Added Vault as optional

agent/container/pkg/clients/nats_client.go

@@ -1,11 +1,13 @@
 package clients
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"time"
 
 	"github.com/intelops/kubviz/agent/container/pkg/config"
+	"github.com/intelops/kubviz/credential"
 
 	"github.com/nats-io/nats.go"
 )
@@ -41,11 +43,25 @@ func NewNATSContext(conf *config.Config) (*NATSContext, error) {
 	fmt.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
 	time.Sleep(1 * time.Second)
 
-	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))
+	var token string
+	log.Println("Vault enabled",conf.Enabled)
+	if conf.Enabled {
+		cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
+		if err != nil {
+			return nil, err
+		}
+		token = cred["nats"]
+	} else {
+		token = conf.NatsToken
+	}
+
+	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
 	if err != nil {
 		return nil, err
 	}
 
+
+
 	ctx := &NATSContext{
 		conf: conf,
 		conn: conn,

agent/container/pkg/config/configuration.go

@@ -5,10 +5,13 @@ package config
 
 // Config will have the configuration details
 type Config struct {
-	NatsAddress string `envconfig:"NATS_ADDRESS"`
-	NatsToken   string `envconfig:"NATS_TOKEN"`
-	Port        int    `envconfig:"PORT"`
-	StreamName  string `envconfig:"STREAM_NAME"`
+	Enabled        bool   `envconfig:"ENABLED" default:"true"`
+	CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
+	EntityName     string `envconfig:"NATS_ENTITY_NAME" default:"nats"`
+	NatsAddress    string `envconfig:"NATS_ADDRESS"`
+	NatsToken      string `envconfig:"NATS_"`
+	Port           int    `envconfig:"PORT"`
+	StreamName     string `envconfig:"STREAM_NAME"`
 }
 
 type GithubConfig struct {

agent/git/pkg/clients/nats_client.go

@@ -1,9 +1,11 @@
 package clients
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/intelops/kubviz/agent/git/pkg/config"
+	"github.com/intelops/kubviz/credential"
 	"github.com/intelops/kubviz/model"
 
 	"log"
@@ -29,8 +31,18 @@ type NATSContext struct {
 func NewNATSContext(conf *config.Config) (*NATSContext, error) {
 	fmt.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
 	time.Sleep(1 * time.Second)
-
-	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))
+	log.Println("Vault Enabled", conf.Enabled)
+	var token string
+	if conf.Enabled {
+		cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
+		if err != nil {
+			return nil, err
+		}
+		token = cred["nats"]
+	} else {
+		token = conf.NatsToken
+	}
+	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
 	if err != nil {
 		return nil, err
 	}

agent/git/pkg/config/configuration.go

@@ -5,6 +5,9 @@ package config
 
 //Config will have the configuration details
 type Config struct {
+	Enabled bool `envconfig:"ENABLED" default:"true"`
+	CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
+	EntityName     string `envconfig:"NATS_ENTITY_NAME" default:"nats"`
 	NatsAddress string `envconfig:"NATS_ADDRESS"`
 	NatsToken   string `envconfig:"NATS_TOKEN"`
 	Port        int    `envconfig:"PORT"`

agent/kubviz/k8smetrics_agent.go

@@ -21,7 +21,7 @@ import (
 	"k8s.io/client-go/rest"
 
 	"fmt"
-
+	
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
@@ -81,7 +81,8 @@ func main() {
 		config    *rest.Config
 		clientset *kubernetes.Clientset
 	)
-	// connecting with nats ...
+
+
 	nc, err := nats.Connect(natsurl, nats.Name("K8s Metrics"), nats.Token(token))
 	checkErr(err)
 	// creating a jetstream connection using the nats connection

charts/agent/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.0
+version: 1.1.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/agent/templates/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "vault-role-kubviz"
+data:
+  roleName: vault-role-kubviz
+  policyNames: {{ .Values.vault.policyNames | quote }}
+  servieAccounts: {{ include "agent.serviceAccountName" . }}
+  servieAccountNameSpaces: {{ .Release.Namespace }}

