 Jan 2025 09:50:23 -0500
Subject: [PATCH] Fix agent image registry in injector deployment
The value for AGENT_INJECT_VAULT_IMAGE in injector-deployment.yaml
incorrectly points to injector image's registry instead of the agent
image registry. This changes the registry to the correct agent image
one, so the agent image variable points to the correct image.
Signed-off-by: Tae Park <tae.park@windriver.com>
---
charts/openbao/templates/injector-deployment.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/charts/openbao/templates/injector-deployment.yaml b/charts/openbao/templates/injector-deployment.yaml
index 64e0de2..d66f6d1 100644
--- a/charts/openbao/templates/injector-deployment.yaml
+++ b/charts/openbao/templates/injector-deployment.yaml
@@ -69,7 +69,7 @@ spec:
- name: AGENT_INJECT_VAULT_AUTH_PATH
value: {{ .Values.injector.authPath }}
- name: AGENT_INJECT_VAULT_IMAGE
- value: "{{ .Values.injector.image.registry | default "quay.io" }}/{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag }}"
+ value: "{{ .Values.injector.agentImage.registry | default "quay.io" }}/{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag }}"
{{- if .Values.injector.certs.secretName }}
- name: AGENT_INJECT_TLS_CERT_FILE
value: "/etc/webhook/certs/{{ .Values.injector.certs.certName }}"
--
2.34.1

4
helm-charts/upstream/openbao-helm/debian/deb_folder/patches/series Normal file
View File

@ -0,0 +1,4 @@
0001-Add-yaml-for-Starlingx-image-handling.patch
0002-update-includeConfigAnnotation-to-match-README-value.patch
0003-Fix-helm-template-for-server-annotations.patch
0004-Fix-agent-image-registry-in-injector-deployment.patch

29
helm-charts/upstream/openbao-helm/debian/deb_folder/rules Executable file
View File

@ -0,0 +1,29 @@
#!/usr/bin/make -f
export DH_VERBOSE = 1
export DEB_VERSION = $(shell dpkg-parsechangelog | egrep '^Version:' | cut -f 2 -d ' ')
export PATCH_VERSION = $(shell echo $(DEB_VERSION) | cut -f 4 -d '.')
export CHART_BASE_VERSION = $(shell echo $(DEB_VERSION) | sed 's/-/./' | cut -d '.' -f 1-3)
export CHART_VERSION = $(CHART_BASE_VERSION)+STX.$(PATCH_VERSION)
export ROOT = debian/tmp
export APP_FOLDER = $(ROOT)/usr/lib/helm
%:
dh $@
override_dh_auto_build:
# Set up chart build files.
mkdir openbao
cp charts/openbao/Chart.yaml charts/openbao/values.yaml openbao
cp openbao-certificates.yaml charts/openbao/templates
mv charts/openbao/templates openbao/templates
# Create the TGZ file.
make CHART_VERSION=$(CHART_VERSION) openbao
override_dh_auto_install:
# Install the app tar file.
install -d -m 755 $(APP_FOLDER)
install -p -D -m 755 openbao*.tgz $(APP_FOLDER)
override_dh_auto_test:

1
helm-charts/upstream/openbao-helm/debian/deb_folder/source/format Normal file
View File

@ -0,0 +1 @@
3.0 (quilt)

14
helm-charts/upstream/openbao-helm/debian/meta_data.yaml Normal file
View File

@ -0,0 +1,14 @@
---
debname: openbao-helm
debver: 0.7-0
dl_path:
name: openbao-0.7.0.tar.gz
url: https://github.com/openbao/openbao-helm/archive/refs/tags/openbao-0.7.0.tar.gz
sha256sum: ade5a12443a76a98a65764853ab6d1840d45654a9b3e1aa6098c1b59b4847dfc
src_files:
- openbao-helm/files/Makefile
- openbao-helm/helm-charts/openbao-certificates.yaml
revision:
dist: $STX_DIST
PKG_GITREVCOUNT:
PKG_BASE_SRCREV: 0144b018a6a592860dace539e9fb937af7b2d26f

5
helm-charts/upstream/openbao-helm/openbao-helm/README Normal file
View File

@ -0,0 +1,5 @@
This directory contains all StarlingX charts that need to be built for this
application. Some charts are common across applications. These common charts
reside in the stx-config/kubernetes/helm-charts directory. To include these in
this application update the build_srpm.data file and use the COPY_LIST_TO_TAR
mechanism to populate these common charts.

41
helm-charts/upstream/openbao-helm/openbao-helm/files/Makefile Normal file
View File

@ -0,0 +1,41 @@
#
# Copyright 2017 The Openstack-Helm Authors.
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# It's necessary to set this because some environments don't link sh -> bash.
SHELL := /bin/bash
TASK := build
EXCLUDES := doc tests tools logs tmp
CHARTS := $(filter-out $(EXCLUDES), $(patsubst %/.,%,$(wildcard */.)))
.PHONY: $(EXCLUDES) $(CHARTS)
all: $(CHARTS)
$(CHARTS):
@if [ -d $@ ]; then \
echo; \
echo "===== Processing [$@] chart ====="; \
make $(TASK)-$@; \
fi
init-%:
if [ -f $*/Makefile ]; then make -C $*; fi
lint-%: init-%
if [ -d $* ]; then helm lint $*; fi
build-%:
if [ -d $* ]; then helm package --version $(CHART_VERSION) $*; fi
clean:
@echo "Clean all build artifacts"
rm -f */templates/_partials.tpl */templates/_globals.tpl
rm -rf */charts */tmpcharts
%:
@:

73
helm-charts/upstream/openbao-helm/openbao-helm/helm-charts/openbao-certificates.yaml Normal file
View File

@ -0,0 +1,73 @@
{{ $ca := genCA "svc-cat-ca" 3650 }}
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
name: {{ template "openbao.name" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app: {{ template "openbao.name" . }}
chart: {{ template "openbao.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
annotations:
"helm.sh/hook": "pre-install"
"helm.sh/hook-delete-policy": "before-hook-creation"
data:
tls.crt: {{ b64enc $ca.Cert }}
tls.key: {{ b64enc $ca.Key }}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
creationTimestamp: null
name: ca-issuer
namespace: {{ .Release.Namespace }}
spec:
ca:
secretName: {{ template "openbao.name" . }}-ca
status: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
creationTimestamp: null
name: openbao-server-tls
namespace: {{ .Release.Namespace }}
spec:
# Secret names are always required.
secretName: openbao-server-tls
duration: 2160h0m0s # 90d
renewBefore: 360h0m0s # 15d
usages:
- server auth
- client auth
# At least one of a DNS Name, URI, or IP address is required.
dnsNames:
- stx-{{ template "openbao.name" . }}
- '*.stx-{{ template "openbao.name" . }}-internal'
- '*.{{ .Release.Namespace }}.pod.cluster.local'
- stx-{{ template "openbao.name" . }}.{{ .Release.Namespace }}
- stx-{{ template "openbao.name" . }}.{{ .Release.Namespace }}.svc
- stx-{{ template "openbao.name" . }}.{{ .Release.Namespace }}.svc.cluster.local
- stx-{{ template "openbao.name" .}}-active.{{ .Release.Namespace }}.svc.cluster.local
ipAddresses:
- 127.0.0.1
# Issuer references are always required.
issuerRef:
name: ca-issuer
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
# This is optional since cert-manager will default to this value however
# if you are using an external issuer, change this to that issuer group.
group: cert-manager.io
privateKey:
algorithm: RSA
encoding: PKCS1
size: 2048
subject:
organizations:
- stx
status: {}

5
python3-k8sapp-openbao/debian/deb_folder/changelog Normal file
View File

@ -0,0 +1,5 @@
python3-k8sapp-openbao (1.0-1) unstable; urgency=medium
* Initial release.
-- Tae Park <tae.park@windriver.com> Thu, 10 Oct 2024 19:34:18 -0400

27
python3-k8sapp-openbao/debian/deb_folder/control Normal file
View File

@ -0,0 +1,27 @@
Source: python3-k8sapp-openbao
Section: libs
Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
dh-python,
python3-all,
python3-pbr,
python3-setuptools,
python3-wheel,
build-info
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io
Package: python3-k8sapp-openbao
Section: libs
Architecture: any
Depends: ${misc:Depends}, ${python3:Depends}
Description: StarlingX Sysinv Openbao Extensions
This package contains sysinv plugins for the openbao K8S app.
Package: python3-k8sapp-openbao-wheels
Section: libs
Architecture: any
Depends: ${misc:Depends}, ${python3:Depends}, python3-wheel
Description: StarlingX Sysinv Openbao Extension Wheels
This package contains python wheels for the openbao K8S app plugins.

