Support for externally referenced S3 credentials and quoted plain values

[Heiko-san]

Hi,

we created an additional datastore of type etcd using your helm chart clastix/kamaji-etcd.
We successfully set up it with an s3 backup. However in our values.yaml we had to define our password like this (not the real pwd):

  s3:
    #...
    bucket: kamaji/kamaji-etcd-2/
    accessKey: kamaji
    secretKey: "'xY%foo$ba)R'"

This is necessary so that the single quotes get added to the mc command, otherwise shell would try to interpret the password.
Maybe in the containers command, the password should be quoted by default.

We use kamaji v0.3.3 together with cluster-api v1.5.0 with infrastructure-vsphere v1.7.0 and your kamaji plugin control-plane-kamaji v0.3.0.

[prometherion]

Thanks for the report, @Heiko-san!

I guess we're just missing the | quote helper when interpolating the variable.

I'll raise a PR, it would be great if you could give it a try.

[Heiko-san]

The change doesn't fix the problem entirely.
The password now gets quoted, but with double quotes, so a $ in the password for example still gets interpreted by the shell.
It has to use single quotes. (which may actually break aswell if you have ' in your passwort, which may be an acceptable edge case, but to be clean, it would need something like | shellescape I guess)

spec:
  containers:
  - command:
    - bash
    - -c
    - |-
      cd /opt/etcd-dump
      if $MC alias set myminio https://s3.url kamaji "Pa$$w0rd" \
      && $MC ping myminio -c 3 -e 3 ; then
        echo -e "\nUploading snapshot(s):"
        $MC cp kamaji-etcd-5_*.db myminio/kamaji/kamaji-etcd-5/
      else
        echo -e "\nERROR: S3 storage could not be configured;\nCheck your S3 URL/Credentials or network connectivity"
        exit 1
      fi
    env:

[Heiko-san]

or maybe provide the password with an env variable would help?

You also could use a secret then.

[ptx96]

or maybe provide the password with an env variable would help?

Hi @Heiko-san

Going to open an Issue to use a previously created secret;
IMHO, is the right way to do this :)

[Heiko-san]

i think so too, it also isn't time critical, since we found a workaround and are still in proof of concept phase

[prometherion]

The attached PR is addressing both use cases, such as:

• plain values, quoted
• Secret reference

[Heiko-san]

Both approaches (secret ref & quoted value) work great in our setup!
Thanks :)