Skip to content

Commit 5afb1ef

Browse files
reet8598reet8598
committed
separate skyline secret creation and update docs
1 parent e05b675 commit 5afb1ef

File tree

3 files changed

+210
-64
lines changed

3 files changed

+210
-64
lines changed

‎bin/create-secrets.sh‎

Lines changed: 12 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,6 @@ neutron_db_password=$(generate_password 32)
7171
neutron_admin_password=$(generate_password 32)
7272
horizon_secret_key=$(generate_password 64)
7373
horizon_db_password=$(generate_password 32)
74-
skyline_service_password=$(generate_password 32)
75-
skyline_db_password=$(generate_password 32)
76-
skyline_secret_key_password=$(generate_password 32)
7774
octavia_rabbitmq_password=$(generate_password 64)
7875
octavia_db_password=$(generate_password 32)
7976
octavia_admin_password=$(generate_password 32)
@@ -456,31 +453,6 @@ data:
456453
---
457454
apiVersion: v1
458455
kind: Secret
459-
metadata:
460-
name: skyline-apiserver-secrets
461-
namespace: openstack
462-
type: Opaque
463-
data:
464-
service-username: $(echo -n "skyline" | base64)
465-
service-password: $(echo -n $skyline_service_password | base64 -w0)
466-
service-domain: $(echo -n "service" | base64)
467-
service-project: $(echo -n "service" | base64)
468-
service-project-domain: $(echo -n "service" | base64)
469-
db-endpoint: $(echo -n "mariadb-cluster-primary.openstack.svc.cluster.local" | base64 -w0)
470-
db-name: $(echo -n "skyline" | base64)
471-
db-username: $(echo -n "skyline" | base64)
472-
db-password: $(echo -n $skyline_db_password | base64 -w0)
473-
secret-key: $(echo -n $skyline_secret_key_password | base64 -w0)
474-
keystone-endpoint: $(echo -n "http://keystone-api.openstack.svc.cluster.local:5000/v3" | base64 -w0)
475-
keystone-username: $(echo -n "skyline" | base64)
476-
default-region: $(echo -n "$region" | base64)
477-
prometheus_basic_auth_password: $(echo -n "" | base64)
478-
prometheus_basic_auth_user: $(echo -n "" | base64)
479-
prometheus_enable_basic_auth: $(echo -n "false" | base64)
480-
prometheus_endpoint: $(echo -n "http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090" | base64 -w0)
481-
---
482-
apiVersion: v1
483-
kind: Secret
484456
metadata:
485457
name: octavia-rabbitmq-password
486458
namespace: openstack
@@ -880,6 +852,17 @@ data:
880852
password: $(echo -n $zaqar_keystone_test_password | base64 -w0)
881853
EOF
882854

855+
# Check if skylinesecrets.yaml exists and append it
856+
SKYLINE_SECRETS_FILE="/etc/genestack/skylinesecrets.yaml"
857+
if [[ -f ${SKYLINE_SECRETS_FILE} ]]; then
858+
echo "Found existing ${SKYLINE_SECRETS_FILE}, appending skyline secrets..."
859+
cat ${SKYLINE_SECRETS_FILE} >> ${OUTPUT_FILE}
860+
echo "✓ Skyline secrets appended from ${SKYLINE_SECRETS_FILE}"
861+
else
862+
echo "Note: ${SKYLINE_SECRETS_FILE} not found. Run create-skyline-secrets.sh to add skyline secrets."
863+
fi
864+
883865
rm nova_ssh_key nova_ssh_key.pub
884866
chmod 0640 ${OUTPUT_FILE}
885-
echo "Secrets YAML file created as ${OUTPUT_FILE}"
867+
echo ""
868+
echo "✓ Secrets YAML file created as ${OUTPUT_FILE}"

