Skip to content

Turn the ClaimToken into a K8s Secret #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mellena1 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Turn the ClaimToken into a K8s Secret #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8dd9ab8
Make claim token a secret
mellena1 Oct 9, 2019
8644af3
Docs fix
mellena1 Oct 9, 2019
9d64a70
Fix typo and update phrasing
mellena1 Oct 11, 2019
c304669
Use plexClaim secret for transcode pods
mellena1 Dec 7, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions charts/kube-plex/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,9 @@ The following tables lists the configurable parameters of the Plex chart and the
| `kubePlex.image.repository` | Image repository | `quay.io/munnerz/kube-plex` |
| `kubePlex.image.tag` | Image tag. | `latest`|
| `kubePlex.image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `claimToken` | Plex Claim Token to authenticate your acount | `` |
| `claimToken.secret` | Existing secret name holding the Plex Claim Token to authenticate your acount. Must set this or `claimToken.value` | `` |
| `claimToken.secretKey` | The key in the above secret that holds the Plex Claim Token | `claimToken` |
| `claimToken.value` | The plain-text Plex Claim Token. Set this if not using `claimToken.secret` | `` |
| `timezone` | Timezone plex instance should run as, e.g. 'America/New_York' | `Europe/London` |
| `service.type` | Kubernetes service type for the plex GUI/API | `ClusterIP` |
| `service.port` | Kubernetes port where the plex GUI/API is exposed| `32400` |
Expand All @@ -35,11 +37,11 @@ The following tables lists the configurable parameters of the Plex chart and the
| `persistence.transcode.subPath` | SubPath to use for existing Claim | `nil` |
| `persistence.transcode.storageClass` | Type of persistent volume claim | `-` |
| `persistence.data.size` | Size of persistent volume claim | `40Gi` |
| `persistence.data.existingClaim`| Use an existing PVC to persist data | `nil` |
| `persistence.data.claimName`| Use an existing PVC to persist data | `nil` |

@munnerz munnerz Jun 12, 2020

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 didn't realise these are incorrect 👀

| `persistence.data.subPath` | SubPath to use for existing Claim | `nil` |
| `persistence.data.storageClass` | Type of persistent volume claim | `-` |
| `persistence.config.size` | Size of persistent volume claim | `20Gi` |
| `persistence.config.existingClaim`| Use an existing PVC to persist data | `nil` |
| `persistence.config.claimName`| Use an existing PVC to persist data | `nil` |
| `persistence.config.subPath` | SubPath to use for existing Claim | `nil` |
| `persistence.config.storageClass` | Type of persistent volume claim | `-` |
| `resources` | CPU/Memory resource requests/limits | `{}` |
Expand Down
11 changes: 11 additions & 0 deletions charts/kube-plex/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the secret name for the claimToken
*/}}
{{- define "claimTokenSecretName" -}}
{{- if .Values.claimToken.secret -}}
{{ printf "%s" .Values.claimToken.secret }}
{{- else -}}
{{ printf "%s-%s" (include "fullname" .) "claim-token" | trunc 63 -}}
{{- end -}}
{{- end -}}
10 changes: 8 additions & 2 deletions charts/kube-plex/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,9 +83,15 @@ spec:
env:
- name: TZ
value: "{{ .Values.timezone }}"
# TODO: move this to a secret?
- name: PLEX_CLAIM_SECRET_NAME
value: {{ template "claimTokenSecretName" . }}
- name: PLEX_CLAIM_SECRET_KEY
value: {{ .Values.claimToken.secretKey }}
- name: PLEX_CLAIM
value: "{{ .Values.claimToken }}"
valueFrom:
secretKeyRef:
name: {{ template "claimTokenSecretName" . }}
key: {{ .Values.claimToken.secretKey }}
# kube-plex env vars
- name: PMS_INTERNAL_ADDRESS
value: http://{{ template "fullname" . }}:32400
Expand Down
14 changes: 14 additions & 0 deletions charts/kube-plex/templates/secret-claimToken.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
{{- if not .Values.claimToken.secret -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "claimTokenSecretName" . }}
labels:
app: {{ template "name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
type: Opaque
data:
{{ .Values.claimToken.secretKey }}: {{ .Values.claimToken.value | b64enc | quote }}

@munnerz munnerz Jun 12, 2020

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once the config for this is split into claimToken and claimTokenSecret, can we change this Secret resource so that it does not use the secretKey or name field from the claimToken 'structure', and instead just hardcodes it (i.e. to the 'fullname' template, and then just some static 'key' for the Secret (specifically in the case where a user specifies claimToken and not claimTokenSecret).

