Store password in secret

apis/mariadb/v1/mariadbprovider_types.go

@@ -22,21 +22,27 @@ import (
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
+type SecretKeyRef struct {
+	Name string `json:"name"`
+	Key  string `json:"key"`
+}
+
 // MariaDBProviderSpec defines the desired state of MariaDBProvider
 type MariaDBProviderSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// These are the spec options for providers
-	Environment          string   `json:"environment,omitempty"`
-	Hostname             string   `json:"hostname,omitempty"`
-	ReadReplicaHostnames []string `json:"readReplicaHostnames,omitempty"`
-	Password             string   `json:"password,omitempty"`
-	Port                 string   `json:"port,omitempty"`
-	Username             string   `json:"user,omitempty"`
-	Type                 string   `json:"type,omitempty"`
-	Name                 string   `json:"name,omitempty"`
-	Namespace            string   `json:"namespace,omitempty"`
+	Environment          string        `json:"environment,omitempty"`
+	Hostname             string        `json:"hostname,omitempty"`
+	ReadReplicaHostnames []string      `json:"readReplicaHostnames,omitempty"`
+	Password             string        `json:"password,omitempty"`
+	PasswordSecretRef    *SecretKeyRef `json:"passwordSecretRef,omitempty"`
+	Port                 string        `json:"port,omitempty"`
+	Username             string        `json:"user,omitempty"`
+	Type                 string        `json:"type,omitempty"`
+	Name                 string        `json:"name,omitempty"`
+	Namespace            string        `json:"namespace,omitempty"`
 }
 
 // MariaDBProviderStatus defines the observed state of MariaDBProvider

apis/mongodb/v1/mongodbprovider_types.go

@@ -22,19 +22,25 @@ import (
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
+type SecretKeyRef struct {
+	Name string `json:"name"`
+	Key  string `json:"key"`
+}
+
 // MongoDBProviderSpec defines the desired state of MongoDBProvider
 type MongoDBProviderSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// These are the spec options for providers
-	Environment string      `json:"environment,omitempty"`
-	Hostname    string      `json:"hostname,omitempty"`
-	Password    string      `json:"password,omitempty"`
-	Port        string      `json:"port,omitempty"`
-	Username    string      `json:"user,omitempty"`
-	Auth        MongoDBAuth `json:"auth,omitempty"`
-	Type        string      `json:"type,omitempty"`
+	Environment       string        `json:"environment,omitempty"`
+	Hostname          string        `json:"hostname,omitempty"`
+	Password          string        `json:"password,omitempty"`
+	PasswordSecretRef *SecretKeyRef `json:"passwordSecretRef,omitempty"`
+	Port              string        `json:"port,omitempty"`
+	Username          string        `json:"user,omitempty"`
+	Auth              MongoDBAuth   `json:"auth,omitempty"`
+	Type              string        `json:"type,omitempty"`
 }
 
 // MongoDBAuth defines the authorisation mechanisms that mongo can use

apis/postgres/v1/postgresqlprovider_types.go

@@ -22,20 +22,27 @@ import (
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
+// SecretKeyRef references a specific key inside a Kubernetes Secret
+type SecretKeyRef struct {
+	Name string `json:"name"`
+	Key  string `json:"key"`
+}
+
 // PostgreSQLProviderSpec defines the desired state of PostgreSQLProvider
 type PostgreSQLProviderSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// These are the spec options for providers
-	Environment string `json:"environment,omitempty"`
-	Hostname    string `json:"hostname,omitempty"`
-	Password    string `json:"password,omitempty"`
-	Port        string `json:"port,omitempty"`
-	Username    string `json:"user,omitempty"`
-	Name        string `json:"name,omitempty"`
-	Namespace   string `json:"namespace,omitempty"`
-	Type        string `json:"type,omitempty"`
+	Environment       string        `json:"environment,omitempty"`
+	Hostname          string        `json:"hostname,omitempty"`
+	Password          string        `json:"password,omitempty"`
+	PasswordSecretRef *SecretKeyRef `json:"passwordSecretRef,omitempty"`
+	Port              string        `json:"port,omitempty"`
+	Username          string        `json:"user,omitempty"`
+	Name              string        `json:"name,omitempty"`
+	Namespace         string        `json:"namespace,omitempty"`
+	Type              string        `json:"type,omitempty"`
 }
 