‎bin/create-skyline-secrets.sh‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
#!/bin/bash
2+
# shellcheck disable=SC2086
3+
4+
usage() {
5+
echo "Usage: $0 [--region <region [RegionOne]>"
6+
exit 1
7+
}
8+
9+
region="RegionOne"
10+
11+
# Parse command-line arguments
12+
while [[ "$#" -gt 0 ]]; do
13+
case $1 in
14+
--help)
15+
usage
16+
;;
17+
-h)
18+
usage
19+
;;
20+
--region)
21+
region="$2"
22+
shift 2
23+
;;
24+
*)
25+
echo "Unknown parameter passed: $1"
26+
usage
27+
;;
28+
esac
29+
done
30+
31+
# Check if the region argument is provided
32+
if [ -z "$region" ]; then
33+
usage
34+
fi
35+
36+
# Generate random password function
37+
generate_password() {
38+
< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32}
39+
}
40+
41+
OUTPUT_FILE="/etc/genestack/kubesecrets.yaml"
42+
SKYLINE_SECRETS_FILE="/etc/genestack/skylinesecrets.yaml"
43+
44+
# Check if skylinesecrets.yaml already exists
45+
if [[ -f ${SKYLINE_SECRETS_FILE} ]]; then
46+
echo "Error: ${SKYLINE_SECRETS_FILE} already exists."
47+
echo " Skyline secrets have already been generated."
48+
echo " If you want to regenerate skyline secrets, please delete ${SKYLINE_SECRETS_FILE} first."
49+
echo " WARNING: This will generate NEW passwords and break existing Skyline installations!"
50+
exit 1
51+
fi
52+
53+
# Check if kubesecrets.yaml exists
54+
if [[ ! -f ${OUTPUT_FILE} ]]; then
55+
echo "Error: ${OUTPUT_FILE} does not exist."
56+
echo " Please run create-secrets.sh first to generate the base secrets file."
57+
exit 1
58+
fi
59+
60+
# Generate Skyline passwords
61+
echo "Generating new Skyline secrets..."
62+
skyline_service_password=$(generate_password 32)
63+
skyline_db_password=$(generate_password 32)
64+
skyline_secret_key_password=$(generate_password 32)
65+
66+
# Create the Skyline secrets YAML content
67+
SKYLINE_SECRET_CONTENT="---
68+
apiVersion: v1
69+
kind: Secret
70+
metadata:
71+
name: skyline-apiserver-secrets
72+
namespace: openstack
73+
type: Opaque
74+
data:
75+
service-username: $(echo -n "skyline" | base64)
76+
service-password: $(echo -n $skyline_service_password | base64 -w0)
77+
service-domain: $(echo -n "service" | base64)
78+
service-project: $(echo -n "service" | base64)
79+
service-project-domain: $(echo -n "service" | base64)
80+
db-endpoint: $(echo -n "mariadb-cluster-primary.openstack.svc.cluster.local" | base64 -w0)
81+
db-name: $(echo -n "skyline" | base64)
82+
db-username: $(echo -n "skyline" | base64)
83+
db-password: $(echo -n $skyline_db_password | base64 -w0)
84+
secret-key: $(echo -n $skyline_secret_key_password | base64 -w0)
85+
keystone-endpoint: $(echo -n "http://keystone-api.openstack.svc.cluster.local:5000/v3" | base64 -w0)
86+
keystone-username: $(echo -n "skyline" | base64)
87+
default-region: $(echo -n "$region" | base64)
88+
prometheus_basic_auth_password: $(echo -n "" | base64)
89+
prometheus_basic_auth_user: $(echo -n "" | base64)
90+
prometheus_enable_basic_auth: $(echo -n "false" | base64)
91+
prometheus_endpoint: $(echo -n "http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090" | base64 -w0)"
92+
93+
# Write to skylinesecrets.yaml
94+
echo "$SKYLINE_SECRET_CONTENT" > ${SKYLINE_SECRETS_FILE}
95+
chmod 0640 ${SKYLINE_SECRETS_FILE}
96+
echo "Created ${SKYLINE_SECRETS_FILE}"
97+
98+
# Check if skyline section already exists in kubesecrets.yaml
99+
if grep -q "name: skyline-apiserver-secrets" ${OUTPUT_FILE}; then
100+
echo "Warning: skyline-apiserver-secrets already exists in ${OUTPUT_FILE}"
101+
echo " This suggests skylinesecrets.yaml was previously generated."
102+
echo " Aborting to prevent duplicate entries."
103+
exit 1
104+
fi
105+
106+
# Append to kubesecrets.yaml
107+
cat <<EOF >> $OUTPUT_FILE
108+
---
109+
apiVersion: v1
110+
kind: Secret
111+
metadata:
112+
name: skyline-apiserver-secrets
113+
namespace: openstack
114+
type: Opaque
115+
data:
116+
service-username: $(echo -n "skyline" | base64)
117+
service-password: $(echo -n $skyline_service_password | base64 -w0)
118+
service-domain: $(echo -n "service" | base64)
119+
service-project: $(echo -n "service" | base64)
120+
service-project-domain: $(echo -n "service" | base64)
121+
db-endpoint: $(echo -n "mariadb-cluster-primary.openstack.svc.cluster.local" | base64 -w0)
122+
db-name: $(echo -n "skyline" | base64)
123+
db-username: $(echo -n "skyline" | base64)
124+
db-password: $(echo -n $skyline_db_password | base64 -w0)
125+
secret-key: $(echo -n $skyline_secret_key_password | base64 -w0)
126+
keystone-endpoint: $(echo -n "http://keystone-api.openstack.svc.cluster.local:5000/v3" | base64 -w0)
127+
keystone-username: $(echo -n "skyline" | base64)
128+
default-region: $(echo -n "$region" | base64)
129+
prometheus_basic_auth_password: $(echo -n "" | base64)
130+
prometheus_basic_auth_user: $(echo -n "" | base64)
131+
prometheus_enable_basic_auth: $(echo -n "false" | base64)
132+
prometheus_endpoint: $(echo -n "http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090" | base64 -w0)
133+
EOF
134+
135+
echo "Skyline secrets appended to ${OUTPUT_FILE}"
136+
echo ""
137+
echo "✓ Successfully created ${SKYLINE_SECRETS_FILE}"
138+
echo "✓ Successfully appended skyline secrets to ${OUTPUT_FILE}"
139+
echo ""
140+
echo "IMPORTANT: Keep ${SKYLINE_SECRETS_FILE} safe!"
141+
echo " It will be used to preserve skyline secrets when regenerating ${OUTPUT_FILE}"

