local deploy without secrets

davdhacs · davdhacs · commit 81ceef61e1fc · 2025-12-06T09:06:32.000-07:00
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
@@ -116,6 +116,12 @@ Use the environment variable `TEST_MODE` to disable certain infra service behavi
 
 This is used in the infra PR clusters to set the login referer and disable telemetry.
 
+#### Deployments for testing only (no secrets)
+
+For test clusters (such as a local KinD/Colima), you can use the deploy-local make target to skip loading secrets. The flavor provisioning actions that require secrets will no be accessible, and integrations such as with Slack will be disabled.
+
+`make deploy-local`
+
 ### Rollback
 
 Use `helm rollback infra-server <REVISION>`.
diff --git a/Makefile b/Makefile
@@ -253,6 +253,10 @@ helm-deploy: pre-check helm-dependency-update create-namespaces
 helm-diff: pre-check helm-dependency-update create-namespaces
 	@./scripts/deploy/helm.sh diff $(VERSION) $(ENVIRONMENT) $(SECRET_VERSION)
 
+## Deploy to local cluster (e.g., Colima) without GCP Secret Manager
+.PHONY: deploy-local
+deploy-local: helm-dependency-update create-namespaces
+	TEST_MODE=true ./scripts/deploy/helm.sh deploy-local $(shell make tag) local
 ## Bounce pods
 .PHONY: bounce-infra-pods
 bounce-infra-pods:
diff --git a/chart/infra-server/configuration/local-values.yaml b/chart/infra-server/configuration/local-values.yaml
@@ -0,0 +1,33 @@
+environment: local
+
+# Disable Auth0 for local development - allow anonymous access
+auth0:
+  clientID: ""
+  tenant: ""
+
+# Set local deploy mode to true for local development
+localDeploy: true
+
+# Enable test mode for faster cluster resume intervals
+testMode: true
+
+# Use local Docker images instead of pulling from registry
+imagePullPolicy: Never
+
+# Pull secrets for container registries - dummy values for local development
+pullSecrets:
+  docker:
+    registry: "docker.io"
+    username: "dummy"
+    password: "dummy"
+  quay:
+    registry: "quay.io"
+    username: "dummy"
+    password: "dummy"
+  stackrox:
+    registry: "stackrox.io"
+    username: "dummy"
+    password: "dummy"
+
+# Alertmanager configuration
+alertmanagerSlackTeam: "dummy-team"
diff --git a/chart/infra-server/templates/argo/secrets.yaml b/chart/infra-server/templates/argo/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -7,3 +8,4 @@ metadata:
 data:
   credentials.json: |-
     {{ required ".Values.google_credentials_json is undefined" .Values.google_credentials_json }}
+{{- end }}
diff --git a/chart/infra-server/templates/aro/secrets.yaml b/chart/infra-server/templates/aro/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -16,3 +17,4 @@ data:
     {{ .Values.aroClusterManager.azureSPSecretVal | b64enc }}
   REDHAT_PULL_SECRET_BASE64: |-
     {{ .Values.aroClusterManager.redHatPullSecretBase64 | b64enc }}
+{{- end }}
diff --git a/chart/infra-server/templates/aws/secrets.yaml b/chart/infra-server/templates/aws/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -10,3 +11,4 @@ data:
     {{ .Values.aws.accessKeyId | b64enc }}
   AWS_SECRET_ACCESS_KEY: |-
     {{ .Values.aws.secretAccessKey | b64enc }}
+{{- end }}
diff --git a/chart/infra-server/templates/azure/secrets.yaml b/chart/infra-server/templates/azure/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 
 ---
 
@@ -18,3 +19,4 @@ data:
     {{ .Values.azure.sp_tenant | b64enc }}
   ACR_TO_ATTACH: |-
     {{ .Values.azure.aks_attached_acr | b64enc }}
+{{- end }}
diff --git a/chart/infra-server/templates/demo/secrets.yaml b/chart/infra-server/templates/demo/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 
 apiVersion: v1
@@ -90,3 +91,4 @@ data:
   .dockerconfigjson: {{ template "pull-secret" .Values.pullSecrets.quay }}
 