charts/agent/templates/deployment.yaml

@@ -49,9 +49,10 @@ spec:
           - name: CLUSTER_NAME
             value: {{ .Values.clusterName }}
           - name: NATS_TOKEN
-            value: {{ .Values.nats.auth.token }}
+            value: {{ .Values.nats.auth.token }}            
           - name: NATS_ADDRESS
             value: {{ .Values.nats.host }}
+
           - name: SCHEDULING_INTERVAL
             value: {{ .Values.schedulingInterval }}
           resources:
@@ -104,3 +105,23 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+{{- if .Values.vault.enabled }}
+
+          env:
+          - name: VAULT_ADDR
+            value: {{ .Values.vault.address }}
+          - name: VAULT_ROLE
+            value: {{ .Values.vault.role }}
+
+          - name: NATS_CRED_IDENTIFIER
+            value: {{ .Values.vault.credidentifier | quote }}
+          - name: NATS_ENTITY_NAME
+            value: {{ .Values.vault.entityname | quote }}
+{{- else }}
+          env:
+          - name: NATS_TOKEN
+            value: {{ .Values.nats.auth.token }}
+          - name: NATS_ADDRESS
+            value: {{ .Values.nats.host }}
+
+{{- end }}

charts/agent/values.yaml

@@ -74,7 +74,14 @@ git_bridge:
     #    hosts:
     #      - chart-example.local
 
-
+vault:
+  enabled: true
+  address: http://vault:8200
+  role: "vault-role-kubviz"
+  policyNames: "vault-policy-cluster-admin,vault-policy-cluster-read"
+  host: kubviz-client-nats
+  credidentifier: auth-token
+  entityname: nats
 
 container_bridge:
   enabled: false
@@ -146,6 +153,7 @@ schedulingInterval: "24h"
 
 clusterName: "kubviz"
 nats:
+
   host: kubviz-client-nats 
   auth:
     token: "UfmrJOYwYCCsgQvxvcfJ3BdI6c8WBbnD"

charts/client/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.0
+version: 1.1.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/client/templates/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "vault-role-kubviz"
+data:
+  roleName: vault-role-kubviz
+  policyNames: {{ .Values.vault.policyNames | quote }}
+  servieAccounts: {{ include "client.serviceAccountName" . }}
+  servieAccountNameSpaces: {{ .Release.Namespace }}

charts/client/templates/deployment.yaml

@@ -37,6 +37,25 @@ spec:
             - name: http
               containerPort: 80
               protocol: TCP
+
+  {{- if .Values.vault.enabled }}
+
+          env:
+          - name: VAULT_ADDR
+            value: {{ .Values.vault.address }}
+          - name: VAULT_ROLE
+            value: {{ .Values.vault.role }}
+
+          - name: NATS_CRED_IDENTIFIER
+            value: {{ .Values.vault.credidentifier | quote }}
+          - name: NATS_ENTITY_NAME
+            value: {{ .Values.vault.entityname | quote }}
+  {{- else }}
+          env:
+          - name: NATS_TOKEN
+            value: {{ .Values.nats.auth.token }}
+
+  {{- end }}
 #          livenessProbe:
 #            httpGet:
 #              path: /
@@ -46,10 +65,12 @@ spec:
 #              path: /
 #              port: http
           env:
-          - name: NATS_TOKEN
-            value: {{ .Values.nats.auth.token }}
           - name: NATS_ADDRESS
-            value: {{ include "client.fullname" . }}-nats
+            value: {{ .Values.nats.host }}
+#          - name: NATS_TOKEN
+#            value: {{ .Values.nats.auth.token }}
+#          - name: NATS_ADDRESS
+#            value: {{ include "client.fullname" . }}-nats
           - name: DB_ADDRESS
             value: {{ include "client.fullname" . }}-clickhouse
           - name: DB_PORT
@@ -68,3 +89,4 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+

charts/client/values.yaml

@@ -64,7 +64,14 @@ resources: {}
   # requests:
   #   cpu: 100m
   #   memory: 128Mi
-
+vault:
+  enabled: true
+  address: http://vault:8200
+  role: "vault-role-kubviz"
+  policyNames: "vault-policy-cluster-admin,vault-policy-cluster-read"
+  host: kubviz-client-nats
+  credidentifier: auth-token
+  entityname: nats
 autoscaling:
   enabled: false
   minReplicas: 1
@@ -79,7 +86,7 @@ tolerations: []
 affinity: {}
 
 nats:
-  enabled: true
+
   #Authentication setup
   auth:
     enabled: true

client/pkg/clients/bridge_client.go

@@ -393,4 +393,4 @@ func (n *NATSContext) SubscribeGitBridgeNats(conn clickhouse.DBInterface) {
 			}
 		}
 	}, nats.Durable(string(bridgeConsumer)), nats.ManualAck())
-}
+}

client/pkg/clients/clients.go

@@ -1,12 +1,15 @@
 package clients
 
 import (
+	"context"
 	"fmt"
+
 	"log"
 	"time"
 
 	"github.com/intelops/kubviz/client/pkg/clickhouse"
 	"github.com/intelops/kubviz/client/pkg/config"
+	"github.com/intelops/kubviz/credential"
 	"github.com/nats-io/nats.go"
 )
 
@@ -20,8 +23,19 @@ type NATSContext struct {
 func NewNATSContext(conf *config.Config, dbClient clickhouse.DBInterface) (*NATSContext, error) {
 	log.Println("Waiting before connecting to NATS at:", conf.NatsAddress)
 	time.Sleep(1 * time.Second)
-
-	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(conf.NatsToken))
+	var token string
+	log.Println("Vault enabled",conf.Enabled)
+	if conf.Enabled {
+		cred, err := credential.GetGenericCredential(context.Background(), conf.EntityName, conf.CredIdentifier)
+		if err != nil {
+			return nil, err
+		}
+		token = cred["nats"]
+	} else {
+		token = conf.NatsToken
+	}
+
+	conn, err := nats.Connect(conf.NatsAddress, nats.Name("Github metrics"), nats.Token(token))
 	if err != nil {
 		return nil, err
 	}

client/pkg/config/config.go

@@ -1,8 +1,11 @@
 package config
 
 type Config struct {
-	NatsAddress string `envconfig:"NATS_ADDRESS"`
-	NatsToken   string `envconfig:"NATS_TOKEN"`
-	DbPort      int    `envconfig:"DB_PORT"`
-	DBAddress   string `envconfig:"DB_ADDRESS"`
+	Enabled        bool   `envconfig:"ENABLED" default:"true"`
+	CredIdentifier string `envconfig:"NATS_CRED_IDENTIFIER" default:"authToken"`
+	EntityName     string `envconfig:"NATS_ENTITY_NAME" default:"astra"`
+	NatsAddress    string `envconfig:"NATS_ADDRESS"`
+	NatsToken      string `envconfig:"NATS_TOKEN"`
+	DbPort         int    `envconfig:"DB_PORT"`
+	DBAddress      string `envconfig:"DB_ADDRESS"`
 }

credential/credential.go

@@ -0,0 +1,27 @@
+package credential
+
+import (
+	"context"
+
+	"github.com/intelops/go-common/credentials"
+	"github.com/pkg/errors"
+)
+
+const (
+	credentialType = "cluster-cred"
+)
+
+func GetGenericCredential(ctx context.Context, Entity, CredIdentifier string) (map[string]string, error) {
+	credReader, err := credentials.NewCredentialReader(ctx)
+	if err != nil {
+		err = errors.WithMessage(err, "error in initializing credential reader")
+		return nil, err
+	}
+	cred, err := credReader.GetCredential(context.Background(), credentialType, Entity, CredIdentifier)
+	if err != nil {
+		err = errors.WithMessage(err, "error in reading credential")
+		return nil, err
+	}
+
+	return cred, nil
+}

dockerfiles/agent/container/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.19 AS builder
+FROM golang:1.20 AS builder
 WORKDIR /
 COPY ./ ./
 

dockerfiles/agent/git/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.19 AS builder
+FROM golang:1.20 AS builder
 WORKDIR /
 COPY ./ ./