‎docs/openstack-skyline.md‎

Lines changed: 57 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,63 @@ OpenStack Skyline is the next-generation web-based dashboard designed to provide
44

55
## Create secrets
66

7-
!!! note "Information about the secretes used"
8-
9-
Manual secret generation is only required if you haven't run the `create-secrets.sh` script located in `/opt/genestack/bin`.
10-
11-
??? example "Example secret generation"
12-
13-
Skyline is a little different because there's no helm integration. Given this difference the deployment is far simpler, and all secrets
14-
can be managed in one object.
15-
16-
``` shell
17-
kubectl --namespace openstack \
18-
create secret generic skyline-apiserver-secrets \
19-
--type Opaque \
20-
--from-literal=service-username="skyline" \
21-
--from-literal=service-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
22-
--from-literal=service-domain="service" \
23-
--from-literal=service-project="service" \
24-
--from-literal=service-project-domain="service" \
25-
--from-literal=db-endpoint="mariadb-cluster-primary.openstack.svc.cluster.local" \
26-
--from-literal=db-name="skyline" \
27-
--from-literal=db-username="skyline" \
28-
--from-literal=db-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
29-
--from-literal=secret-key="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
30-
--from-literal=keystone-endpoint="$(kubectl --namespace openstack get secret keystone-keystone-admin -o jsonpath='{.data.OS_AUTH_URL}' | base64 -d)" \
31-
--from-literal=keystone-username="skyline" \
32-
--from-literal=default-region="RegionOne" \
33-
--from-literal=prometheus_basic_auth_password="" \
34-
--from-literal=prometheus_basic_auth_user="" \
35-
--from-literal=prometheus_enable_basic_auth="false" \
36-
--from-literal=prometheus_endpoint="http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090"
37-
```
38-
39-
!!! note
40-
41-
All the configuration is in this one secret, so be sure to set your entries accordingly.
7+
!!! note "Automated secret generation"
8+
9+
Skyline secrets can be generated automatically using the `create-skyline-secrets.sh` script located in `/opt/genestack/bin`. This script integrates with the main `create-secrets.sh` workflow and handles all secret generation automatically.
10+
11+
### Automated Secret Generation
12+
13+
The recommended approach is to use the automated script:
14+
15+
``` shell
16+
# Generate Skyline secrets with default region (RegionOne)
17+
/opt/genestack/bin/create-skyline-secrets.sh
18+
```
19+
20+
The script will:
21+
22+
- Generate secure random passwords for all Skyline services
23+
- Create `/etc/genestack/skylinesecrets.yaml` with the Skyline-specific secrets
24+
- Append the secrets to `/etc/genestack/kubesecrets.yaml` for integration with the main workflow
25+
- Perform safety checks to prevent duplicate secret generation
26+
- Ensure the main `kubesecrets.yaml` file exists before proceeding
27+
28+
!!! warning "Prerequisites"
29+
30+
The `create-skyline-secrets.sh` script requires that `/etc/genestack/kubesecrets.yaml` already exists. Run the main `create-secrets.sh` script first if you haven't already.
31+
32+
!!! note "Secret Management"
33+
34+
All Skyline configuration is managed in a single secret object (`skyline-apiserver-secrets`), making deployment simpler compared to other OpenStack services that use Helm integration.
35+
36+
### Manual Secret Generation (Alternative)
37+
38+
If you prefer manual control or need to customize specific values, you can still create secrets manually:
39+
40+
??? example "Manual secret generation"
41+
42+
``` shell
43+
kubectl --namespace openstack \
44+
create secret generic skyline-apiserver-secrets \
45+
--type Opaque \
46+
--from-literal=service-username="skyline" \
47+
--from-literal=service-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
48+
--from-literal=service-domain="service" \
49+
--from-literal=service-project="service" \
50+
--from-literal=service-project-domain="service" \
51+
--from-literal=db-endpoint="mariadb-cluster-primary.openstack.svc.cluster.local" \
52+
--from-literal=db-name="skyline" \
53+
--from-literal=db-username="skyline" \
54+
--from-literal=db-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
55+
--from-literal=secret-key="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
56+
--from-literal=keystone-endpoint="http://keystone-api.openstack.svc.cluster.local:5000/v3" \
57+
--from-literal=keystone-username="skyline" \
58+
--from-literal=default-region="RegionOne" \
59+
--from-literal=prometheus_basic_auth_password="" \
60+
--from-literal=prometheus_basic_auth_user="" \
61+
--from-literal=prometheus_enable_basic_auth="false" \
62+
--from-literal=prometheus_endpoint="http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090"
63+
```
4264

4365
## Run the deployment
4466

0 commit comments

Comments
 (0)