 ---
+{{- end }}
diff --git a/chart/infra-server/templates/deployment.yaml b/chart/infra-server/templates/deployment.yaml
@@ -27,8 +27,12 @@ spec:
         - name: infra-server
           image: quay.io/rhacs-eng/infra-server:{{ required "A valid .Values.tag entry is required!" .Values.tag }}
           env:
+{{- if not .Values.localDeploy }}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /configuration/google-credentials.json
+{{- end }}
+            - name: LOCAL_DEPLOY
+              value: "{{ .Values.localDeploy }}"
             - name: TEST_MODE
               value: "{{ .Values.testMode }}"
           readinessProbe:
@@ -47,7 +51,7 @@ spec:
               containerPort: 8443
             - name: metrics
               containerPort: 9101
-          imagePullPolicy: Always
+          imagePullPolicy: {{ .Values.imagePullPolicy | default "Always" }}
           volumeMounts:
             - mountPath: /configuration
               name: configuration
diff --git a/chart/infra-server/templates/gke/secrets.yaml b/chart/infra-server/templates/gke/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 
 apiVersion: v1
@@ -13,3 +14,4 @@ data:
     {{ required ".Values.gke__gke_provisioner_json is undefined" .Values.gke__gke_provisioner_json }}
 
 ---
+{{- end }}
diff --git a/chart/infra-server/templates/ibm/secrets.yaml b/chart/infra-server/templates/ibm/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -8,3 +9,4 @@ metadata:
 data:
   IBM_ROKS_API_KEY: |-
     {{ .Values.ibmCloudSecrets.ibmRoksApiKey | b64enc }}
+{{- end }}
diff --git a/chart/infra-server/templates/monitoring/secrets.yaml b/chart/infra-server/templates/monitoring/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -6,3 +7,4 @@ metadata:
   namespace: monitoring
 data:
   webhookURL: "{{ .Values.alertmanagerSlackWebhook | b64enc }}"
+{{- end }}
diff --git a/chart/infra-server/templates/openshift-4/secrets.yaml b/chart/infra-server/templates/openshift-4/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 apiVersion: v1
 kind: Secret
 type: Opaque
@@ -43,3 +44,4 @@ metadata:
 data:
   REDHAT_PULL_SECRET: |-
     {{ required ".Values.openshift_4__redhat_pull_secret_json is undefined" .Values.openshift_4__redhat_pull_secret_json }}
+{{- end }}
diff --git a/chart/infra-server/templates/openshift/secrets.yaml b/chart/infra-server/templates/openshift/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 apiVersion: v1
 kind: Secret
 type: Opaque
@@ -9,3 +10,4 @@ metadata:
 data:
   google-credentials.json: |-
     {{ required ".Values.openshift__google_credentials_json is undefined" .Values.openshift__google_credentials_json }}
+{{- end }}
diff --git a/chart/infra-server/templates/osd/secrets.yaml b/chart/infra-server/templates/osd/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 ---
 apiVersion: v1
 kind: Secret
@@ -19,3 +20,4 @@ data:
     {{ .Values.osdClusterManager.gcpSaCredsJsonBase64 | b64enc }}
   GCP_SERVICE_ACCOUNT_KEY_BASE64: |-
     {{ .Values.osdClusterManager.gcpServiceAccountKeyBase64 | b64enc }}
+{{- end }}
diff --git a/chart/infra-server/templates/secrets.yaml b/chart/infra-server/templates/secrets.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.localDeploy }}
 apiVersion: v1
 kind: Secret
 
@@ -112,3 +113,119 @@ metadata:
 
