-
Notifications
You must be signed in to change notification settings - Fork 68
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: break to 2 apis - decrypt and encrypt (#31)
* refactor: break to 2 apis - decrypt and encrypt * fix dockerfile + black box tests * initial commit - adding chart * fix the chart * add kamus cli * some fixes * enforce HTTPs urls * use caporal logger * fix encrypt.js * fix missing http * added cert pinning * fix CR comments
- Loading branch information
Showing
65 changed files
with
2,299 additions
and
128 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,6 @@ | ||
| bin\ | ||
| obj\ | ||
| obj\ | ||
| cmd/ | ||
| **/bin/* | ||
| **/obj/* | ||
| **/vendor |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,4 +39,5 @@ job/ | |
|
|
||
| **/report.json | ||
| **/report.json | ||
| node_modules/ | ||
| node_modules/ | ||
| **/vendor/ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,26 @@ | ||
| FROM microsoft/dotnet:2.1-sdk AS build-env | ||
|
|
||
| ARG PROJECT_NAME=decrypt-api | ||
|
|
||
| WORKDIR /app | ||
|
|
||
| # Copy csproj and restore as distinct layers | ||
| COPY ./src/Hamuste.csproj ./ | ||
| RUN dotnet restore | ||
| COPY ./src/$PROJECT_NAME/$PROJECT_NAME.csproj ./$PROJECT_NAME/$PROJECT_NAME.csproj | ||
| COPY ./src/key-managment/key-managment.csproj ./key-managment/key-managment.csproj | ||
| RUN dotnet restore $PROJECT_NAME/$PROJECT_NAME.csproj | ||
|
|
||
| # Copy everything else and build | ||
| COPY ./src ./ | ||
| RUN dotnet publish -c Release -o ./obj/Docker/publish | ||
| COPY ./src/$PROJECT_NAME ./$PROJECT_NAME | ||
| COPY ./src/key-managment ./key-managment | ||
| RUN dotnet publish $PROJECT_NAME/$PROJECT_NAME.csproj -c Release -o ./obj/Docker/publish | ||
|
|
||
| # Build runtime image | ||
| FROM microsoft/dotnet:2.1-aspnetcore-runtime as release | ||
| FROM microsoft/dotnet:2.1.6-aspnetcore-runtime as release | ||
| ARG PROJECT_NAME=decrypt-api | ||
| ENV PROJECT_NAME_ENV=$PROJECT_NAME | ||
| RUN groupadd -r dotnet && useradd --no-log-init -r -g dotnet -d /home/dotnet -ms /bin/bash dotnet | ||
| USER dotnet | ||
| WORKDIR /home/dotnet/app | ||
| ENV ASPNETCORE_URLS=http://+:9999 | ||
| COPY --from=build-env /app/obj/Docker/publish . | ||
| ENTRYPOINT ["dotnet", "Hamuste.dll"] | ||
| COPY --from=build-env /app/$PROJECT_NAME/obj/Docker/publish . | ||
| ENTRYPOINT dotnet $PROJECT_NAME_ENV.dll |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: v1 | ||
| description: An open source, git-ops, zero-trust secrets encryption and decryption solution for Kubernetes applications | ||
| name: kamus | ||
| version: 0.1.0 | ||
| keywords: | ||
| - gitops | ||
| - secrets | ||
| sources: | ||
| - https://github.com/Soluto/Kamus | ||
| maintainers: | ||
| - name: Omer Levi Hevroni | ||
| - name: Shai Katz |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| 1. Get the application URL by running these commands: | ||
| {{- if .Values.ingress.enabled }} | ||
| {{- range .Values.ingress.hosts }} | ||
| http://{{ . }} | ||
| {{- end }} | ||
| {{- else if contains "NodePort" .Values.service.type }} | ||
| export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "kamus.name" . }}) | ||
| export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") | ||
| echo http://$NODE_IP:$NODE_PORT | ||
| {{- else if contains "LoadBalancer" .Values.service.type }} | ||
| NOTE: It may take a few minutes for the LoadBalancer IP to be available. | ||
| You can watch the status of by running 'kubectl get svc -w {{ template "kamus.name" . }}' | ||
| export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "kamus.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') | ||
| echo http://$SERVICE_IP:{{ .Values.service.externalPort }} | ||
| {{- else if contains "ClusterIP" .Values.service.type }} | ||
| export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "kamus.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") | ||
| echo "Visit http://127.0.0.1:8080 to use your application" | ||
| kubectl port-forward $POD_NAME 8080:{{ .Values.service.internalPort }} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| {{/* vim: set filetype=mustache: */}} | ||
| {{/* | ||
| Expand the name of the chart. | ||
| */}} | ||
| {{- define "kamus.name" -}} | ||
| {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "appsettings.secret.json" }} | ||
| {{ printf "{\n\t\"ActiveDirectory\": { " }} | ||
| {{ if .Values.activeDirectory}} | ||
| {{ printf "\t\t\"ClientSecret\": \"%s\" " .Values.activeDirectory.clientSecret }} | ||
| {{- end -}} | ||
| {{ if .Values.keyManagment.AES}} | ||
| {{ printf "\"KeyManagement\": { \n\t\t\"AES\": { \"Key\": \"%s\" } }" .Values.keyManagment.AES.key }} | ||
| {{- end -}} | ||
| {{ printf "} \n}"}} | ||
| {{- end }} | ||
|
|
||
| "KeyManagement": { | ||
| "Provider": "AESKey", | ||
| "AES": { | ||
| "Key": "rWnWbaFutavdoeqUiVYMNJGvmjQh31qaIej/vAxJ9G0=" | ||
| }, | ||
| "KeyVault": { | ||
| "Name": "k8spoc", | ||
| "KeyType": "RSA", | ||
| "KeyLength": "2048", | ||
| "MaximumDataLength": "214" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: autoscaling/v1 | ||
| kind: HorizontalPodAutoscaler | ||
| metadata: | ||
| name: {{ template "kamus.name" . }}-decryptor | ||
| namespace: {{ .Values.team }} | ||
| labels: | ||
| app: {{ template "kamus.name" . }} | ||
| component: decryptor | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| release: {{ .Release.Name }} | ||
| heritage: {{ .Release.Service }} | ||
| spec: | ||
| scaleTargetRef: | ||
| apiVersion: apps/v1beta1 | ||
| kind: Deployment | ||
| name: {{ template "kamus.name" . }}-decryptor | ||
| minReplicas: {{ .Values.autoscale.minReplicas }} | ||
| maxReplicas: {{ .Values.autoscale.maxReplicas }} | ||
| targetCPUUtilizationPercentage: {{ .Values.autoscale.targetCPU }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: autoscaling/v1 | ||
| kind: HorizontalPodAutoscaler | ||
| metadata: | ||
| name: {{ template "kamus.name" . }}-encryptor | ||
| namespace: {{ .Values.team }} | ||
| labels: | ||
| app: {{ template "kamus.name" . }} | ||
| component: encryptor | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| release: {{ .Release.Name }} | ||
| heritage: {{ .Release.Service }} | ||
| spec: | ||
| scaleTargetRef: | ||
| apiVersion: apps/v1beta1 | ||
| kind: Deployment | ||
| name: {{ template "kamus.name" . }}-encryptor | ||
| minReplicas: {{ .Values.autoscale.minReplicas }} | ||
| maxReplicas: {{ .Values.autoscale.maxReplicas }} | ||
| targetCPUUtilizationPercentage: {{ .Values.autoscale.targetCPU }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ template "kamus.name" . }}-decryptor | ||
| namespace: {{ .Values.team }} | ||
| data: | ||
| KeyManagement__Provider: {{ .Values.keyManagment.provider }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ template "kamus.name" . }}-encryptor | ||
| namespace: {{ .Values.team }} | ||
| data: | ||
| KeyManagement__Provider: {{ .Values.keyManagment.provider }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| apiVersion: extensions/v1beta1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: {{ template "kamus.name" . }}-decryptor | ||
| namespace: {{ .Values.team }} | ||
| labels: | ||
| app: {{ template "kamus.name" . }} | ||
| component: decryptor | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| release: {{ .Release.Name }} | ||
| heritage: {{ .Release.Service }} | ||
| spec: | ||
| strategy: | ||
| rollingUpdate: | ||
| maxUnavailable: {{ .Values.maxUnavailable }} | ||
| replicas: {{ .Values.replicaCount }} | ||
| selector: | ||
| matchLabels: | ||
| app: {{ template "kamus.name" . }} | ||
| release: {{ .Release.Name }} | ||
| component: decryptor | ||
| revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: {{ template "kamus.name" . }} | ||
| release: {{ .Release.Name }} | ||
| component: decryptor | ||
| spec: | ||
| serviceAccountName: {{ template "kamus.name" . }} | ||
| automountServiceAccountToken: true | ||
| containers: | ||
| - name: decryptor-api | ||
| image: {{ .Values.image.repository }}/kamus:decryptor-{{ .Values.image.version }} | ||
| imagePullPolicy: {{ .Values.image.pullPolicy }} | ||
| volumeMounts: | ||
| - name: secret-volume | ||
| mountPath: /app/secrets | ||
| ports: | ||
| - containerPort: 9999 | ||
| livenessProbe: | ||
| httpGet: | ||
| path: /api/v1/isAlive | ||
| port: 9999 | ||
| readinessProbe: | ||
| httpGet: | ||
| path: /api/v1/isAlive | ||
| port: 9999 | ||
| resources: | ||
| {{ toYaml .Values.resources | indent 12 }} | ||
| envFrom: | ||
| - configMapRef: | ||
| name: {{ template "kamus.name" . }}-decryptor | ||
| {{- if .Values.imagePullSecrets }} | ||
| imagePullSecrets: | ||
| - name: {{ toYaml .Values.imagePullSecrets }} | ||
| {{- end }} | ||
| volumes: | ||
| - name: secret-volume | ||
| secret: | ||
| secretName: {{ template "kamus.name" . }} | ||
| {{- if .Values.nodeSelector }} | ||
| nodeSelector: | ||
| {{ toYaml .Values.nodeSelector | indent 8 }} | ||
| {{- end }} |
Oops, something went wrong.