Skip to content

Commit 4293e9f

Browse files
cardoecardoe
authored
Merge pull request #1743 from rackerlabs/nautobot-api-tokens
feat(nautobot-api-tokens): add new chart to manage Nautbot API tokens
2 parents 1a0e48c + 85038c7 commit 4293e9f

15 files changed

Lines changed: 823 additions & 2 deletions

‎.github/workflows/helm-chart-test.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,14 @@ jobs:
8888
run: |
8989
./bootstrap/argocd.sh
9090
91-
- name: install argocd-understack
91+
- name: Install argocd-understack
9292
if: steps.list-changed.outputs.argocd-understack == 'true'
9393
run: helm install testsite charts/argocd-understack --namespace argocd --values charts/argocd-understack/ci/example.yaml
94+
95+
- name: Install nautobot-api-tokens
96+
if: steps.list-changed.outputs.nautobot-api-tokens == 'true'
97+
run: |
98+
helm install nautobot-api-tokens-test charts/nautobot-api-tokens \
99+
--namespace nautobot \
100+
--create-namespace \
101+
--values charts/nautobot-api-tokens/ci/example.yaml

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ repos:
1212
- id: check-yaml
1313
args:
1414
- --allow-multiple-documents
15-
exclude: "mkdocs.yml|^charts/argocd-understack/templates/"
15+
exclude: "mkdocs.yml|^charts/.*/templates/"
1616
- id: check-yaml
1717
name: check-yaml-mkdocs
1818
# --unsafe is a workaround for the use of !! in mkdocs.yml

‎.yamllint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ extends: default
33
ignore:
44
- components/etcdbackup/templates/
55
- charts/argocd-understack/templates/
6+
- charts/nautobot-api-tokens/templates/
67

78
rules:
89
comments:

‎charts/argocd-understack/templates/application-nautobot-api-tokens.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{{- if eq (include "understack.isEnabled" (list $.Values.global "nautobot_api_tokens")) "true" }}
2+
---
3+
apiVersion: argoproj.io/v1alpha1
4+
kind: Application
5+
metadata:
6+
name: {{ printf "%s-%s" $.Release.Name "nautobot-api-tokens" }}
7+
finalizers:
8+
- resources-finalizer.argocd.argoproj.io
9+
annotations:
10+
argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
11+
spec:
12+
destination:
13+
namespace: nautobot
14+
server: {{ $.Values.cluster_server }}
15+
project: understack
16+
sources:
17+
- repoURL: {{ include "understack.understack_url" $ }}
18+
targetRevision: {{ include "understack.understack_ref" $ }}
19+
path: charts/nautobot-api-tokens
20+
helm:
21+
ignoreMissingValueFiles: true
22+
valueFiles:
23+
- $deploy/{{ include "understack.deploy_path" $ }}/nautobot-api-tokens/values.yaml
24+
- path: {{ include "understack.deploy_path" $ }}/nautobot-api-tokens
25+
ref: deploy
26+
repoURL: {{ include "understack.deploy_url" $ }}
27+
targetRevision: {{ include "understack.deploy_ref" $ }}
28+
syncPolicy:
29+
automated:
30+
prune: true
31+
selfHeal: true
32+
syncOptions:
33+
- ServerSideApply=true
34+
- RespectIgnoreDifferences=true
35+
- ApplyOutOfSyncOnly=true
36+
{{- end }}

‎charts/argocd-understack/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,12 @@ global:
129129
# @default -- false
130130
enabled: false
131131

132+
# -- Nautobot API token generation jobs
133+
nautobot_api_tokens:
134+
# -- Enable/disable deploying
135+
# @default -- false
136+
enabled: false
137+
132138
# -- Nautobot Operator for Kubernetes
133139
nautobotop:
134140
# -- Enable/disable deploying Nautobot Operator

‎charts/nautobot-api-tokens/Chart.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v2
2+
name: nautobot-api-tokens
3+
description: Bootstrap Nautobot users and API tokens from Kubernetes Secret references
4+
5+
type: application
6+
7+
version: 0.1.0
8+
# renovate: datasource=docker depName=networktocode/nautobot versioning=semver
9+
appVersion: "3.0.7"
10+
11+
maintainers:
12+
- name: rackerlabs

‎charts/nautobot-api-tokens/README.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# nautobot-api-tokens
2+
3+
Helm chart that manages Nautobot users and API tokens from Kubernetes Secret references.
4+
5+
## Behavior
6+
7+
- Renders one Argo CD hook `Job` per entry in `values.yaml` `tokens[]`.
8+
- Renders one additional Argo CD hook `Job` that cleans up stale managed tokens.
9+
- Each job runs `nautobot-server shell --interface python` using a mounted managed script.
10+
- User and token reconciliation is idempotent:
11+
- create user if missing
12+
- update email/password/flags if changed
13+
- ensure group membership for managed users
14+
- create token if missing
15+
- update token key if changed
16+
- Managed tokens are stamped with `Token.description` prefix `nautobot-api-token-managed:`.
17+
- Cleanup job removes managed tokens that are no longer present in `tokens[]`.
18+
- Cleanup job can also delete users in `cleanup.groupName` when they have no desired managed tokens.
19+
20+
## Image behavior
21+
22+
- Default image is upstream Nautobot.
23+
- Default tag comes from chart `appVersion` (currently `3.0.7`).
24+
- You can override image repository/tag/pullPolicy in values.
25+
26+
## Config behavior
27+
28+
- `nautobot.configPath` is optional.
29+
- If set, chart injects `NAUTOBOT_CONFIG`.
30+
- If unset/empty, container default config behavior is used.
31+
- `nautobot.dbPasswordSecretRef` configures the Secret `name`/`key` used to inject `NAUTOBOT_DB_PASSWORD`.
32+
33+
## Example values
34+
35+
```yaml
36+
image:
37+
repository: ghcr.io/nautobot/nautobot
38+
tag: "3.0.7"
39+
pullPolicy: IfNotPresent
40+
41+
nautobot:
42+
configPath: ""
43+
dbPasswordSecretRef:
44+
name: nautobot-env
45+
key: NAUTOBOT_DB_PASSWORD
46+
47+
cleanup:
48+
groupName: nautobot-api-token-managed
49+
deleteUserWhenNoManagedTokens: true
50+
51+
tokens:
52+
- name: inventory-client
53+
sourceSecretRef:
54+
name: nautobot-token-inventory
55+
keys:
56+
username: username
57+
email: email
58+
password: password
59+
apiToken: apiToken
60+
user:
61+
isSuperuser: false
62+
63+
- name: automation-client
64+
sourceSecretRef:
65+
name: nautobot-token-automation
66+
keys:
67+
username: username
68+
email: email
69+
password: password
70+
apiToken: apiToken
71+
```
72+
73+
## Install
74+
75+
```bash
76+
helm upgrade --install nautobot-api-tokens ./charts/nautobot-api-tokens -n nautobot
77+
```

