Issue 280: Read InfluxDB credentials from a secret

deploy/crds/pravega.pravega.io_pravegaclusters_crd.yaml

@@ -2186,6 +2186,10 @@ spec:
                       repository:
                         type: string
                     type: object
+                  influxDBSecret:
+                    description: Name of Secret containing Password based Authentication
+                      Parameters like username, password
+                    type: string
                   longtermStorage:
                     description: LongTermStorage is the configuration of Pravega's
                       tier 2 storage. If no configuration is provided, it will assume

doc/configuration.md

@@ -17,3 +17,4 @@ This document explains how to configure Pravega
 * [Configuring Service and Sts Names](service-sts-name-configuration.md)
 * [Enable AuthHandlers](auth-handlers.md)
 * [Init Containers Usage](init-containers.md)
+* [Enable InfluxDB Authentication](influxdb-auth.md)

doc/influxdb-auth.md

@@ -0,0 +1,24 @@
+# Enable InfluxDB Authentication
+
+Operator supports passing influxdb credentials as secret. It is the recommended approach rather than passing username/password as part of Pravega options.
+
+Steps to configure influxdb authentication are as follows:
+
+1. Create a secret for basic authentication. Below is the sample yaml file
+
+```
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret-basic-auth
+type: kubernetes.io/basic-auth
+stringData:
+  username: admin
+  password: t0p-Secret
+  ```
+2. Modify the Pravega manifest to include the secret name for influxdb
+
+```
+influxDBSecret: "secret-basic-auth"
+```
+3. Once Pravega is deployed, secret will be mounted in `/etc/influxdb-secret-volume`  for controller and segment store pods.

pkg/apis/pravega/v1beta1/pravega.go

@@ -228,6 +228,9 @@ type PravegaSpec struct {
 
 	// Details of authplugin to be copied into pravega controller
 	AuthImplementations *AuthImplementationSpec `json:"authImplementations,omitempty"`
+
+	// Name of Secret containing Password based Authentication Parameters like username, password
+	InfluxDBSecret string `json:"influxDBSecret,omitempty"`
 }
 
 func (s *PravegaSpec) withDefaults() (changed bool) {

pkg/controller/pravega/constants.go

@@ -28,4 +28,6 @@ const (
 	ssAuthVolumeName         = "ss-auth-secret"
 	controllerAuthMountDir   = "/etc/controller-auth-volume"
 	ssAuthMountDir           = "/etc/ss-auth-volume"
+	influxDBSecretVolumeName = "influxdb-secret"
+	influxDBSecretMountDir   = "/etc/influxdb-secret-volume"
 )

pkg/controller/pravega/pravega_controller.go

@@ -253,6 +253,7 @@ func makeControllerPodSpec(p *api.PravegaCluster) *corev1.PodSpec {
 	configureControllerTLSSecrets(podSpec, p)
 	configureAuthSecrets(podSpec, p)
 	configureControllerAuthSecrets(podSpec, p)
+	configureControllerInfluxDBSecrets(podSpec, p)
 	return podSpec
 }
 
@@ -276,6 +277,20 @@ func configureControllerAuthSecrets(podSpec *corev1.PodSpec, p *api.PravegaClust
 	}
 }
 
+func configureControllerInfluxDBSecrets(podSpec *corev1.PodSpec, p *api.PravegaCluster) {
+	if p.Spec.Pravega.InfluxDBSecret != "" {
+		addSecretVolumeWithMount(podSpec, p, influxDBSecretVolumeName, p.Spec.Pravega.InfluxDBSecret,
+			influxDBSecretVolumeName, influxDBSecretMountDir)
+
+		podSpec.Containers[0].Env = []corev1.EnvVar{
+			{
+				Name:  "INFLUX_DB_SECRET_MOUNT_PATH",
+				Value: influxDBSecretMountDir,
+			},
+		}
+	}
+}
+
 func addSecretVolumeWithMount(podSpec *corev1.PodSpec, p *api.PravegaCluster,
 	volumeName string, secretName string,
 	mountName string, mountDir string) {

pkg/controller/pravega/pravega_controller_test.go

@@ -87,6 +87,7 @@ var _ = Describe("Controller", func() {
 						ControllerPodAnnotations:       annotationsMap,
 						SegmentStoreServiceAnnotations: annotationsMap,
 						SegmentStorePodLabels:          annotationsMap,
+						InfluxDBSecret:                 "influxdb-secret",
 						Image: &v1beta1.ImageSpec{
 							Repository: "bar/pravega",
 						},
@@ -181,6 +182,11 @@ var _ = Describe("Controller", func() {
 
 				})
 
