Skip to content

Commit dde13a6

Browse files
reet8598reet8598
authored
Separate skyline secret creation and Update docs (#1266)
* separate skyline secret creation and update docs * docs: update skyline docs for cleaner info and refactor code * docs: update skyline doc to include enable federation section and add skylinesecrets to gitignore
1 parent bfc4f46 commit dde13a6

File tree

4 files changed

+188
-61
lines changed

4 files changed

+188
-61
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,6 @@ base-kustomize/**/charts
129129

130130
# mkdocs
131131
site/
132+
133+
# skyline secrets
134+
/etc/genestack/skylinesecrets.yaml

‎bin/create-secrets.sh‎

Lines changed: 12 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,6 @@ neutron_db_password=$(generate_password 32)
7171
neutron_admin_password=$(generate_password 32)
7272
horizon_secret_key=$(generate_password 64)
7373
horizon_db_password=$(generate_password 32)
74-
skyline_service_password=$(generate_password 32)
75-
skyline_db_password=$(generate_password 32)
76-
skyline_secret_key_password=$(generate_password 32)
7774
octavia_rabbitmq_password=$(generate_password 64)
7875
octavia_db_password=$(generate_password 32)
7976
octavia_admin_password=$(generate_password 32)
@@ -456,31 +453,6 @@ data:
456453
---
457454
apiVersion: v1
458455
kind: Secret
459-
metadata:
460-
name: skyline-apiserver-secrets
461-
namespace: openstack
462-
type: Opaque
463-
data:
464-
service-username: $(echo -n "skyline" | base64)
465-
service-password: $(echo -n $skyline_service_password | base64 -w0)
466-
service-domain: $(echo -n "service" | base64)
467-
service-project: $(echo -n "service" | base64)
468-
service-project-domain: $(echo -n "service" | base64)
469-
db-endpoint: $(echo -n "mariadb-cluster-primary.openstack.svc.cluster.local" | base64 -w0)
470-
db-name: $(echo -n "skyline" | base64)
471-
db-username: $(echo -n "skyline" | base64)
472-
db-password: $(echo -n $skyline_db_password | base64 -w0)
473-
secret-key: $(echo -n $skyline_secret_key_password | base64 -w0)
474-
keystone-endpoint: $(echo -n "http://keystone-api.openstack.svc.cluster.local:5000/v3" | base64 -w0)
475-
keystone-username: $(echo -n "skyline" | base64)
476-
default-region: $(echo -n "$region" | base64)
477-
prometheus_basic_auth_password: $(echo -n "" | base64)
478-
prometheus_basic_auth_user: $(echo -n "" | base64)
479-
prometheus_enable_basic_auth: $(echo -n "false" | base64)
480-
prometheus_endpoint: $(echo -n "http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090" | base64 -w0)
481-
---
482-
apiVersion: v1
483-
kind: Secret
484456
metadata:
485457
name: octavia-rabbitmq-password
486458
namespace: openstack
@@ -880,6 +852,17 @@ data:
880852
password: $(echo -n $zaqar_keystone_test_password | base64 -w0)
881853
EOF
882854

855+
# Check if skylinesecrets.yaml exists and append it
856+
SKYLINE_SECRETS_FILE="/etc/genestack/skylinesecrets.yaml"
857+
if [[ -f ${SKYLINE_SECRETS_FILE} ]]; then
858+
echo "Found existing ${SKYLINE_SECRETS_FILE}, appending skyline secrets..."
859+
cat ${SKYLINE_SECRETS_FILE} >> ${OUTPUT_FILE}
860+
echo "✓ Skyline secrets appended from ${SKYLINE_SECRETS_FILE}"
861+
else
862+
echo "Note: ${SKYLINE_SECRETS_FILE} not found. Run create-skyline-secrets.sh to add skyline secrets."
863+
fi
864+
883865
rm nova_ssh_key nova_ssh_key.pub
884866
chmod 0640 ${OUTPUT_FILE}
885-
echo "Secrets YAML file created as ${OUTPUT_FILE}"
867+
echo ""
868+
echo "✓ Secrets YAML file created as ${OUTPUT_FILE}"

