Skip to content

Introduce Bootstrap Secrets#127

Open
mhjacks wants to merge 23 commits into
validatedpatterns:mainfrom
mhjacks:bootstrap_secrets_two_sections
Open

Introduce Bootstrap Secrets#127
mhjacks wants to merge 23 commits into
validatedpatterns:mainfrom
mhjacks:bootstrap_secrets_two_sections

Conversation

@mhjacks
Copy link
Copy Markdown
Collaborator

@mhjacks mhjacks commented May 14, 2026

  • Introduces optional bootstrap_secrets section to secrets file
    These secrets will always be injected as "none" (direct kubernetes secret injection) type secrets by the backend.
    These secrets are allowed to create their namespaces if the namespaces do not currently exist.

  • Bootstrap secrets are installed with make install . make load-secrets keeps track of whether bootstrap secrets have been injected or not in this run, and attempts to install them if not. (In the ordinary pattern install case bootstrap secrets will not be injected twice). Bootstrap secrets (only) can be loaded with the rhvp.cluster_utils.load_boostrap_secrets playbook on demand.

  • The existing secrets loading path is visibly the same. (The underlying python implementation is more selective
    and somewhat clearer now).

  • Fixed the "display_secrets_info" playbook and updated it to show both classes of secrets.

Martin Jackson and others added 14 commits May 13, 2026 07:47
Introduce a role that derives main and managed clustergroup stems from
values-global.yaml and the main values file, exposes load order and local
file paths, and optionally parses each file. Add list_clustergroups and
parse_clustergroup_values playbooks for local debugging. Document pattern_dir
and discovery usage in the collection README.

Co-authored-by: Cursor <cursoragent@cursor.com>
…or install and allow bootstrap secrets to create namespaces
Co-authored-by: Cursor <cursoragent@cursor.com>
…sabled

Co-authored-by: Cursor <cursoragent@cursor.com>
Bootstrap targets early Kubernetes injection; Vault is not used for that path.
vault_load_secrets validates bootstrap_secrets but only writes secrets[] to Vault.
Relax none-phase vault prefix validation, update schema and module docs,
tighten k8s inject naming/loop labels, and extend unit tests and fixtures.

Co-authored-by: Cursor <cursoragent@cursor.com>
…aces

Vault injector never materializes kubernetes_secret_objects from targetNamespaces.
Document behavior in parse_secrets_info, schema, and add a unit test.

Co-authored-by: Cursor <cursoragent@cursor.com>
A prior edit left _create_k8s_secret under else without for tns, causing NameError.

Co-authored-by: Cursor <cursoragent@cursor.com>
Coerce values-secret dict to YAML text for parse_secrets_info, resolve backing
store from values-global when unset, harden assembled debug structure, and
drop pattern_dir override that forced wrong values-global paths.

Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid hard failure when -e pattern_dir is omitted; extra-vars still override.
Typical use is running from the pattern repo root.

Co-authored-by: Cursor <cursoragent@cursor.com>
…ault

'.' is the ansible-playbook cwd, not the playbook dir; collection installs are
not the pattern repo. Accept PATTERN_DIR env or -e pattern_dir and fail with
guidance when neither is set.

Co-authored-by: Cursor <cursoragent@cursor.com>
Reuse pattern_settings resolve_overrides (extra var, PATTERN_DIR, PWD, pwd)
so determine_pattern_dir matches list_clustergroups and README; fail only
if still empty after that chain.

Co-authored-by: Cursor <cursoragent@cursor.com>
@mhjacks
Copy link
Copy Markdown
Collaborator Author

mhjacks commented May 14, 2026

Canonical usage:

---
version: "2.0"

bootstrap_secrets:
  - name: private-repo
    targetNamespaces:
      - patterns-operator
    fields:
      - name: type
        value: git
      - name: sshPrivateKey
        path: ~/.ssh/id_ed25519
      - name: url
        value: git@github.com:mhjacks/private-pattern-test.git

secrets:
# As before; no intersection between bootstrap and "regular" secrets

for:

---
global:
  pattern: private-pattern-test
  # secretLoader:
  #  disabled: true
  options:
    useCSV: false
    syncPolicy: Automatic
    installPlanApproval: Automatic
  # secretStore:
  #  backend: kubernetes
main:
  git:
    repoURL: git@github.com:mhjacks/private-pattern-test.git
    revision: main
  tokenSecret: private-repo
  tokenSecretNamespace: patterns-operator
  clusterGroupName: hub
  multiSourceConfig:
    enabled: true
    clusterGroupChartVersion: "0.9.*"

Note: Blog post here: validatedpatterns/docs#682

Martin Jackson and others added 8 commits May 14, 2026 16:02
- none backend rejects generate in _validate_one_secret_entry with a distinct message.
- invalid secrets_phase is rejected by AnsibleModule choices; use msg (args[1] is absent).

Co-authored-by: Cursor <cursoragent@cursor.com>
Remove list_clustergroups.yml, parse_clustergroup_values.yml, and
roles/clustergroup_discovery; strip README clustergroup discovery section.
These paths did not exist on main.

Co-authored-by: Cursor <cursoragent@cursor.com>
ansible-galaxy collection install can raise KeyError 'results' against
Galaxy on recent ansible-core (e.g. uv-installed lint in GitHub Actions).
offline: true skips requirements.yml installs; lint still passes.

Co-authored-by: Cursor <cursoragent@cursor.com>
Drop ansible-lint action uv stack (latest ansible-core breaks Galaxy install).
Install ansible-lint with ansible-core<2.19, pre-install requirements.yml
collections, then lint. Revert .ansible-lint offline so modules resolve.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- Set bootstrap_secrets_loaded_this_run after successful early-phase inject.
- Before late parse, if that fact is unset and bootstrap_secrets exist (v2),
  parse/inject bootstrap once then set the fact.
- Mirror the preflight in process_secrets.yml; document in load_secrets defaults
  and load_secrets playbook header.

Co-authored-by: Cursor <cursoragent@cursor.com>
set_fact from bootstrap k8s selection persisted on localhost so late phase
kept k8s_secret_utils instead of vault_utils when backend is vault.

Co-authored-by: Cursor <cursoragent@cursor.com>
Per early-phase inject run: reset counters, increment on real k8s namespace/secret
changes, then debug counts only (no secret values). kubernetes.core.k8s
tasks stay no_log; recap still reflects module changed state.

Co-authored-by: Cursor <cursoragent@cursor.com>
@mhjacks mhjacks marked this pull request as ready for review May 14, 2026 22:01
@mhjacks mhjacks requested review from darkdoc, day0hero, dminnear-rh, mbaldessari and minmzzhang and removed request for minmzzhang May 14, 2026 22:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant