Skip to content

Commit 9500d0b

Browse files
jhoblittjhoblitt
authored
Merge pull request #487 from lsst-it/IT-5445/fix-onepassword-connect-creds
(rancher.*) convert onepassword-connect install to be credentials only
2 parents 39f9afc + e43d685 commit 9500d0b

File tree

10 files changed

+63
-15
lines changed

10 files changed

+63
-15
lines changed

‎rancher.cp/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.cp/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.cp.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.cp.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.dev/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.dev/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.dev.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.dev.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.ls/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.ls/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.ls.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.ls.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.tu/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.tu/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.tu.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.tu.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎template/onepassword/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ Deployment
66

77
Run the `fetch-credentials.sh` script to download the 1pass access token. Note the `op` CLI must be installed and configured.
88

9-
Once the `1password-credentials.json` file is present, run the `onepassword-connect.sh` script.
9+
Once the `secret-op-credentials.yaml` file is present, run the `onepassword-connect.sh` script.

‎template/onepassword/onepassword-connect.sh‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,5 @@
22

33
set -ex
44

5-
helm repo add onepassword-connect https://1password.github.io/connect-helm-charts
6-
helm repo update
7-
8-
helm upgrade --install \
9-
onepassword-connect onepassword-connect/connect \
10-
--create-namespace --namespace onepassword-connect \
11-
--version v1.14.0 \
12-
--atomic \
13-
--set-file connect.credentials=1password-credentials.json \
14-
-f ./values.yaml
5+
kubectl create namespace onepassword-connect --dry-run=client -o yaml | kubectl apply --server-side -f -
6+
kubectl apply --server-side -f secret-op-credentials.yaml

0 commit comments

Comments
 (0)