Skip to content

Commit

Permalink
feat: support secret encryption key (#746)
Browse files Browse the repository at this point in the history 
* feat: support setting private key for secret store

Signed-off-by: arkbriar <arkbriar@gmail.com>

* Add unit tests for the validation webhook

Signed-off-by: arkbriar <arkbriar@gmail.com>

* Refine the behaviours

Signed-off-by: arkbriar <arkbriar@gmail.com>

* Add license header

Signed-off-by: arkbriar <arkbriar@gmail.com>

---------

Signed-off-by: arkbriar <arkbriar@gmail.com>
  • Loading branch information
@arkbriar
arkbriar authored Oct 30, 2024
1 parent 96bf158 commit e747ca0
Show file tree
Hide file tree
Showing 19 changed files with 772 additions and 33 deletions.
45 changes: 45 additions & 0 deletions apis/risingwave/v1alpha1/risingwave_secret_store.go
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
// Copyright 2024 RisingWave Labs
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package v1alpha1

// RisingWaveSecretStorePrivateKeySecretReference is a reference to a secret that contains a private key.
type RisingWaveSecretStorePrivateKeySecretReference struct {
// Name is the name of the secret.
Name string `json:"name"`

// Key is the key in the secret that contains the private key.
Key string `json:"key"`
}

// RisingWaveSecretStorePrivateKey is a private key that can be stored in a secret or directly in the resource.
type RisingWaveSecretStorePrivateKey struct {
// Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
// When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
// generated randomly.
// +kubebuilder:validation:Pattern="^[0-9a-f]{32}$"
// +optional
Value *string `json:"value,omitempty"`

// SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
// Note that the value in the secret must be a 128-bit key encoded in hex.
// +optional
SecretRef *RisingWaveSecretStorePrivateKeySecretReference `json:"secretRef,omitempty"`
}

// RisingWaveSecretStore is the configuration of the secret store.
type RisingWaveSecretStore struct {
// PrivateKey is the private key used to encrypt and decrypt the secrets.
PrivateKey RisingWaveSecretStorePrivateKey `json:"privateKey,omitempty"`
}
3 changes: 3 additions & 0 deletions apis/risingwave/v1alpha1/risingwave_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,9 @@ type RisingWaveSpec struct {

// LicenseKey to enable paid features of RisingWave.
LicenseKey *RisingWaveLicenseKey `json:"licenseKey,omitempty"`

// SecretStore is the configuration of the secret store.
SecretStore RisingWaveSecretStore `json:"secretStore,omitempty"`
}

// ComponentGroupReplicasStatus are the running status of Pods in group.
Expand Down
57 changes: 57 additions & 0 deletions apis/risingwave/v1alpha1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions config/crd/bases/risingwave.risingwavelabs.com_risingwaves.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30510,6 +30510,38 @@ spec:
- path
type: object
type: object
secretStore:
description: SecretStore is the configuration of the secret store.
properties:
privateKey:
description: PrivateKey is the private key used to encrypt and
decrypt the secrets.
properties:
secretRef:
description: |-
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
Note that the value in the secret must be a 128-bit key encoded in hex.
properties:
key:
description: Key is the key in the secret that contains
the private key.
type: string
name:
description: Name is the name of the secret.
type: string
required:
- key
- name
type: object
value:
description: |-
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
generated randomly.
pattern: ^[0-9a-f]{32}$
type: string
type: object
type: object
standaloneMode:
default: 0
description: |-
Expand Down
32 changes: 32 additions & 0 deletions config/risingwave-operator-test.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30527,6 +30527,38 @@ spec:
- path
type: object
type: object
secretStore:
description: SecretStore is the configuration of the secret store.
properties:
privateKey:
description: PrivateKey is the private key used to encrypt and
decrypt the secrets.
properties:
secretRef:
description: |-
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
Note that the value in the secret must be a 128-bit key encoded in hex.
properties:
key:
description: Key is the key in the secret that contains
the private key.
type: string
name:
description: Name is the name of the secret.
type: string
required:
- key
- name
type: object
value:
description: |-
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
generated randomly.
pattern: ^[0-9a-f]{32}$
type: string
type: object
type: object
standaloneMode:
default: 0
description: |-
Expand Down
32 changes: 32 additions & 0 deletions config/risingwave-operator.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30527,6 +30527,38 @@ spec:
- path
type: object
type: object
secretStore:
description: SecretStore is the configuration of the secret store.
properties:
privateKey:
description: PrivateKey is the private key used to encrypt and
decrypt the secrets.
properties:
secretRef:
description: |-
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
Note that the value in the secret must be a 128-bit key encoded in hex.
properties:
key:
description: Key is the key in the secret that contains
the private key.
type: string
name:
description: Name is the name of the secret.
type: string
required:
- key
- name
type: object
value:
description: |-
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
generated randomly.
pattern: ^[0-9a-f]{32}$
type: string
type: object
type: object
standaloneMode:
default: 0
description: |-
Expand Down
Loading

0 comments on commit e747ca0

Please sign in to comment.