{{- end -}}
7 changes: 6 additions & 1 deletion charts/kube-plex/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,12 @@ kubePlex:
pullPolicy: Always

# Override this with the plex claim token from plex.tv/claim
claimToken: ""
claimToken:

@munnerz munnerz Jun 12, 2020

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to not break existing users, how about we leave this field as is, and add a new field:

# Configure the Plex 'claim token' (plex.tv/claim) using a manually created
# Secret resource stored in the cluster.
# Only one of 'claimToken' or 'claimTokenSecret' may be specified.
# 'claimToken' is deprecated in favour of 'claimTokenSecret' to avoid persisting
# sensitive information into Helm releases.
claimTokenSecret:
  ## Name of a Secret resource containing a Plex 'claim' token.
  name: ""
  ## Key in the Secret resource of the claim token
  key: "token"

## secret containing your claimToken. if not set it will create a secret instead using claimToken.value
secret:
secretKey: claimToken
## only specify value if you are passing in the plain text claimToken
value:

# Set the timezone of the plex server
timezone: Europe/London
Expand Down
40 changes: 37 additions & 3 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,16 @@ var namespace = os.Getenv("KUBE_NAMESPACE")
var pmsImage = os.Getenv("PMS_IMAGE")
var pmsInternalAddress = os.Getenv("PMS_INTERNAL_ADDRESS")

// the info about where the plex claim secret is held
// instead of passing the claim in plain text to the pods, we pass the secret
var plexClaimSecretName = os.Getenv("PLEX_CLAIM_SECRET_NAME")
var plexClaimSecretKey = os.Getenv("PLEX_CLAIM_SECRET_KEY")

func main() {
env := os.Environ()
args := os.Args

rewriteEnv(env)
env = rewriteEnv(env)
rewriteArgs(args)
cwd, err := os.Getwd()
if err != nil {
Expand Down Expand Up @@ -83,9 +88,20 @@ func main() {
}
}

func removeValFromEnvSlice(s []string, r string) []string {
for i, v := range s {
splitvar := strings.SplitN(v, "=", 2)
if splitvar[0] == r {
return append(s[:i], s[i+1:]...)
}
}
return s
}

// rewriteEnv rewrites environment variables to be passed to the transcoder
func rewriteEnv(in []string) {
// no changes needed
func rewriteEnv(in []string) []string {
in = removeValFromEnvSlice(in, "PLEX_CLAIM")
return in
}

func rewriteArgs(in []string) {
Expand All @@ -101,6 +117,7 @@ func rewriteArgs(in []string) {

func generatePod(cwd string, env []string, args []string) *corev1.Pod {
envVars := toCoreV1EnvVar(env)
envVars = addFromSecretsToCoreV1EnvVar(envVars)

@munnerz munnerz Jun 12, 2020

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think these values need to be set on the transcoder pods as the transcoder doesn't have to authenticate with PMS, as far as I am aware? 🤔 perhaps I am wrong though! It's been a while...

return &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
GenerateName: "pms-elastic-transcoder-",
Expand Down Expand Up @@ -165,6 +182,23 @@ func generatePod(cwd string, env []string, args []string) *corev1.Pod {
}
}

func addFromSecretsToCoreV1EnvVar(vars []corev1.EnvVar) []corev1.EnvVar {
secrets := []corev1.EnvVar{
{
Name: "PLEX_CLAIM",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: plexClaimSecretName,
},
Key: plexClaimSecretKey,
},
},
},
}
return append(vars, secrets...)
}

func toCoreV1EnvVar(in []string) []corev1.EnvVar {
out := make([]corev1.EnvVar, len(in))
for i, v := range in {
Expand Down