‎bin/create-skyline-secrets.sh‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
#!/bin/bash
2+
# shellcheck disable=SC2086
3+
4+
usage() {
5+
echo "Usage: $0 [--region <region [RegionOne]>"
6+
exit 1
7+
}
8+
9+
region="RegionOne"
10+
11+
# Parse command-line arguments
12+
while [[ "$#" -gt 0 ]]; do
13+
case $1 in
14+
--help)
15+
usage
16+
;;
17+
-h)
18+
usage
19+
;;
20+
--region)
21+
region="$2"
22+
shift 2
23+
;;
24+
*)
25+
echo "Unknown parameter passed: $1"
26+
usage
27+
;;
28+
esac
29+
done
30+
31+
# Check if the region argument is provided
32+
if [ -z "$region" ]; then
33+
usage
34+
fi
35+
36+
# Generate random password function
37+
generate_password() {
38+
< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32}
39+
}
40+
41+
OUTPUT_FILE="/etc/genestack/kubesecrets.yaml"
42+
SKYLINE_SECRETS_FILE="/etc/genestack/skylinesecrets.yaml"
43+
44+
# Check if skylinesecrets.yaml already exists
45+
if [[ -f ${SKYLINE_SECRETS_FILE} ]]; then
46+
echo "Error: ${SKYLINE_SECRETS_FILE} already exists."
47+
echo " Skyline secrets have already been generated."
48+
echo " If you want to regenerate skyline secrets, please delete ${SKYLINE_SECRETS_FILE} first."
49+
echo " WARNING: This will generate NEW passwords and break existing Skyline installations!"
50+
exit 1
51+
fi
52+
53+
# Check if kubesecrets.yaml exists
54+
if [[ ! -f ${OUTPUT_FILE} ]]; then
55+
echo "Error: ${OUTPUT_FILE} does not exist."
56+
echo " Please run create-secrets.sh first to generate the base secrets file."
57+
exit 1
58+
fi
59+
60+
# Generate Skyline passwords
61+
echo "Generating new Skyline secrets..."
62+
skyline_service_password=$(generate_password 32)
63+
skyline_db_password=$(generate_password 32)
64+
skyline_secret_key_password=$(generate_password 32)
65+
66+
# Create the Skyline secrets YAML content
67+
SKYLINE_SECRET_CONTENT="---
68+
apiVersion: v1
69+
kind: Secret
70+
metadata:
71+
name: skyline-apiserver-secrets
72+
namespace: openstack
73+
type: Opaque
74+
data:
75+
service-username: $(echo -n "skyline" | base64)
76+
service-password: $(echo -n $skyline_service_password | base64 -w0)
77+
service-domain: $(echo -n "service" | base64)
78+
service-project: $(echo -n "service" | base64)
79+
service-project-domain: $(echo -n "service" | base64)
80+
db-endpoint: $(echo -n "mariadb-cluster-primary.openstack.svc.cluster.local" | base64 -w0)
81+
db-name: $(echo -n "skyline" | base64)
82+
db-username: $(echo -n "skyline" | base64)
83+
db-password: $(echo -n $skyline_db_password | base64 -w0)
84+
secret-key: $(echo -n $skyline_secret_key_password | base64 -w0)
85+
keystone-endpoint: $(echo -n "http://keystone-api.openstack.svc.cluster.local:5000/v3" | base64 -w0)
86+
keystone-username: $(echo -n "skyline" | base64)
87+
default-region: $(echo -n "$region" | base64)
88+
prometheus_basic_auth_password: $(echo -n "" | base64)
89+
prometheus_basic_auth_user: $(echo -n "" | base64)
90+
prometheus_enable_basic_auth: $(echo -n "false" | base64)
91+
prometheus_endpoint: $(echo -n "http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090" | base64 -w0)"
92+
93+
# Write to skylinesecrets.yaml
94+
echo "$SKYLINE_SECRET_CONTENT" > ${SKYLINE_SECRETS_FILE}
95+
chmod 0640 ${SKYLINE_SECRETS_FILE}
96+
echo "Created ${SKYLINE_SECRETS_FILE}"
97+
98+
# Check if skyline section already exists in kubesecrets.yaml
99+
if grep -q "name: skyline-apiserver-secrets" ${OUTPUT_FILE}; then
100+
echo "Warning: skyline-apiserver-secrets already exists in ${OUTPUT_FILE}"
101+
echo " This suggests skylinesecrets.yaml was previously generated."
102+
echo " Aborting to prevent duplicate entries."
103+
exit 1
104+
fi
105+
106+
# Append to kubesecrets.yaml
107+
echo "$SKYLINE_SECRET_CONTENT" >> $OUTPUT_FILE
108+
109+
echo "Skyline secret appended to ${OUTPUT_FILE}"
110+
echo ""
111+
echo "✓ Successfully created ${SKYLINE_SECRETS_FILE}"
112+
echo "✓ Successfully appended skyline secret to ${OUTPUT_FILE}"
113+
echo ""
114+
echo "IMPORTANT: Keep ${SKYLINE_SECRETS_FILE} safe!"
115+
echo " It will be used to preserve skyline secret when regenerating ${OUTPUT_FILE}"

‎docs/openstack-skyline.md‎

Lines changed: 58 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,67 @@ OpenStack Skyline is the next-generation web-based dashboard designed to provide
44