41
python3-k8sapp-openbao/debian/deb_folder/copyright Normal file
View File

@ -0,0 +1,41 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: python3-k8sapp-openbao
Source: https://opendev.org/starlingx/app-openbao/
Files: *
Copyright: (c) 2024 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.
# If you want to use GPL v2 or later for the /debian/* files use
# the following clauses, or change it to suit. Delete these two lines
Files: debian/*
Copyright: 2024 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.

1
python3-k8sapp-openbao/debian/deb_folder/python3-k8sapp-openbao-wheels.install Normal file
View File

@ -0,0 +1 @@
plugins/*.whl

1
python3-k8sapp-openbao/debian/deb_folder/python3-k8sapp-openbao.install Normal file
View File

@ -0,0 +1 @@
usr/lib/python3/dist-packages/k8sapp_*

33
python3-k8sapp-openbao/debian/deb_folder/rules Executable file
View File

@ -0,0 +1,33 @@
#!/usr/bin/make -f
# export DH_VERBOSE = 1
export APP_NAME = openbao
export PYBUILD_NAME = k8sapp-openbao
export DEB_VERSION = $(shell dpkg-parsechangelog | egrep '^Version:' | cut -f 2 -d ' ')
export MAJOR = $(shell cat /etc/build.info | grep SW_VERSION | cut -d'"' -f2)
export MINOR_PATCH = $(shell echo $(DEB_VERSION) | cut -f 4 -d '.')
export PBR_VERSION = $(MAJOR).$(MINOR_PATCH)
export ROOT = $(CURDIR)/debian/tmp
export SKIP_PIP_INSTALL = 1
%:
dh $@ --with=python3 --buildsystem=pybuild
override_dh_auto_install:
env | sort
python3 setup.py install \
--install-layout=deb \
--root $(ROOT)
python3 setup.py bdist_wheel \
--universal \
-d $(ROOT)/plugins
override_dh_python3:
dh_python3 --shebang=/usr/bin/python3
override_dh_auto_test:
PYTHONDIR=$(CURDIR) stestr run

1
python3-k8sapp-openbao/debian/deb_folder/source/format Normal file
View File

@ -0,0 +1 @@
3.0 (quilt)

9
python3-k8sapp-openbao/debian/meta_data.yaml Normal file
View File

@ -0,0 +1,9 @@
---
debname: python3-k8sapp-openbao
debver: 1.0-1
src_path: k8sapp_openbao
revision:
dist: $STX_DIST
SRC_GITREVCOUNT:
SRC_DIR: ${MY_REPO}/stx/app-openbao
SRC_BASE_SRCREV: 0144b018a6a592860dace539e9fb937af7b2d26f

35
python3-k8sapp-openbao/k8sapp_openbao/.gitignore vendored Normal file
View File

@ -0,0 +1,35 @@
# Compiled files
*.py[co]
*.a
*.o
*.so
# Sphinx
_build
doc/source/api/
# Packages/installer info
*.egg
*.egg-info
dist
build
eggs
parts
var
sdist
develop-eggs
.installed.cfg
# Other
*.DS_Store
.stestr
.testrepository
.tox
.venv
.*.swp
.coverage
bandit.xml
cover
AUTHORS
ChangeLog
*.sqlite

4
python3-k8sapp-openbao/k8sapp_openbao/.stestr.conf Normal file
View File

@ -0,0 +1,4 @@
[DEFAULT]
test_path=./k8sapp_openbao/tests
top_dir=./k8sapp_openbao
#parallel_class=True

202
python3-k8sapp-openbao/k8sapp_openbao/LICENSE Normal file
View File

@ -0,0 +1,202 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright 2019 Wind River Systems, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

7
python3-k8sapp-openbao/k8sapp_openbao/README.rst Normal file
View File

@ -0,0 +1,7 @@
k8sapp-openbao
===================
This project contains StarlingX Kubernetes application specific python plugins
for Openbao. These plugins are required to integrate the openbao authorization
application into the StarlingX application framework and to support the
various StarlingX deployments.

0
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/__init__.py Normal file
View File

0
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/common/__init__.py Normal file
View File

23
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/common/constants.py Normal file
View File

@ -0,0 +1,23 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
"""Constants values for openbao helm"""
# Helm: Supported charts:
# These values match the names in the chart package's Chart.yaml
HELM_APP_OPENBAO = 'openbao'
HELM_RELEASE_OPENBAO = 'stx-openbao'
HELM_CHART_OPENBAO = 'openbao'
HELM_RELEASE_OPENBAO_MANAGER = 'stx-openbao-manager'
HELM_CHART_OPENBAO_MANAGER = 'openbao-manager'
HELM_CHART_NS_OPENBAO = 'openbao'
HELM_OPENBAO_SERVER_POD = 'server'
HELM_OPENBAO_MANAGER_POD = 'manager'
HELM_OPENBAO_INJECTOR_POD = 'injector'
HELM_CHART_COMPONENT_LABEL = 'app.starlingx.io/component'
KEYSHARDS = 5

0
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/helm/__init__.py Normal file
View File

166
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/helm/openbao.py Normal file
View File

