Auto-replace 'secret' fields with generate-secrets script

Author: pvannierop

bin/generate-secrets

@@ -33,54 +33,39 @@ fi
 
 insert_secret() {
   localSecret="${secret:-$(generate_secret)}"
+  # For any group of yaml paths passed add the same (!) password.
   for key in "$@"; do
     localSecret="$localSecret" yq -i "$key = strenv(localSecret)" etc/secrets.yaml
   done
+  # Do not remove this 'secret=' line! It ensures that subsequent replacements get a unique password.
+  secret=
 }
 
-insert_secret ".mongodb.auth.replicaSetKey"
-insert_secret ".mongodb.auth.rootPassword"
-insert_secret ".mongodb.auth.passwords[0]"
+# -- Groups of shared passwords
 
-insert_secret ".graylog.graylog.rootPassword"
-insert_secret ".kube_prometheus_stack.kube-prometheus-stack.grafana.adminPassword"
-
-nginx_auth_password=$(generate_secret)
-secret="thehyve:$(echo $nginx_auth_password | openssl passwd -apr1 -stdin)" insert_secret ".kube_prometheus_stack.nginx_auth"
-comment="username: thehyve, password: $nginx_auth_password" yq -i ".kube_prometheus_stack.nginx_auth line_comment |= strenv(comment)" etc/secrets.yaml
-
-insert_secret ".kafka_manager.basicAuth.password"
-
-# Shared postgresql secret
+# Management portal postgres database
 insert_secret \
   ".postgresql.global.postgresql.auth.postgresPassword" \
   ".postgresql.auth.replicationPassword" \
   ".management_portal.postgres.password" \
   ".app_config.jdbc.password" \
   ".radar_rest_sources_backend.postgres.password"
 
-insert_secret ".management_portal.managementportal.common_admin_password"
-insert_secret ".management_portal.managementportal.frontend_client_secret"
-insert_secret ".management_portal.oauth_clients.radar_upload_backend.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_upload_connect.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_rest_sources_auth_backend.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_redcap_integrator.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_fitbit_connector.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_appconfig.client_secret"
-insert_secret ".management_portal.oauth_clients.radar_push_endpoint.client_secret"
-
+# Appserver postgres database
 insert_secret \
   ".radar_appserver_postgresql.global.postgresql.auth.postgresPassword" \
   ".radar_appserver_postgresql.auth.replicationPassword" \
   ".radar_appserver.postgres.password"
 
-insert_secret ".timescaledb_password"
-insert_secret ".grafana_password"
-insert_secret ".grafana_metrics_password"
-
-insert_secret ".s3_access_key"
-insert_secret ".s3_secret_key"
+# --
 
-insert_secret ".radar_upload_postgres_password"
+# The NGINX password for prometheus follows a pattern different from others.
+nginx_auth_password=$(generate_secret)
+secret="thehyve:$(echo $nginx_auth_password | openssl passwd -apr1 -stdin)" insert_secret ".kube_prometheus_stack.nginx_auth"
+comment="username: thehyve, password: $nginx_auth_password" yq -i ".kube_prometheus_stack.nginx_auth line_comment |= strenv(comment)" etc/secrets.yaml
 
-echo "Passwords and secrets have been generated successfully."
+# Generate secrets for all remaining fields with value 'secret'.
+replacements=$(yq e '.. | select(. == "secret") | [(path | "."+join("."))] | join(" ")' etc/secrets.yaml);
+for key in $replacements; do
+  insert_secret $key
+done

etc/base-secrets.yaml

@@ -1,6 +1,6 @@
 # NOTE:
-# - properties equal to 'secret' will be replaced by the bin/generate-secrets script
-# - properties equal to 'change_me' should be replaced manually (externally provided secrets)
+# - properties equal to 'secret' will be replaced by the bin/generate-secrets script.
+# - properties equal to 'change_me' are externally provided secrets that should be replaced manually.
 
 # --------------------------------------------------------- 00-init.yaml ---------------------------------------------------------
 mongodb:
@@ -47,12 +47,12 @@ kafka_manager:
 # --------------------------------------------------------- 10-base.yaml ---------------------------------------------------------
 confluent_cloud:
   cc:
-    bootstrapServerurl: confluentBootstrapServers
-    schemaRegistryUrl: confluentSchemaRegistryUrl
-    apiKey: ccApikey
-    apiSecret: ccApiSecret
-    schemaRegistryApiKey: srApiKey
-    schemaRegistryApiSecret: srApiSecret
+    bootstrapServerurl: change_me
+    schemaRegistryUrl: change_me
+    apiKey: change_me
+    apiSecret: change_me
+    schemaRegistryApiKey: change_me
+    schemaRegistryApiSecret: change_me
 
 # --------------------------------------------------------- 10-managementportal.yaml ---------------------------------------------------------
 postgresql:
@@ -146,8 +146,8 @@ radar_integration:
 # --------------------------------------------------------- 20-s3-connector.yaml ---------------------------------------------------------
 # The access keys and secret keys of object storage services should match.
 # If AWS S3 is used as a storage medium instead of minio, then fill in those.
-s3_access_key: secret
-s3_secret_key: secret
+s3_access_key: change_me
+s3_secret_key: change_me
 
 # --------------------------------------------------------- 20-upload.yaml ---------------------------------------------------------
 radar_upload_postgres_password: secret
@@ -172,4 +172,4 @@ velero:
         cloud: |
           [default]
           aws_access_key_id=change_me
-          aws_secret_access_key=change_me
+          aws_secret_access_key=change_me