Skip to content

Commit e43d685

Browse files
jhoblittjhoblitt
committed
(rancher.*) convert onepassword-connect install to be credentials only
Fleet will install / upgrade the onepassword-connect chart going forward. As the credentials are being installed "manually", they will not be owned by the currently installed chart release and will not be uninstalled when the chart release is upgraded by fleet.
1 parent 39f9afc commit e43d685

File tree

10 files changed

+63
-15
lines changed

10 files changed

+63
-15
lines changed

‎rancher.cp/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.cp/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.cp.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.cp.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.dev/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.dev/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.dev.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.dev.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.ls/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.ls/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.ls.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.ls.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎rancher.tu/onepassword/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
1password-credentials.json
2+
secret-op-credentials.yaml

‎rancher.tu/onepassword/fetch-credentials.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,17 @@ set -e
55
if ! env | grep OP_SESSION_ > /dev/null 2>&1; then
66
eval "$(op signin)"
77
fi
8-
op read "op://1pass connect/connect.tu.lsst.org Credentials File/1password-credentials.json" --out-file 1password-credentials.json
8+
ONEPASS_CREDS="$(op read "op://1pass connect/connect.tu.lsst.org Credentials File/1password-credentials.json")"
9+
10+
cat > secret-op-credentials.yaml <<END
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: op-credentials
16+
namespace: onepassword-connect
17+
type: Opaque
18+
# The credentials end up being double base64 encoded...
19+
stringData:
20+
1password-credentials.json: $(echo "${ONEPASS_CREDS}" | base64 -w 0)
21+
END

‎template/onepassword/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ Deployment
66

77
Run the `fetch-credentials.sh` script to download the 1pass access token. Note the `op` CLI must be installed and configured.
88

9-
Once the `1password-credentials.json` file is present, run the `onepassword-connect.sh` script.
9+
Once the `secret-op-credentials.yaml` file is present, run the `onepassword-connect.sh` script.

‎template/onepassword/onepassword-connect.sh‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,5 @@
22

33
set -ex
44

5-
helm repo add onepassword-connect https://1password.github.io/connect-helm-charts
6-
helm repo update
7-
8-
helm upgrade --install \
9-
onepassword-connect onepassword-connect/connect \
10-
--create-namespace --namespace onepassword-connect \
11-
--version v1.14.0 \
12-
--atomic \
13-
--set-file connect.credentials=1password-credentials.json \
14-
-f ./values.yaml
5+
kubectl create namespace onepassword-connect --dry-run=client -o yaml | kubectl apply --server-side -f -
6+
kubectl apply --server-side -f secret-op-credentials.yaml

0 commit comments

Comments
 (0)