@ -0,0 +1,166 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
"""Application helm class"""
from k8sapp_openbao.common import constants as app_constants
from oslo_log import log as logging
from sysinv.common import constants
from sysinv.common import exception
from sysinv.common import kubernetes
from sysinv.helm import base
from sysinv.helm import common
from sysinv.db import api as dbapi
import yaml
LOG = logging.getLogger(__name__)
class OpenbaoHelm(base.FluxCDBaseHelm):
"""Class to encapsulate helm operations for the openbao chart"""
SUPPORTED_NAMESPACES = base.BaseHelm.SUPPORTED_NAMESPACES + \
[common.HELM_NS_OPENBAO]
SUPPORTED_APP_NAMESPACES = {
constants.HELM_APP_OPENBAO:
base.BaseHelm.SUPPORTED_NAMESPACES + [common.HELM_NS_OPENBAO],
}
SUPPORTED_COMPONENT_OVERRIDES = ['application', 'platform']
DEFAULT_AFFINITY = 'platform'
LABEL_PARAMETER = 'extraLabels'
CHART = app_constants.HELM_CHART_OPENBAO
HELM_RELEASE = app_constants.HELM_RELEASE_OPENBAO
def get_namespaces(self):
"""Return the list of supported namespaces"""
return self.SUPPORTED_NAMESPACES
def get_master_worker_host_count(self):
"""Read the number of nodes with worker function"""
controller = len(self.dbapi.ihost_get_by_personality(constants.CONTROLLER))
worker = len(self.dbapi.ihost_get_by_personality(constants.WORKER))
return controller + worker
def get_overrides(self, namespace=None):
"""Return the system overrides"""
if self.get_master_worker_host_count() >= 3:
ha_replicas = 3
else:
ha_replicas = 1
dbapi_instance = dbapi.get_instance()
db_app = dbapi_instance.kube_app_get(app_constants.HELM_APP_OPENBAO)
# User chart overrides
new_chart_overrides = self._get_helm_overrides(
dbapi_instance,
db_app,
app_constants.HELM_CHART_OPENBAO,
app_constants.HELM_CHART_NS_OPENBAO,
'user_overrides')
k8s_version = ""
try:
kube = kubernetes.KubeOperator()
k8s_version = kube.kube_get_kubernetes_version()
except exception.KubeNotConfigured:
# Do not check for psp override if kubernetes is not configured yet
pass
if (k8s_version >= "v1.25.1"
and new_chart_overrides
and "global" in new_chart_overrides.keys()
and "psp" in new_chart_overrides["global"].keys()
and "enable" in new_chart_overrides["global"]["psp"].keys()
and new_chart_overrides["global"]["psp"]["enable"] is True):
LOG.info("PSP must be disabled for kubernetes version 1.25 and onwards, "
"as the feature is depreciated. User helm override will be changed "
"so that global.psp.enabled is false")
new_chart_overrides["global"]["psp"]["enable"] = False
self._update_helm_overrides(
dbapi_instance,
db_app,
app_constants.HELM_CHART_OPENBAO,
app_constants.HELM_CHART_NS_OPENBAO,
'user_overrides',
new_chart_overrides
)
user_chosen_affinity = new_chart_overrides.get(
app_constants.HELM_CHART_COMPONENT_LABEL) \
if new_chart_overrides else None
if user_chosen_affinity in self.SUPPORTED_COMPONENT_OVERRIDES:
affinity = user_chosen_affinity
else:
affinity = self.DEFAULT_AFFINITY
LOG.warn((f'User override for core affinity {user_chosen_affinity} '
f'is invalid, using default of {self.DEFAULT_AFFINITY}'))
overrides = {
common.HELM_NS_OPENBAO: {
app_constants.HELM_OPENBAO_SERVER_POD: {
'ha': {
'replicas': ha_replicas,
},
self.LABEL_PARAMETER: {
app_constants.HELM_CHART_COMPONENT_LABEL: affinity
}
},
app_constants.HELM_OPENBAO_INJECTOR_POD: {
self.LABEL_PARAMETER: {
app_constants.HELM_CHART_COMPONENT_LABEL: affinity
}
},
}
}
if namespace in self.SUPPORTED_NAMESPACES:
return overrides[namespace]
if namespace:
raise exception.InvalidHelmNamespace(chart=self.CHART,
namespace=namespace)
return overrides
@staticmethod
def _get_helm_overrides(dbapi_instance, app, chart, namespace,
type_of_overrides):
"""Helper function for querying helm overrides from db."""
helm_overrides = {}
try:
helm_overrides = dbapi_instance.helm_override_get(
app_id=app.id,
name=chart,
namespace=namespace,
)[type_of_overrides]
if isinstance(helm_overrides, str):
helm_overrides = yaml.safe_load(helm_overrides)
except exception.HelmOverrideNotFound:
LOG.debug("Overrides for this chart not found, nothing to be done.")
return helm_overrides
@staticmethod
def _update_helm_overrides(dbapi_instance, app, chart, namespace,
type_of_overrides, value):
"""Helper function for updating helm overrides to db."""
helm_overrides = {type_of_overrides: yaml.safe_dump(value)}
dbapi_instance.helm_override_update(
app_id=app.id,
name=chart,
namespace=namespace,
values=helm_overrides
)

127
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/helm/openbao_manager.py Normal file
View File

@ -0,0 +1,127 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
"""Application helm class"""
from k8sapp_openbao.common import constants as app_constants
from oslo_log import log as logging
from sysinv.common import constants
from sysinv.common import exception
from sysinv.helm import base
from sysinv.helm import common
from sysinv.db import api as dbapi
import yaml
LOG = logging.getLogger(__name__)
class OpenbaoManagerHelm(base.FluxCDBaseHelm):
"""Class to encapsulate helm operations for the openbao manager chart"""
SUPPORTED_NAMESPACES = base.BaseHelm.SUPPORTED_NAMESPACES + \
[common.HELM_NS_OPENBAO]
SUPPORTED_APP_NAMESPACES = {
constants.HELM_APP_OPENBAO:
base.BaseHelm.SUPPORTED_NAMESPACES + [common.HELM_NS_OPENBAO],
}
SUPPORTED_COMPONENT_OVERRIDES = ['application', 'platform']
DEFAULT_AFFINITY = 'platform'
LABEL_PARAMETER = 'extraLabels'
CHART = app_constants.HELM_CHART_OPENBAO_MANAGER
HELM_RELEASE = app_constants.HELM_RELEASE_OPENBAO_MANAGER
def execute_kustomize_updates(self, operator):
# On application load this chart is enabled. Only disable if
# specified by the user
if not self._is_enabled(operator.APP, self.CHART,
common.HELM_NS_OPENBAO):
operator.helm_release_resource_delete(self.CHART)
def get_namespaces(self):
"""Return the list of supported namespaces"""
return self.SUPPORTED_NAMESPACES
def get_master_worker_host_count(self):
"""Read the number of nodes with worker function"""
controller = len(self.dbapi.ihost_get_by_personality(constants.CONTROLLER))
worker = len(self.dbapi.ihost_get_by_personality(constants.WORKER))
return controller + worker
def get_overrides(self, namespace=None):
"""Return the system overrides"""
if self.get_master_worker_host_count() >= 3:
ha_replicas = 3
else:
ha_replicas = 1
dbapi_instance = dbapi.get_instance()
db_app = dbapi_instance.kube_app_get(app_constants.HELM_APP_OPENBAO)
# User chart overrides
new_chart_overrides = self._get_helm_overrides(
dbapi_instance,
db_app,
app_constants.HELM_CHART_OPENBAO_MANAGER,
app_constants.HELM_CHART_NS_OPENBAO,
'user_overrides')
user_chosen_affinity = new_chart_overrides.get(
app_constants.HELM_CHART_COMPONENT_LABEL) \
if new_chart_overrides else None
if user_chosen_affinity in self.SUPPORTED_COMPONENT_OVERRIDES:
affinity = user_chosen_affinity
else:
affinity = self.DEFAULT_AFFINITY
LOG.warn((f'User override for core affinity {user_chosen_affinity} '
f'is invalid, using default of {self.DEFAULT_AFFINITY}'))
overrides = {
common.HELM_NS_OPENBAO: {
app_constants.HELM_OPENBAO_MANAGER_POD: {
'ha': {
'replicas': ha_replicas,
},
self.LABEL_PARAMETER: {
app_constants.HELM_CHART_COMPONENT_LABEL: affinity
}
},
}
}
if namespace in self.SUPPORTED_NAMESPACES:
return overrides[namespace]
if namespace:
raise exception.InvalidHelmNamespace(chart=self.CHART,
namespace=namespace)
return overrides
@staticmethod
def _get_helm_overrides(dbapi_instance, app, chart, namespace,
type_of_overrides):
"""Helper function for querying helm overrides from db."""
helm_overrides = {}
try:
helm_overrides = dbapi_instance.helm_override_get(
app_id=app.id,
name=chart,
namespace=namespace,
)[type_of_overrides]
if isinstance(helm_overrides, str):
helm_overrides = yaml.safe_load(helm_overrides)
except exception.HelmOverrideNotFound:
LOG.debug("Overrides for this chart not found, nothing to be done.")
return helm_overrides

19
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/kustomize/__init__.py Normal file
View File

@ -0,0 +1,19 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
import yaml
class quoted_str(str):
pass
# force strings to be single-quoted to avoid interpretation as numeric values
def quoted_presenter(dumper, data):
return dumper.represent_scalar(u'tag:yaml.org,2002:str', data, style="'")
yaml.add_representer(quoted_str, quoted_presenter)

28
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/kustomize/kustomize_openbao.py Normal file
View File

@ -0,0 +1,28 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# All Rights Reserved.
#
""" System inventory Kustomization resource operator."""
from sysinv.common import constants
from sysinv.helm import kustomize_base as base
class OpenbaoFluxCDKustomizeOperator(base.FluxCDKustomizeOperator):
APP = constants.HELM_APP_OPENBAO
def platform_mode_kustomize_updates(self, dbapi, mode):
""" Update the top-level kustomization resource list
Make changes to the top-level kustomization resource list based
on the platform mode
:param dbapi: DB api object
:param mode: mode to control when to update the resource list
"""
pass

0
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/lifecycle/__init__.py Normal file
View File

36
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/lifecycle/lifecycle_openbao.py Normal file
View File

@ -0,0 +1,36 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# All Rights Reserved.
#
""" System inventory App lifecycle operator."""
from oslo_log import log as logging
from sysinv.helm import lifecycle_base as base
LOG = logging.getLogger(__name__)
class OpenbaoAppLifecycleOperator(base.AppLifecycleOperator):
"""Lifecycle operator for openbao application"""
def app_lifecycle_actions(self, context, conductor_obj, app_op, app, hook_info):
"""Perform lifecycle actions for an operation
:param context: request context, can be None
:param conductor_obj: conductor object, can be None
:param app_op: AppOperator object
:param app: AppOperator.Application object
:param hook_info: LifecycleHookInfo object
"""
LOG.info("lifecycle_type: {}, operation: {}, relative_timing: {}".format(
hook_info.lifecycle_type,
hook_info.operation,
hook_info.relative_timing))
super().app_lifecycle_actions(context, conductor_obj, app_op,
app, hook_info)

0
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/tests/__init__.py Normal file
View File

49
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/tests/test_openbao.py Normal file
View File

@ -0,0 +1,49 @@
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
from k8sapp_openbao.common import constants as app_constants
from k8sapp_openbao.tests import test_plugins
from sysinv.db import api as dbapi
from sysinv.helm import common
from sysinv.tests.db import base as dbbase
from sysinv.tests.db import utils as dbutils
from sysinv.tests.helm import base
class OpenbaoTestCase(test_plugins.K8SAppOpenbaoAppMixin,
base.HelmTestCaseMixin):
def setUp(self):
super(OpenbaoTestCase, self).setUp()
self.app = dbutils.create_test_app(name='openbao')
self.dbapi = dbapi.get_instance()
class OpenbaoIPv4ControllerHostTestCase(OpenbaoTestCase,
dbbase.ProvisionedControllerHostTestCase):
def test_replicas(self):
overrides = self.operator.get_helm_chart_overrides(
app_constants.HELM_CHART_OPENBAO,
cnamespace=common.HELM_NS_OPENBAO)
self.assertOverridesParameters(overrides, {
'server': {'ha': {'replicas': 1}}
})
class OpenbaoIPv6AIODuplexSystemTestCase(OpenbaoTestCase,
dbbase.BaseIPv6Mixin,
dbbase.ProvisionedAIODuplexSystemTestCase):
def test_replicas(self):
overrides = self.operator.get_helm_chart_overrides(
app_constants.HELM_CHART_OPENBAO,
cnamespace=common.HELM_NS_OPENBAO)
self.assertOverridesParameters(overrides, {
'server': {'ha': {'replicas': 1}}
})

39
python3-k8sapp-openbao/k8sapp_openbao/k8sapp_openbao/tests/test_plugins.py Normal file
View File

@ -0,0 +1,39 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
from sysinv.common import constants
from sysinv.tests.db import base as dbbase
class K8SAppOpenbaoAppMixin(object):
app_name = constants.HELM_APP_OPENBAO
path_name = app_name + '.tgz'
def setUp(self):
super(K8SAppOpenbaoAppMixin, self).setUp()
# Test Configuration:
# - Controller
# - IPv6
# - Ceph Storage
# - Openbao app
class K8sAppOpenbaoControllerTestCase(K8SAppOpenbaoAppMixin,
dbbase.BaseIPv6Mixin,
dbbase.BaseCephStorageBackendMixin,
dbbase.ControllerHostTestCase):
pass
# Test Configuration:
# - AIO
# - IPv4
# - Ceph Storage
# - Openbao app
class K8SAppOpenbaoAIOTestCase(K8SAppOpenbaoAppMixin,
dbbase.BaseCephStorageBackendMixin,
dbbase.AIOSimplexHostTestCase):
pass

336
python3-k8sapp-openbao/k8sapp_openbao/pylint.rc Normal file
View File

@ -0,0 +1,336 @@
[MASTER]
# Specify a configuration file.
rcfile=pylint.rc
# Python code to execute, usually for sys.path manipulation such as
# pygtk.require().
#init-hook=
# Add files or directories to the blacklist. Should be base names, not paths.
ignore=
# Pickle collected data for later comparisons.
persistent=yes
# List of plugins (as comma separated values of python modules names) to load,
# usually to register additional checkers.
load-plugins=
# Use multiple processes to speed up Pylint.
jobs=4
# Allow loading of arbitrary C extensions. Extensions are imported into the
# active Python interpreter and may run arbitrary code.
unsafe-load-any-extension=no
# A comma-separated list of package or module names from where C extensions may
# be loaded. Extensions are loading into the active Python interpreter and may
# run arbitrary code
extension-pkg-whitelist=lxml.etree,greenlet
[MESSAGES CONTROL]
# Disable the message, report, category or checker with the given id(s). You
# can either give multiple identifier separated by comma (,) or put this option
# multiple time (only on the command line, not in the configuration file where
# it should appear only once).
# See "Messages Control" section of
# https://pylint.readthedocs.io/en/latest/user_guide
disable=
# C codes refer to Convention
C0103, # invalid-name
C0104, # disallowed-nameA
C0112, # empty-docstring
C0114, # missing-module-docstring
C0115, # missing-class-docstring
C0116, # missing-function-docstring
C0123, # unidiomatic-typecheck !!!
C0201, # consider-iterating-dictionary
C0202, # bad-classmethod-argument
C0206, # consider-using-dict-items
C0207, # use-maxsplit-arg
C0209, # consider-using-f-string
C0301, # line-too-long
C0302, # too-many-lines
C0325, # superfluous-parens
C0411, # wrong-import-order
C0412, # ungrouped-imports
C0413, # wrong-import-position
C0414, # useless-import-alias !!!
C0415, # import-outside-toplevel
C1802, # use-implicit-booleaness-not-len !!!
C2801, # unnecessary-dunder-call !!!
C3002, # unnecessary-direct-lambda-call !!!
# R codes refer to refactoring
R0022, # useless-option-value !!!
R0205, # useless-object-inheritance
R0402, # consider-using-from-import
R0901, # too-many-ancestors
R0902, # too-many-instance-attributes
R0903, # too-few-public-methods
R0904, # too-many-public-methods
R0911, # too-many-return-statements
R0912, # too-many-branches
R0913, # too-many-arguments
R0914, # too-many-locals
R0915, # too-many-statements
R0916, # too-many-boolean-expressions
R1702, # too-many-nested-blocks
R1703, # simplifiable-if-statement
R1704, # redefined-argument-from-local !!!
R1705, # no-else-return
R1707, # trailing-comma-tuple !!!
R1708, # stop-iteration-return !!!
R1710, # inconsistent-return-statements
R1711, # useless-return
R1714, # consider-using-in
R1717, # consider-using-dict-comprehension !!!
R1718, # consider-using-set-comprehension
R1719, # simplifiable-if-expression
R1720, # no-else-raise
R1721, # unnecessary-comprehension
R1722, # consider-using-sys-exit !!!
R1723, # no-else-break
R1724, # no-else-continue
R1725, # super-with-arguments
R1726, # simplifiable-condition !!!
R1728, # consider-using-generator
R1729, # use-a-generator
R1730, # consider-using-min-builtin !!!
R1731, # consider-using-max-builtin !!!
R1732, # consider-using-with
R1733, # unnecessary-dict-index-lookup !!
R1734, # use-list-literal
R1735, # use-dict-literal
# W codes are warnings
W0101, # unreachable
W0105, # pointless-string-statement
W0106, # expression-not-assigned
W0107, # unnecessary-pass
W0108, # unnecessary-lambda
W0109, # duplicate-key !!!
W0123, # eval-used
W0125, # using-constant-test !!!
W0133, # pointless-exception-statement !!!
W0143, # comparison-with-callable !!!
W0150, # lost-exception
W0201, # attribute-defined-outside-init
W0211, # bad-staticmethod-argument
W0212, # protected-access
W0221, # arguments-differ
W0223, # abstract-method
W0231, # super-init-not-called
W0235, # useless-super-delegation
W0237, # arguments-renamed !!!
W0311, # bad-indentation
W0402, # deprecated-module
W0404, # reimported
W0511, # fixme
W0602, # global-variable-not-assigned !!!
W0603, # global-statement
W0612, # unused-variable
W0613, # unused-argument
W0621, # redefined-outer-name
W0622, # redefined-builtin
W0631, # undefined-loop-variable
W0703, # broad-except (pylint 2.16 renamed to broad-except-caught)
W0706, # try-except-raise
W0707, # raise-missing-from
W0719, # broad-exception-raised
W1113, # keyword-arg-before-vararg
W1310, # format-string-without-interpolation !!!
W1401, # anomalous-backslash-in-string
W1406, # redundant-u-string-prefix
W1505, # deprecated-method
W1514, # unspecified-encoding
W3101, # missing-timeout
E0601, # used-before-assignment !!!
E0605, # invalid-all-format !!!
E1101, # no-member
E1111, # assignment-from-no-return
E1121, # too-many-function-args !!!
E1123, # unexpected-keyword-arg !!!
E1136, # unsubscriptable-object !!!
[REPORTS]
# Set the output format. Available formats are text, parseable, colorized, msvs
# (visual studio) and html
output-format=text
# Tells whether to display a full report or only the messages
reports=no
# Python expression which should return a note less than 10 (10 is the highest
# note). You have access to the variables errors warning, statement which
# respectively contain the number of errors / warnings messages and the total
# number of statements analyzed. This is used by the global evaluation report
# (RP0004).
evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
[SIMILARITIES]
# Minimum lines number of a similarity.
min-similarity-lines=4
# Ignore comments when computing similarities.
ignore-comments=yes
# Ignore docstrings when computing similarities.
ignore-docstrings=yes
[FORMAT]
# Maximum number of characters on a single line.
max-line-length=85
# Maximum number of lines in a module
max-module-lines=1000
# String used as indentation unit. This is usually 4 spaces or "\t" (1 tab).
indent-string=' '
[TYPECHECK]
# Tells whether missing members accessed in mixin class should be ignored. A
# mixin class is detected if its name ends with "mixin" (case insensitive).
ignore-mixin-members=yes
# List of module names for which member attributes should not be checked
# (useful for modules/projects where namespaces are manipulated during runtime
# and thus existing member attributes cannot be deduced by static analysis
ignored-modules=distutils,eventlet.green.subprocess,six,six.moves
# List of classes names for which member attributes should not be checked
# (useful for classes with attributes dynamically set).
# pylint is confused by sqlalchemy Table, as well as sqlalchemy Enum types
# ie: (unprovisioned, identity)
# LookupDict in requests library confuses pylint
ignored-classes=SQLObject, optparse.Values, thread._local, _thread._local,
Table, unprovisioned, identity, LookupDict
# List of members which are set dynamically and missed by pylint inference
# system, and so shouldn't trigger E0201 when accessed. Python regular
# expressions are accepted.
generated-members=REQUEST,acl_users,aq_parent
[BASIC]
# Regular expression which should only match correct module names
module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
# Regular expression which should only match correct module level names
const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
# Regular expression which should only match correct class names
class-rgx=[A-Z_][a-zA-Z0-9]+$
# Regular expression which should only match correct function names
function-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct method names
method-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct instance attribute names
attr-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct argument names
argument-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct variable names
variable-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct list comprehension /
# generator expression variable names
inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
# Good variable names which should always be accepted, separated by a comma
good-names=i,j,k,ex,Run,_
# Bad variable names which should always be refused, separated by a comma
bad-names=foo,bar,baz,toto,tutu,tata
# Regular expression which should only match functions or classes name which do
# not require a docstring
no-docstring-rgx=__.*__
[MISCELLANEOUS]
# List of note tags to take in consideration, separated by a comma.
notes=FIXME,XXX,TODO
[VARIABLES]
# Tells whether we should check for unused import in __init__ files.
init-import=no
# A regular expression matching the beginning of the name of dummy variables
# (i.e. not used).
dummy-variables-rgx=_|dummy
# List of additional names supposed to be defined in builtins. Remember that
# you should avoid to define new builtins when possible.
additional-builtins=
[IMPORTS]
# Deprecated modules which should not be used, separated by a comma
deprecated-modules=regsub,string,TERMIOS,Bastion,rexec
# Create a graph of every (i.e. internal and external) dependencies in the
# given file (report RP0402 must not be disabled)
import-graph=
# Create a graph of external dependencies in the given file (report RP0402 must
# not be disabled)
ext-import-graph=
# Create a graph of internal dependencies in the given file (report RP0402 must
# not be disabled)
int-import-graph=
[DESIGN]
# Maximum number of arguments for function / method
max-args=5
# Argument names that match this expression will be ignored. Default to name
# with leading underscore
ignored-argument-names=_.*
# Maximum number of locals for function / method body
max-locals=15
# Maximum number of return / yield for function / method body
max-returns=6
# Maximum number of branch for function / method body
max-branches=12
# Maximum number of statements in function / method body
max-statements=50
# Maximum number of parents for a class (see R0901).
max-parents=7
# Maximum number of attributes for a class (see R0902).
max-attributes=7
# Minimum number of public methods for a class (see R0903).
min-public-methods=2
# Maximum number of public methods for a class (see R0904).
max-public-methods=20
[CLASSES]
# List of method names used to declare (i.e. assign) instance attributes.
defining-attr-methods=__init__,__new__,setUp
# List of valid names for the first argument in a class method.
valid-classmethod-first-arg=cls
[EXCEPTIONS]
# Exceptions that will emit a warning when caught.
overgeneral-exceptions=builtins.BaseException,builtins.Exception