 data:
   .dockerconfigjson: {{ template "pull-secret" .Values.pullSecrets.quay }}
+{{- end }}
+
+{{- if .Values.localDeploy }}
+---
+apiVersion: v1
+kind: Secret
+
+metadata:
+  name: infra-server-secrets
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: infra-server
+
+data:
+  # Minimal config for LOCAL_DEPLOY mode
+  infra.yaml: {{ printf "server:\n  port: 8443\n  cert: /configuration/cert.pem\n  key: /configuration/key.pem\n  static: /etc/infra/static\n  metricsPort: 9101" | b64enc }}
+
+  # Minimal OIDC config - uses Google as a valid issuer for initialization
+  oidc.yaml: {{ printf "issuer: https://accounts.google.com\nclientID: dummy\nclientSecret: dummy\nendpoint: localhost:8443\nsessionSecret: local-dev-secret-min-32-chars-long\ntokenLifetime: 24h" | b64enc }}
+
+  # Empty Google credentials - not used in LOCAL_DEPLOY mode
+  google-credentials.json: {{ "{}" | b64enc }}
+
+  # Empty BigQuery credentials - not used in LOCAL_DEPLOY mode
+  bigquery-sa.json: {{ "{}" | b64enc }}
+
+  # Self-signed TLS certificate for local development
+  cert.pem: {{ .Files.Get "configuration/local-cert.pem" | b64enc }}
+
+  # Self-signed TLS private key for local development
+  key.pem: {{ .Files.Get "configuration/local-key.pem" | b64enc }}
+
+  # Flavors and all workflows needed by flavors.yaml
+  flavors.yaml: |-
+    {{- tpl (.Files.Get "static/flavors.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-gke-default.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-gke-default.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-demo.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-demo.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-qa-demo.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-qa-demo.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-4.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-4.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-4-demo.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-4-demo.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-eks.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-eks.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-aks.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-aks.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-aro.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-aro.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-rosa.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-rosa.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-rosa-hcp.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-rosa-hcp.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-openshift-ibmroks.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-openshift-ibmroks.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-osd-aws.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-osd-aws.yaml" ) . | b64enc | nindent 4 }}
+
+  workflow-osd-gcp.yaml: |-
+    {{- tpl (.Files.Get "static/workflow-osd-gcp.yaml" ) . | b64enc | nindent 4 }}
+
+  # Janitor (cleanup) workflows
+  janitor-delete-gke-default.yaml: |-
+    {{- tpl (.Files.Get "static/janitor-delete-gke-default.yaml" ) . | b64enc | nindent 4 }}
+
+  janitor-delete-openshift-4.yaml: |-
+    {{- tpl (.Files.Get "static/janitor-delete-openshift-4.yaml" ) . | b64enc | nindent 4 }}
+
+  janitor-delete-openshift-rosa.yaml: |-
+    {{- tpl (.Files.Get "static/janitor-delete-openshift-rosa.yaml" ) . | b64enc | nindent 4 }}
+
+  # Test workflows (for non-production environments)
+  test-url-artifact.yaml: |-
+    {{- tpl (.Files.Get "static/test-url-artifact.yaml" ) . | b64enc | nindent 4 }}
+
+  test-connect-artifact.yaml: |-
+    {{- tpl (.Files.Get "static/test-connect-artifact.yaml" ) . | b64enc | nindent 4 }}
+
+  test-gke-lite.yaml: |-
+    {{- tpl (.Files.Get "static/test-gke-lite.yaml" ) . | b64enc | nindent 4 }}
+
+  test-qa-demo.yaml: |-
+    {{- tpl (.Files.Get "static/test-qa-demo.yaml" ) . | b64enc | nindent 4 }}
+
+  test-simulate.yaml: |-
+    {{- tpl (.Files.Get "static/test-simulate.yaml" ) . | b64enc | nindent 4 }}
+
+  test-janitor-delete.yaml: |-
+    {{- tpl (.Files.Get "static/test-janitor-delete.yaml" ) . | b64enc | nindent 4 }}
+
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+
+metadata:
+  name: infra-image-registry-pull-secret
+  namespace: infra
+
+data:
+  .dockerconfigjson: {{ template "pull-secret" .Values.pullSecrets.quay }}
+{{- end }}
diff --git a/pkg/signer/signer.go b/pkg/signer/signer.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"cloud.google.com/go/storage"
+	"github.com/stackrox/infra/pkg/logging"
 	"golang.org/x/oauth2/google"
 	"golang.org/x/oauth2/jwt"
 )
@@ -27,18 +28,23 @@ const (
 	gcsSignedURLLifespan = 10 * time.Minute
 )
 
+var (
+	log = logging.CreateProductionLogger()
+)
+
 // Signer facilitates the generation of signed GCS URLS.
 type Signer struct {
 	cfg    jwt.Config
 	client *storage.Client
 }
 
 // NewFromEnv constructs a Signer from the GOOGLE_APPLICATION_CREDENTIALS set
-// in the working environment.
+// in the working environment. Returns an empty Signer if not configured.
 func NewFromEnv() (*Signer, error) {
 	credentialsFilename, found := os.LookupEnv(googleCredentialsEnvVar)
 	if !found {
-		return nil, fmt.Errorf("environment variable %q was not set", googleCredentialsEnvVar)
+		log.Log(logging.WARN, "GCS signing disabled", "reason", "GOOGLE_APPLICATION_CREDENTIALS not set")
+		return &Signer{}, nil
 	}
 
 	data, err := os.ReadFile(credentialsFilename)
diff --git a/scripts/deploy/helm.sh b/scripts/deploy/helm.sh