‎charts/nautobot-api-tokens/ci/example.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
image:
2+
repository: ghcr.io/nautobot/nautobot
3+
tag: "3.0.7"
4+
5+
tokens:
6+
- name: inventory-client
7+
sourceSecretRef:
8+
name: nautobot-token-inventory
9+
keys:
10+
username: username
11+
email: email
12+
password: password
13+
apiToken: apiToken
14+
user:
15+
isSuperuser: false

‎charts/nautobot-api-tokens/templates/_helpers.tpl‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{{/* Expand the name of the chart. */}}
2+
{{- define "nautobot-api-tokens.name" -}}
3+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
4+
{{- end }}
5+
6+
{{/* Create a default fully qualified app name. */}}
7+
{{- define "nautobot-api-tokens.fullname" -}}
8+
{{- if .Values.fullnameOverride }}
9+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
10+
{{- else }}
11+
{{- $name := default .Chart.Name .Values.nameOverride }}
12+
{{- if contains $name .Release.Name }}
13+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
16+
{{- end }}
17+
{{- end }}
18+
{{- end }}
19+
20+
{{/* Chart label value. */}}
21+
{{- define "nautobot-api-tokens.chart" -}}
22+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
23+
{{- end }}
24+
25+
{{/* Common labels. */}}
26+
{{- define "nautobot-api-tokens.labels" -}}
27+
helm.sh/chart: {{ include "nautobot-api-tokens.chart" . }}
28+
{{ include "nautobot-api-tokens.selectorLabels" . }}
29+
{{- if .Chart.AppVersion }}
30+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
31+
{{- end }}
32+
app.kubernetes.io/managed-by: {{ .Release.Service }}
33+
{{- end }}
34+
35+
{{/* Selector labels. */}}
36+
{{- define "nautobot-api-tokens.selectorLabels" -}}
37+
app.kubernetes.io/name: {{ include "nautobot-api-tokens.name" . }}
38+
app.kubernetes.io/instance: {{ .Release.Name }}
39+
{{- end }}
40+
41+
{{/* Script config map name. */}}
42+
{{- define "nautobot-api-tokens.scriptConfigMapName" -}}
43+
{{- if .Values.scriptConfigMapName }}
44+
{{- .Values.scriptConfigMapName | trunc 63 | trimSuffix "-" -}}
45+
{{- else -}}
46+
{{- printf "%s-script" (include "nautobot-api-tokens.fullname" .) | trunc 63 | trimSuffix "-" -}}
47+
{{- end -}}
48+
{{- end }}
49+
50+
{{/* Desired token names config map name. */}}
51+
{{- define "nautobot-api-tokens.desiredConfigMapName" -}}
52+
{{- printf "%s-desired" (include "nautobot-api-tokens.fullname" .) | trunc 63 | trimSuffix "-" -}}
53+
{{- end }}
54+
55+
{{/* Per-token job name. */}}
56+
{{- define "nautobot-api-tokens.jobName" -}}
57+
{{- $root := index . 0 -}}
58+
{{- $token := index . 1 -}}
59+
{{- printf "%s-%s" (include "nautobot-api-tokens.fullname" $root) $token.name | trunc 63 | trimSuffix "-" -}}
60+
{{- end }}
61+
62+
{{/* Cleanup job name. */}}
63+
{{- define "nautobot-api-tokens.cleanupJobName" -}}
64+
{{- printf "%s-cleanup" (include "nautobot-api-tokens.fullname" .) | trunc 63 | trimSuffix "-" -}}
65+
{{- end }}

‎charts/nautobot-api-tokens/templates/configmap-desired-tokens.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- $desired := list -}}
2+
{{- range $token := .Values.tokens -}}
3+
{{- if (default true $token.enabled) -}}
4+
{{- $desired = append $desired $token.name -}}
5+
{{- end -}}
6+
{{- end -}}
7+
apiVersion: v1
8+
kind: ConfigMap
9+
metadata:
10+
name: {{ include "nautobot-api-tokens.desiredConfigMapName" . }}
11+
labels:
12+
{{- include "nautobot-api-tokens.labels" . | nindent 4 }}
13+
data:
14+
token-names.json: |
15+
{{ $desired | toJson }}

0 commit comments

Comments
 (0)