2
python3-k8sapp-openbao/k8sapp_openbao/requirements.txt Normal file
View File

@ -0,0 +1,2 @@
pbr>=2.0.0
PyYAML>=3.10.0

47
python3-k8sapp-openbao/k8sapp_openbao/setup.cfg Normal file
View File

@ -0,0 +1,47 @@
[metadata]
name = k8sapp-openbao
summary = StarlingX sysinv extensions for openbao
long_description = file: README.rst
long_description_content_type = text/x-rst
license = Apache 2.0
author = StarlingX
author-email = starlingx-discuss@lists.starlingx.io
home-page = https://www.starlingx.io/
classifier =
Environment :: OpenStack
Intended Audience :: Information Technology
Intended Audience :: System Administrators
License :: OSI Approved :: Apache Software License
Operating System :: POSIX :: Linux
Programming Language :: Python
Programming Language :: Python :: 2
Programming Language :: Python :: 2.7
Programming Language :: Python :: 3
Programming Language :: Python :: 3.4
Programming Language :: Python :: 3.5
[files]
packages =
k8sapp_openbao
[global]
setup-hooks =
pbr.hooks.setup_hook
[entry_points]
systemconfig.helm_applications =
openbao = systemconfig.helm_plugins.openbao
systemconfig.helm_plugins.openbao =
001_openbao = k8sapp_openbao.helm.openbao:OpenbaoHelm
002_openbao-manager = k8sapp_openbao.helm.openbao_manager:OpenbaoManagerHelm
systemconfig.fluxcd.kustomize_ops =
openbao = k8sapp_openbao.kustomize.kustomize_openbao:OpenbaoFluxCDKustomizeOperator
systemconfig.app_lifecycle =
openbao = k8sapp_openbao.lifecycle.lifecycle_openbao:OpenbaoAppLifecycleOperator
[bdist_wheel]
universal = 1

12
python3-k8sapp-openbao/k8sapp_openbao/setup.py Normal file
View File

@ -0,0 +1,12 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
import setuptools
setuptools.setup(
setup_requires=['pbr>=2.0.0'],
pbr=True)

20
python3-k8sapp-openbao/k8sapp_openbao/test-requirements.txt Normal file
View File

@ -0,0 +1,20 @@
# The order of packages is significant, because pip processes them in the order
# of appearance. Changing the order has an impact on the overall integration
# process, which may cause wedges in the gate later.
hacking>=1.1.0,<=2.0.0 # Apache-2.0
astroid
bandit<1.7.2;python_version>="3.0"
coverage>=3.6
fixtures>=3.0.0 # Apache-2.0/BSD
mock>=2.0.0 # BSD
python-subunit>=0.0.18
requests-mock>=0.6.0 # Apache-2.0
sphinx
oslosphinx
oslotest>=3.2.0 # Apache-2.0
stestr>=1.0.0 # Apache-2.0
testrepository>=0.0.18
testtools!=1.2.0,>=0.9.36
isort<5;python_version>="3.0"
pylint
pycryptodomex

188
python3-k8sapp-openbao/k8sapp_openbao/tox.ini Normal file
View File

@ -0,0 +1,188 @@
[tox]
envlist = flake8,py39,pylint,metadata
minversion = 1.6
skipsdist = True
# tox does not work if the path to the workdir is too long, so move it to /tmp
# tox 3.1.0 adds TOX_LIMITED_SHEBANG
toxworkdir = /tmp/{env:USER}_k8sopenbaotox
stxdir = {toxinidir}/../../..
distshare={toxworkdir}/.tox/distshare
[testenv]
basepython = python3.9
usedevelop = True
# tox is silly... these need to be separated by a newline....
allowlist_externals = bash
find
echo
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
# Note the hash seed is set to 0 until can be tested with a
# random hash seed successfully.
setenv = VIRTUAL_ENV={envdir}
PYTHONHASHSEED=0
PIP_RESOLVER_DEBUG=1
PYTHONDONTWRITEBYTECODE=1
OS_TEST_PATH=./k8sapp_openbao/tests
LANG=en_US.UTF-8
LANGUAGE=en_US:en
LC_ALL=C
EVENTS_YAML=./k8sapp_openbao/tests/events_for_testing.yaml
SYSINV_TEST_ENV=True
TOX_WORK_DIR={toxworkdir}
PYLINTHOME={toxworkdir}
deps = -r{toxinidir}/requirements.txt
-r{toxinidir}/test-requirements.txt
-e{[tox]stxdir}/config/sysinv/sysinv/sysinv
-e{[tox]stxdir}/config/tsconfig/tsconfig
-e{[tox]stxdir}/fault/fm-api/source
-e{[tox]stxdir}/fault/python-fmclient/fmclient
-e{[tox]stxdir}/update/sw-patch/cgcs-patch
-e{[tox]stxdir}/utilities/ceph/python-cephclient/python-cephclient
commands =
find . -type f -name "*.pyc" -delete
[flake8]
# H series are hacking
# H101 is TODO
# H102 is apache license
# H104 file contains only comments (ie: license)
# H105 author tags
# H306 imports not in alphabetical order
# H401 docstring should not start with a space
# H403 multi line docstrings should end on a new line
# H404 multi line docstring should start without a leading new line
# H405 multi line docstring summary not separated with an empty line
# H701 Empty localization string
# H702 Formatting operation should be outside of localization method call
# H703 Multiple positional placeholders
# B series are bugbear
# B006 Do not use mutable data structures for argument defaults. Needs to be FIXED.
# B007 Loop control variable not used within the loop body.
# B009 Do not call getattr with a constant attribute value
# B010 Do not call setattr with a constant attribute value
# B012 return/continue/break inside finally blocks cause exceptions to be silenced
# B014 Redundant exception types
# B301 Python 3 does not include `.iter*` methods on dictionaries. (this should be suppressed on a per line basis)
# W series are warnings
# W503 line break before binary operator
# W504 line break after binary operator
# W605 invalid escape sequence
# E series are pep8
# E117 over-indented
# E126 continuation line over-indented for hanging indent
# E127 continuation line over-indented for visual indent
# E128 continuation line under-indented for visual indent
# E402 module level import not at top of file
# E741 ambiguous variable name
ignore = H101,H102,H104,H105,H306,H401,H403,H404,H405,H701,H702,H703,
B006,B007,B009,B010,B012,B014,B301
W503,W504,W605,
E117,E126,E127,E128,E402,E741
exclude = build,dist,tools,.eggs
max-line-length=120
[testenv:flake8]
deps = -r{toxinidir}/test-requirements.txt
commands =
flake8 {posargs} ./k8sapp_openbao
[testenv:py39]
commands =
stestr run {posargs}
stestr slowest
[testenv:pep8]
# testenv:flake8 clone
deps = -r{toxinidir}/test-requirements.txt
commands = {[testenv:flake8]commands}
[testenv:venv]
commands = {posargs}
[bandit]
# The following bandit tests are being skipped:
# B101: Test for use of assert
# B103: Test for setting permissive file permissions
# B104: Test for binding to all interfaces
# B105: Test for use of hard-coded password strings
# B108: Test for insecure usage of tmp file/directory
# B110: Try, Except, Pass detected.
# B303: Use of insecure MD2, MD4, MD5, or SHA1 hash function.
# B307: Blacklisted call to eval.
# B310: Audit url open for permitted schemes
# B311: Standard pseudo-random generators are not suitable for security/cryptographic purposes
# B314: Blacklisted calls to xml.etree.ElementTree
# B318: Blacklisted calls to xml.dom.minidom
# B320: Blacklisted calls to lxml.etree
# B404: Import of subprocess module
# B405: import xml.etree
# B408: import xml.minidom
# B410: import lxml
# B506: Test for use of yaml load
# B602: Test for use of popen with shell equals true
# B603: Test for use of subprocess without shell equals true
# B604: Test for any function with shell equals true
# B605: Test for starting a process with a shell
# B607: Test for starting a process with a partial path
# B608: Possible SQL injection vector through string-based query
#
# Note: 'skips' entry cannot be split across multiple lines
#
skips = B101,B103,B104,B105,B108,B110,B303,B307,B310,B311,B314,B318,B320,B404,B405,B408,B410,B506,B602,B603,B604,B605,B607,B608
exclude = tests
[testenv:bandit]
deps = -r{toxinidir}/test-requirements.txt
commands = bandit --ini tox.ini -n 5 -r k8sapp_openbao
[testenv:pylint]
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
commands =
pylint {posargs} k8sapp_openbao --rcfile=./pylint.rc
[testenv:cover]
# not sure is passenv is still needed
passenv = CURL_CA_BUNDLE
deps = {[testenv]deps}
setenv = {[testenv]setenv}
PYTHON=coverage run --parallel-mode
commands =
{[testenv]commands}
coverage erase
stestr run {posargs}
coverage combine
coverage html -d cover
coverage xml -o cover/coverage.xml
coverage report
[testenv:pip-missing-reqs]
# do not install test-requirements as that will pollute the virtualenv for
# determining missing packages
# this also means that pip-missing-reqs must be installed separately, outside
# of the requirements.txt files
deps = pip_missing_reqs
-rrequirements.txt
commands=pip-missing-reqs -d --ignore-file=/k8sapp_openbao/tests k8sapp_openbao
[testenv:metadata]
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
# Pass top level app folder to 'sysinv-app tox' command.
commands =
bash -c "echo $(dirname $(dirname $(pwd))) | xargs -n 1 sysinv-app tox"