55
## Create secrets
66

7-
!!! note "Information about the secretes used"
8-
9-
Manual secret generation is only required if you haven't run the `create-secrets.sh` script located in `/opt/genestack/bin`.
10-
11-
??? example "Example secret generation"
12-
13-
Skyline is a little different because there's no helm integration. Given this difference the deployment is far simpler, and all secrets
14-
can be managed in one object.
15-
16-
``` shell
17-
kubectl --namespace openstack \
18-
create secret generic skyline-apiserver-secrets \
19-
--type Opaque \
20-
--from-literal=service-username="skyline" \
21-
--from-literal=service-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
22-
--from-literal=service-domain="service" \
23-
--from-literal=service-project="service" \
24-
--from-literal=service-project-domain="service" \
25-
--from-literal=db-endpoint="mariadb-cluster-primary.openstack.svc.cluster.local" \
26-
--from-literal=db-name="skyline" \
27-
--from-literal=db-username="skyline" \
28-
--from-literal=db-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
29-
--from-literal=secret-key="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
30-
--from-literal=keystone-endpoint="$(kubectl --namespace openstack get secret keystone-keystone-admin -o jsonpath='{.data.OS_AUTH_URL}' | base64 -d)" \
31-
--from-literal=keystone-username="skyline" \
32-
--from-literal=default-region="RegionOne" \
33-
--from-literal=prometheus_basic_auth_password="" \
34-
--from-literal=prometheus_basic_auth_user="" \
35-
--from-literal=prometheus_enable_basic_auth="false" \
36-
--from-literal=prometheus_endpoint="http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090"
37-
```
7+
Skyline secret can be generated using the `create-skyline-secrets.sh` script located in `/opt/genestack/bin`. This script integrates with the `create-secrets.sh` workflow and handles all secret generation.
8+
9+
``` shell
10+
# Generate Skyline secrets with default region (RegionOne)
11+
/opt/genestack/bin/create-skyline-secrets.sh
12+
```
13+
14+
The script will:
15+
16+
- Generate secure random passwords for the Skyline service
17+
- Create `/etc/genestack/skylinesecrets.yaml` with the Skyline-specific secret
18+
- Append the secret to `/etc/genestack/kubesecrets.yaml` for integration with the main workflow
19+
- Perform safety checks to prevent duplicate secret generation
20+
- Ensure the `kubesecrets.yaml` file exists before proceeding
21+
22+
!!! warning "Prerequisites"
23+
24+
The `create-skyline-secrets.sh` script requires that `/etc/genestack/kubesecrets.yaml` already exists. Run the `create-secrets.sh` script first if you haven't already.
25+
26+
27+
### Enable Federation (use Keystone public endpoint)
28+
29+
If you plan to enable federation in Skyline, ensure the Keystone endpoint used for secrets is the public endpoint (not the internal cluster service).
3830

3931
!!! note
4032

41-
All the configuration is in this one secret, so be sure to set your entries accordingly.
33+
Edit `/opt/genestack/bin/create-skyline-secrets.sh` and set the `keystone-endpoint` value to your public Keystone URL (for example, `https://keystone.example.com/v3`). Then run the script:
34+
35+
``` shell
36+
/opt/genestack/bin/create-skyline-secrets.sh
37+
```
38+
39+
40+
### Manual Secret Generation (Alternative)
41+
42+
Manual secret generation is only required if you haven't run the `create-skyline-secrets.sh` script located in `/opt/genestack/bin`.
43+
44+
??? example "Manual secret generation"
45+
46+
``` shell
47+
kubectl --namespace openstack \
48+
create secret generic skyline-apiserver-secrets \
49+
--type Opaque \
50+
--from-literal=service-username="skyline" \
51+
--from-literal=service-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
52+
--from-literal=service-domain="service" \
53+
--from-literal=service-project="service" \
54+
--from-literal=service-project-domain="service" \
55+
--from-literal=db-endpoint="mariadb-cluster-primary.openstack.svc.cluster.local" \
56+
--from-literal=db-name="skyline" \
57+
--from-literal=db-username="skyline" \
58+
--from-literal=db-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
59+
--from-literal=secret-key="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
60+
--from-literal=keystone-endpoint="http://keystone-api.openstack.svc.cluster.local:5000/v3" \
61+
--from-literal=keystone-username="skyline" \
62+
--from-literal=default-region="RegionOne" \
63+
--from-literal=prometheus_basic_auth_password="" \
64+
--from-literal=prometheus_basic_auth_user="" \
65+
--from-literal=prometheus_enable_basic_auth="false" \
66+
--from-literal=prometheus_endpoint="http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090"
67+
```
4268

4369
## Run the deployment
4470

0 commit comments

Comments
 (0)