-
Notifications
You must be signed in to change notification settings - Fork 241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Introduced new soa key for rotating database passwords #3655
Introduced new soa key for rotating database passwords #3655
Conversation
- database_credentials is a top level key. The next key will be a datastore. This could be MySQL or Cassandra or anything else. Each data store (dstore) contains a name, eg {mysql: ['cred1', 'cred2']}. These credentials point to a vault path under /dstore/mysql/{cred1,cred2} These passwords are then mapped to the paasta service as a volume, where each file corresponds to a Vault entry
- Used a context manager for temporarily setting vault credentials - Several python magic upgrades - Added sample return types for data - Changed default parameters to required for dstore/creds - Few refactors
I ran a fresh make setup-kubernetes-job with the vault credentials set in etc_paasta_playground.vault.json under database_credentials_vault_env_overrides (just vault_addr_override and vault_token_override) and confirmed that the env worked as expected |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i still have to formulate some thoughts/suggestions re: tests - but for now i've left some other comments so that you're not blocked waiting for me to review
- Changed database and dstore -> datastore for clarity
- set_env always resets the environ later, so it should instead be renamed to reflect this
- Although we didn't specify cassandra here (since we don't know yet), we add additional_properties = True to suffice
- Having one volume with keys + paths as items from SecretSource allows us to get the same effect - Refactored time.sleep in tests and secrets_sync - Fixed test cases to match
Co-authored-by: Luis Pérez <[email protected]>
- Shortened volume name for datastores
…ased-mysql-password-rotation
- Corrected 'help' for --secret-type call
https://fluffy.yelpcorp.com/i/67hDPrWrG31CtcZRZf0RB17HqJg8XqXZ.html
Pasting in fluffy for security reasons
(updated Aug 9, 2023 @ 1:46pm)