1
python3-k8sapp-openbao/k8sapp_openbao/upper-constraints.txt Normal file
View File

@ -0,0 +1 @@
# Override upstream constraints based on StarlingX load

1
requirements.txt Normal file
View File

@ -0,0 +1 @@
# Nothing

5
stx-openbao-helm/debian/deb_folder/changelog Normal file
View File

@ -0,0 +1,5 @@
stx-openbao-helm (1.0-1) unstable; urgency=medium
* Initial release.
-- Tae Park <tae.park@windriver.com> Thu, 10 Oct 2024 19:34:18 -0400

19
stx-openbao-helm/debian/deb_folder/control Normal file
View File

@ -0,0 +1,19 @@
Source: stx-openbao-helm
Section: libs
Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
openbao-helm,
openbao-manager-helm,
helm,
python3-k8sapp-openbao-wheels,
build-info
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io
Package: stx-openbao-helm
Section: libs
Architecture: any
Depends: ${misc:Depends}
Description: StarlingX Openbao FluxCD Helm Charts
This package contains FluxCD helm charts for the openbao application.

41
stx-openbao-helm/debian/deb_folder/copyright Normal file
View File

@ -0,0 +1,41 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: stx-openbao-helm
Source: https://opendev.org/starlingx/app-openbao/
Files: *
Copyright: (c) 2013-2021 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.
# If you want to use GPL v2 or later for the /debian/* files use
# the following clauses, or change it to suit. Delete these two lines
Files: debian/*
Copyright: 2021 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.

62
stx-openbao-helm/debian/deb_folder/rules Executable file
View File

@ -0,0 +1,62 @@
#!/usr/bin/make -f
# export DH_VERBOSE = 1
export ROOT = debian/tmp
export APP_FOLDER = $(ROOT)/usr/local/share/applications/helm
export DEB_VERSION = $(shell dpkg-parsechangelog | egrep '^Version:' | cut -f 2 -d ' ')
export RELEASE = $(shell cat /etc/build.info | grep SW_VERSION | cut -d'"' -f2)
export REVISION = $(shell echo $(DEB_VERSION) | cut -f 4 -d '.')
export APP_NAME = openbao
export APP_VERSION = $(RELEASE)-$(REVISION)
export APP_TARBALL = $(APP_NAME)-$(APP_VERSION).tgz
export HELM_REPO = stx-platform
export STAGING = staging
%:
dh $@
override_dh_auto_build:
# Setup the staging directory.
mkdir -p $(STAGING)
cp files/metadata.yaml $(STAGING)
cp -Rv fluxcd-manifests $(STAGING)/
mkdir -p $(STAGING)/charts
cp /usr/lib/helm/openbao*.tgz $(STAGING)/charts
# Adjust the helmrelease yamls based on the chart versions
for c in $(STAGING)/charts/*; do \
chart=$$(basename $$c .tgz); \
chart_name=$${chart%-*}; \
chart_version=$${chart##*-}; \
echo "Found $$chart; name: $$chart_name, version: $$chart_version"; \
chart_manifest=$$(find $(STAGING)/fluxcd-manifests/$$chart_name -name helmrelease.yaml -exec grep -q $$chart_name {} \; -print); \
echo "Updating manifest: $$chart_manifest"; \
sed -i "s/REPLACE_HELM_CHART_VERSION/$$chart_version/g" $$chart_manifest; \
grep version $$chart_manifest; \
done
# Populate metadata.
sed -i 's/APP_REPLACE_NAME/$(APP_NAME)/g' $(STAGING)/metadata.yaml
sed -i 's/APP_REPLACE_VERSION/$(APP_VERSION)/g' $(STAGING)/metadata.yaml
sed -i 's/HELM_REPLACE_REPO/$(HELM_REPO)/g' $(STAGING)/metadata.yaml
# Copy the plugins: installed in the buildroot
mkdir -p $(STAGING)/plugins
cp /plugins/*.whl $(STAGING)/plugins
# calculate checksum of all files in staging for the app
cd $(STAGING) && find . -type f ! -name '*.md5' -print0 | xargs -0 md5sum > checksum.md5
# package the app
tar -zcf $(APP_TARBALL) -C $(STAGING)/ .
# Cleanup staging
rm -rf $(STAGING)
override_dh_auto_install:
# Install the app tar file.
install -d -m 755 $(APP_FOLDER)
install -p -D -m 755 $(APP_TARBALL) $(APP_FOLDER)
override_dh_usrlocal:

1
stx-openbao-helm/debian/deb_folder/source/format Normal file
View File

@ -0,0 +1 @@
3.0 (quilt)

1
stx-openbao-helm/debian/deb_folder/stx-openbao-helm.install Normal file
View File

@ -0,0 +1 @@
usr/local/share/applications/helm/*

9
stx-openbao-helm/debian/meta_data.yaml Normal file
View File

@ -0,0 +1,9 @@
---
debname: stx-openbao-helm
debver: 1.0-1
src_path: stx-openbao-helm
revision:
dist: $STX_DIST
SRC_GITREVCOUNT:
SRC_DIR: ${MY_REPO}/stx/app-openbao
SRC_BASE_SRCREV: 0144b018a6a592860dace539e9fb937af7b2d26f

4
stx-openbao-helm/stx-openbao-helm/README Normal file
View File

@ -0,0 +1,4 @@
This directory contains all fluxCD manifest required in the configuration
of the Openbao application for StarlingX. This includes config for the
upstream Openbao helm chart, Openbao manager chart, and the python sysinv
integration for Openbao.

17
stx-openbao-helm/stx-openbao-helm/files/metadata.yaml Normal file
View File

@ -0,0 +1,17 @@
app_name: APP_REPLACE_NAME
app_version: APP_REPLACE_VERSION
helm_repo: HELM_REPLACE_REPO
maintain_user_overrides: true
upgrades:
auto_update: true
supported_k8s_version:
minimum: 1.24.4
behavior:
platform_managed_app: yes
evaluate_reapply:
after:
- platform-integ-apps

12
stx-openbao-helm/stx-openbao-helm/files/repositories.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: v1
generated: 2019-01-02T15:19:36.215111369-06:00
repositories:
- caFile: ""
cache: /builddir/.helm/repository/cache/local-index.yaml
certFile: ""
keyFile: ""
name: local
password: ""
url: http://127.0.0.1:8879/charts
username: ""

13
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/base/helmrepository.yaml Normal file
View File

@ -0,0 +1,13 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: stx-platform
spec:
url: http://192.168.206.1:8080/helm_charts/stx-platform
interval: 1m

8
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/base/kustomization.yaml Normal file
View File

@ -0,0 +1,8 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
resources:
- helmrepository.yaml

10
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/base/namespace.yaml Normal file
View File

@ -0,0 +1,10 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: v1
kind: Namespace
metadata:
name: openbao

13
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/kustomization.yaml Normal file
View File

@ -0,0 +1,13 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: openbao
resources:
- base
- openbao
- openbao-manager

36
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao-manager/helmrelease.yaml Normal file
View File

@ -0,0 +1,36 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: "helm.toolkit.fluxcd.io/v2"
kind: HelmRelease
metadata:
name: openbao-manager
labels:
chart_group: openbao
spec:
releaseName: stx-openbao-manager
chart:
spec:
chart: openbao-manager
version: REPLACE_HELM_CHART_VERSION
sourceRef:
kind: HelmRepository
name: stx-platform
interval: 1m
timeout: 30m
test:
enable: false
install:
disableHooks: false
upgrade:
disableHooks: false
valuesFrom:
- kind: Secret
name: openbao-manager-static-overrides
valuesKey: openbao-manager-static-overrides.yaml
- kind: Secret
name: openbao-manager-system-overrides
valuesKey: openbao-manager-system-overrides.yaml

18
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao-manager/kustomization.yaml Normal file
View File

@ -0,0 +1,18 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
namespace: openbao
resources:
- helmrelease.yaml
secretGenerator:
- name: openbao-manager-static-overrides
files:
- openbao-manager-static-overrides.yaml
- name: openbao-manager-system-overrides
files:
- openbao-manager-system-overrides.yaml
generatorOptions:
disableNameSuffixHash: true

24
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao-manager/openbao-manager-static-overrides.yaml Normal file
View File

@ -0,0 +1,24 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
manager:
image:
repository: starlingx/stx-vault-manager
tag: stx.10.0-v1.29.6-1
tolerations: |
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
unsealWaitIntervals: 0
imagePullSecrets:
- name: default-registry-key
livenessProbe:
initialDelaySeconds: 31
periodSeconds: 23
timeoutSeconds: 13

6
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao-manager/openbao-manager-system-overrides.yaml Normal file
View File

@ -0,0 +1,6 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#

36
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao/helmrelease.yaml Normal file
View File

@ -0,0 +1,36 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
apiVersion: "helm.toolkit.fluxcd.io/v2"
kind: HelmRelease
metadata:
name: openbao
labels:
chart_group: openbao
spec:
releaseName: stx-openbao
chart:
spec:
chart: openbao
version: REPLACE_HELM_CHART_VERSION
sourceRef:
kind: HelmRepository
name: stx-platform
interval: 1m
timeout: 30m
test:
enable: false
install:
disableHooks: false
upgrade:
disableHooks: false
valuesFrom:
- kind: Secret
name: openbao-static-overrides
valuesKey: openbao-static-overrides.yaml
- kind: Secret
name: openbao-system-overrides
valuesKey: openbao-system-overrides.yaml

18
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao/kustomization.yaml Normal file
View File

@ -0,0 +1,18 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
namespace: openbao
resources:
- helmrelease.yaml
secretGenerator:
- name: openbao-static-overrides
files:
- openbao-static-overrides.yaml
- name: openbao-system-overrides
files:
- openbao-system-overrides.yaml
generatorOptions:
disableNameSuffixHash: true

117
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao/openbao-static-overrides.yaml Normal file
View File

@ -0,0 +1,117 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
global:
enabled: true
tlsDisable: false
imagePullSecrets:
- name: default-registry-key
injector:
enabled: true
nodeSelector: |
node-role.kubernetes.io/control-plane: ""
affinity: null
strategy:
rollingUpdate:
maxUnavailable: 100%
image:
registry: docker.io
repository: hashicorp/vault-k8s
tag: 1.2.1
agentImage:
# Add yaml compatible with starlingx platform image pull, and
# service-parameter registry overrides. This will pull from
# private or public registry into registry.local. docker.io
# registry is assumed when omitted:
image:
registry: quay.io
repository: openbao/openbao
tag: 2.1.0
# Set the openbao yaml to refer to registry.local pulled as above
registry: registry.local:9001/quay.io
repository: openbao/openbao
tag: 2.1.0
tolerations: |
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
livenessProbe:
initialDelaySeconds: 11
periodSeconds: 11
timeoutSeconds: 7
server:
affinity: |
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/name: {{ template "openbao.name" . }}
app.kubernetes.io/instance: "{{ .Release.Name }}"
component: server
topologyKey: kubernetes.io/hostname
image:
registry: quay.io
repository: openbao/openbao
tag: 2.1.0
tolerations: |
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
auditStorage:
enabled: true
size: 10Gi
ha:
enabled: true
replicas: 3
raft:
enabled: true
config: |
ui = false
listener "tcp" {
tls_disable = 0
address = "[::]:8200"
cluster_address = "[::]:8201"
tls_cert_file = "/openbao/userconfig/openbao-server-tls/tls.crt"
tls_key_file = "/openbao/userconfig/openbao-server-tls/tls.key"
tls_client_ca_file = "/openbao/userconfig/openbao-server-tls/ca.crt"
}
storage "raft" {
path = "/openbao/data"
}
service_registration "kubernetes" {}
extraLabels:
app: openbao
extraEnvironmentVars:
VAULT_CACERT: /openbao/userconfig/openbao-server-tls/ca.crt
volumes:
- name: openbao-server-tls
secret:
secretName: openbao-server-tls
volumeMounts:
- name: openbao-server-tls
readOnly: true
mountPath: /openbao/userconfig/openbao-server-tls
readinessProbe:
initialDelaySeconds: 25
csi:
image:
registry: "docker.io"
repository: "hashicorp/vault-csi-provider"
tag: "1.4.0"
agent:
image:
registry: "quay.io"
repository: "openbao/openbao"
tag: "2.1.0"

6
stx-openbao-helm/stx-openbao-helm/fluxcd-manifests/openbao/openbao-system-overrides.yaml Normal file
View File

@ -0,0 +1,6 @@
#
# Copyright (c) 2024 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#

3
test-requirements.txt Normal file
View File

@ -0,0 +1,3 @@
# hacking pulls in flake8
hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
bashate >= 0.2

54
tox.ini Normal file
View File

@ -0,0 +1,54 @@
[tox]
envlist = linters
minversion = 2.9
skipsdist = True
sitepackages=False
[testenv]
basepython = python3
install_command = pip install -U \
{opts} {packages} \
-c{env:TOX_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt}
setenv =
VIRTUAL_ENV={envdir}
OS_STDOUT_CAPTURE=1
OS_STDERR_CAPTURE=1
OS_DEBUG=1
OS_LOG_CAPTURE=1
deps =
-r{toxinidir}/requirements.txt
-r{toxinidir}/test-requirements.txt
allowlist_externals =
bash
[testenv:flake8]
basepython = python3
description = Dummy environment to allow flake8 to be run in subdir tox
[testenv:pylint]
basepython = python3
description = Dummy environment to allow pylint to be run in subdir tox
[testenv:metadata]
basepython = python3
description = Dummy environment to allow sysinv-app to be run in subdir tox
[testenv:bandit]
basepython = python3
description = Dummy environment to allow bandit to be run in subdir tox
[testenv:bashate]
# Treat all E* codes as Errors rather than warnings using: -e 'E*'
commands =
bash -c "find {toxinidir} \
-not \( -type d -name .?\* -prune \) \
-type f \
-not -name \*~ \
-not -name \*.md \
-name \*.sh \
-print0 | xargs -r -n 1 -0 bashate -v \
-e 'E*'"
[testenv:linters]
commands =
{[testenv:bashate]commands}