 // PostgreSQLProviderStatus defines the observed state of PostgreSQLProvider

charts/dbaas-operator/templates/clusterrole.yaml

@@ -15,6 +15,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - mariadb.amazee.io
   resources:

charts/dbaas-operator/templates/role.yaml

@@ -31,4 +31,12 @@ rules:
   resources:
   - events
   verbs:
-  - create
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch

charts/mariadbprovider/templates/mariadbprovider.yaml

@@ -9,7 +9,12 @@ spec:
   hostname:  {{ $providerConfig.hostname | quote }}
   readReplicaHostnames:
     {{- toYaml $providerConfig.readReplicaHostnames | nindent 4 }}
+  passwordSecretRef:
+    name: {{ $providerConfig.passwordSecretRef.name | quote }}
+    key: {{ $providerConfig.passwordSecretRef.key | quote }}
+  {{- else if $providerConfig.password }}  
   password: {{ $providerConfig.password | quote }}
+  {{- end }}
   port: {{ $providerConfig.port | quote }}
   user: {{ $providerConfig.user | quote }}
   type: {{ $providerConfig.type | quote | default "generic" }}

charts/mongodbprovider/templates/mongodbprovider.yaml

@@ -7,7 +7,12 @@ metadata:
 spec:
   environment: {{ $providerConfig.environment | quote }}
   hostname:  {{ $providerConfig.hostname | quote }}
+  passwordSecretRef:
+    name: {{ $providerConfig.passwordSecretRef.name | quote }}
+    key: {{ $providerConfig.passwordSecretRef.key | quote }}
+  {{- else if $providerConfig.password }}
   password: {{ $providerConfig.password | quote }}
+  {{- end }}
   port: {{ $providerConfig.port | quote }}
   user: {{ $providerConfig.user | quote }}
   type: {{ $providerConfig.type | quote | default "generic" }}

charts/postgresqlprovider/templates/postgresqlprovider.yaml

@@ -7,7 +7,12 @@ metadata:
 spec:
   environment: {{ $providerConfig.environment | quote }}
   hostname:  {{ $providerConfig.hostname | quote }}
+  passwordSecretRef:
+    name: {{ $providerConfig.passwordSecretRef.name | quote }}
+    key: {{ $providerConfig.passwordSecretRef.key | quote }}
+  {{- else if $providerConfig.password }}
   password: {{ $providerConfig.password | quote }}
+  {{- end }}
   port: {{ $providerConfig.port | quote }}
   user: {{ $providerConfig.user | quote }}
   type: {{ $providerConfig.type | quote | default "generic" }}

config/crd/bases/mariadb.amazee.io_mariadbconsumers.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -87,9 +86,3 @@ spec:
         type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/mariadb.amazee.io_mariadbproviders.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -47,6 +46,16 @@ spec:
                 type: string
               password:
                 type: string
+              passwordSecretRef:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    type: string
+                required:
+                - key
+                - name
+                type: object
               port:
                 type: string
               readReplicaHostnames:
@@ -64,9 +73,3 @@ spec:
         type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/mongodb.amazee.io_mongodbconsumers.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -103,9 +102,3 @@ spec:
         type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/mongodb.amazee.io_mongodbproviders.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -56,6 +55,16 @@ spec:
                 type: string
               password:
                 type: string
+              passwordSecretRef:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    type: string
+                required:
+                - key
+                - name
+                type: object
               port:
                 type: string
               type:
@@ -69,9 +78,3 @@ spec:
         type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/postgres.amazee.io_postgresqlconsumers.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -80,9 +79,3 @@ spec:
         type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []