Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generate 'stanley' private SSH key if no one provided in Helm values #62

Closed
wants to merge 5 commits into from

Conversation

arm4b
Copy link
Member

@arm4b arm4b commented Apr 9, 2019

Closes #16

armab added 2 commits April 9, 2019 13:22
@arm4b arm4b added the WIP label Apr 9, 2019
@arm4b
Copy link
Member Author

arm4b commented Apr 10, 2019

After several tries and deeper research, it turns out Helm doesn't provide enough instrumentation to work with autogenerated values and their state.

  1. It's possible to autogenerate SSH private key secret, but it will be generated every time on Helm upgrade which is undesired
  2. It's possible to workaround SSH private key generation only once on install and mark it as unmanaged by Helm (so it's not deleted on upgrade), but it's not possible to transition to user-provided SSH key in helm values after that
  3. It's possible to set SSH private key in values.yaml, but it's not possible to transition to autogenerated if user removed predefined one from Helm values

I've seen other official Helm chart repositories and what they do: allow or autogenerated or predefined secrets without proper transition, meaning user had autogenerated secret on first install (default), they can't change it to custom one having no chance to rotate the secrets afterwards.

With that missing functionality with autogenerated < > predefined value transition I'll keep our Helm values as is until better solution introduced in Helm itself.

There are a lot of discussions around this issue in Helm community and even a WIP PR in links below:

@arm4b arm4b added wontfix This will not be worked on and removed WIP labels Apr 10, 2019
@arm4b
Copy link
Member Author

arm4b commented May 18, 2020

Per helm/helm#3053 (comment) looks like Helm3 has a solution related to this issue via new lookup feature.
We'll need to review this.

@arm4b arm4b removed the wontfix This will not be worked on label May 18, 2020
@cognifloyd
Copy link
Member

#203 includes generating the stanley_rsa ssh key by default. So, if that gets merged then this can probably be closed.

@arm4b arm4b closed this in #203 Jul 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Autogenerate secrets if no Helm value provided, remove insecure defaults
2 participants