feat(keyless): add keyless config to deployment template

[jiparis]

This PR adds the secrets and configuration to support keyless signing in the K8s deployment.

Before and after applying keyless configuration in values.yaml

--- before.yaml	2024-06-04 19:01:52
+++ after.yaml	2024-06-04 19:02:02
@@ -129,6 +129,12 @@
   # We store it also as a different key so it can be reused during upgrades by the common.secrets.passwords.manage helper
   generated_jws_hmac_secret: "REDACTED"
 stringData:
+  fileca.secret.yaml: |
+    certificate_authority:
+      file_ca:
+        cert_path: "/ca_secrets/file_ca.cert"
+        key_path:  "/ca_secrets/file_ca.key"
+        key_pass: "REDACTED"
   config.secret.yaml: |
     data:
       database:
@@ -156,6 +162,24 @@
       # Private key used to sign the JWTs meant to be consumed by the CAS
       cas_robot_account_private_key_path: "/secrets/cas.private.key"
 ---
+# Source: chainloop/templates/controlplane/file_ca.secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-chainloop-controlplane-keyless-file-ca
+  labels:
+    app.kubernetes.io/name: chainloop
+    helm.sh/chart: chainloop-1.54.1
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/version: "v0.90.1"
+    app.kubernetes.io/part-of: chainloop
+    app.kubernetes.io/component: controlplane
+type: Opaque
+data:
+  file_ca.cert: "REDACTED"
+  file_ca.key: "REDACTED"
+---
 # Source: chainloop/templates/controlplane/jwt_cas_private_key.secret.yaml
 apiVersion: v1
 kind: Secret
@@ -776,7 +800,7 @@
     metadata:
       annotations:
         checksum/config: 8efedc33a9689b3bc5e07902d1acbe52f02dbe48b9a3c0186d3b281b82ce53db
-        checksum/secret-config: 20313929688b2c1fccc0283e6104a90e9f222f9494fc0cffb4b5b1449deaf23c
+        checksum/secret-config: ab779eb86eecaced7d6350510fdf93b2a88a7242d307f5a517c9d39a6e2e17eb
         checksum/cas-private-key: 83da145aeffe6a714534836f62e2eb177f6dfbfb7fbf257c3548fff320950073
         kubectl.kubernetes.io/default-container: controlplane
       labels:
@@ -838,6 +862,8 @@
               mountPath: /tmp
             - name: jwt-cas-private-key
               mountPath: /secrets
+            - name: file-ca-cert
+              mountPath: /ca_secrets
       volumes:
         - name: config
           projected:
@@ -852,6 +878,9 @@
         - name: jwt-cas-private-key
           secret:
             secretName: test-chainloop-controlplane-jwt-cas
+        - name: file-ca-cert
+          secret:
+            secretName: test-chainloop-controlplane-keyless-file-ca
 ---
 # Source: chainloop/charts/postgresql/templates/primary/statefulset.yaml
 apiVersion: apps/v1

Refs #865

[migmartri]

thanks!

It would be great if you could show a diff of doing a helm template before and after the change.

[migmartri]

At first, it looks good to me!

We are missing though a section in the readme documenting this feature. Like Enable Keyless signing using local file CA or smth like that. You can see in the readme examples of excerps of snippets about enabling different features.

Please do not merge until we double check that there is no render problem.

Another thing you need to do is to bump the chart version (patch version)

chainloop/deployment/chainloop/Chart.yaml

Lines 6 to 7 in 65be1d6

	# Bump the patch (not minor, not major) version on each change in the Chart Source code
	version: 1.52.0

[jiparis]

At first, it looks good to me!

We are missing though a section in the readme documenting this feature. Like Enable Keyless signing using local file CA or smth like that. You can see in the readme examples of excerps of snippets about enabling different features.

Please do not merge until we double check that there is no render problem.

Another thing you need to do is to bump the chart version (patch version)

chainloop/deployment/chainloop/Chart.yaml

Lines 6 to 7 in 65be1d6

	# Bump the patch (not minor, not major) version on each change in the Chart Source code
	version: 1.52.0

Sure, let me ammend some changes.

[migmartri]

Thanks

[migmartri]

s/still/yet

[jiparis]

😞 those false friends ...