+				It("should have VolumeMounts created for influxdb secret", func() {
+					deploy := pravega.MakeControllerPodTemplate(p)
+					mounthostpath := deploy.Spec.Containers[0].VolumeMounts[9].MountPath
+					Ω(mounthostpath).Should(Equal("/etc/influxdb-secret-volume"))
+				})
 				It("should create the service", func() {
 					svc := pravega.MakeControllerService(p)
 					Ω(svc.Spec.Type).To(Equal(corev1.ServiceTypeClusterIP))

pkg/controller/pravega/pravega_segmentstore.go

@@ -74,6 +74,7 @@ func MakeSegmentStorePodTemplate(p *api.PravegaCluster) corev1.PodTemplateSpec {
 func makeSegmentstorePodSpec(p *api.PravegaCluster) corev1.PodSpec {
 	configMapName := strings.TrimSpace(p.Spec.Pravega.SegmentStoreEnvVars)
 	secret := p.Spec.Pravega.SegmentStoreSecret
+
 	environment := []corev1.EnvFromSource{
 		{
 			ConfigMapRef: &corev1.ConfigMapEnvSource{
@@ -263,6 +264,8 @@ func makeSegmentstorePodSpec(p *api.PravegaCluster) corev1.PodSpec {
 
 	configureSegmentstoreAuthSecret(&podSpec, p)
 
+	configureInfluxDBSecret(&podSpec, p)
+
 	return podSpec
 }
 
@@ -471,6 +474,30 @@ func configureCaBundleSecret(podSpec *corev1.PodSpec, p *api.PravegaCluster) {
 	}
 }
 
+func configureInfluxDBSecret(podSpec *corev1.PodSpec, p *api.PravegaCluster) {
+	if p.Spec.Pravega.InfluxDBSecret != "" {
+		vol := corev1.Volume{
+			Name: influxDBSecretVolumeName,
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName: p.Spec.Pravega.InfluxDBSecret,
+				},
+			},
+		}
+		podSpec.Volumes = append(podSpec.Volumes, vol)
+
+		podSpec.Containers[0].VolumeMounts = append(podSpec.Containers[0].VolumeMounts, corev1.VolumeMount{
+			Name:      influxDBSecretVolumeName,
+			MountPath: influxDBSecretMountDir,
+		})
+
+		podSpec.Containers[0].Env = append(podSpec.Containers[0].Env, corev1.EnvVar{
+			Name:  "INFLUX_DB_SECRET_MOUNT_PATH",
+			Value: influxDBSecretMountDir,
+		})
+	}
+}
+
 func MakeSegmentStoreHeadlessService(p *api.PravegaCluster) *corev1.Service {
 	serviceport, _ := strconv.Atoi(p.Spec.Pravega.Options["pravegaservice.service.listener.port"])
 	return &corev1.Service{

pkg/controller/pravega/pravega_segmentstore_test.go

@@ -87,6 +87,7 @@ var _ = Describe("PravegaSegmentstore", func() {
 						SegmentStorePodLabels:          annotationsMap,
 						SegmentStorePodAnnotations:     annotationsMap,
 						SegmentStoreEnvVars:            "SEG_CONFIG_MAP",
+						InfluxDBSecret:                 "influxdb-secret",
 						SegmentStoreSecret: &v1beta1.SegmentStoreSecret{
 							Secret:    "seg-secret",
 							MountPath: "",
@@ -120,8 +121,9 @@ var _ = Describe("PravegaSegmentstore", func() {
 						},
 					},
 					Authentication: &v1beta1.AuthenticationParameters{
-						Enabled:            true,
-						PasswordAuthSecret: "authentication-secret",
+						Enabled:                 true,
+						PasswordAuthSecret:      "authentication-secret",
+						SegmentStoreTokenSecret: "segment-store-secret",
 					},
 				}
 				p.WithDefaults()
@@ -187,6 +189,8 @@ var _ = Describe("PravegaSegmentstore", func() {
 					Ω(mounthostpath3).Should(Equal("/opt/pravega/logs"))
 					mounthostpath4 := sts.Spec.Template.Spec.Containers[0].VolumeMounts[4].MountPath
 					Ω(mounthostpath4).Should(Equal("/opt/pravega/conf/logback.xml"))
+					mounthostpath5 := sts.Spec.Template.Spec.Containers[0].VolumeMounts[9].MountPath
+					Ω(mounthostpath5).Should(Equal("/etc/influxdb-secret-volume"))
 					Ω(err).Should(BeNil())
 				})
 
@@ -315,11 +319,14 @@ var _ = Describe("PravegaSegmentstore", func() {
 					Ω(strings.Contains(javaOpts, "-Dpravegaservice.service.listener.port=443")).Should(BeTrue())
 					Ω(err).Should(BeNil())
 				})
-
+				It("should create a stateful set with filesystem as longtermstorage", func() {
+					sts := pravega.MakeSegmentStoreStatefulSet(p)
+					mounthostpath0 := sts.Spec.Template.Spec.Containers[0].VolumeMounts[4].MountPath
+					Ω(mounthostpath0).Should(Equal("/mnt/tier2"))
+				})
 				It("should set external access service type to LoadBalancer", func() {
 					Ω(p.Spec.ExternalAccess.Type).Should(Equal(corev1.ServiceTypeClusterIP))
 				})
-
 			})
 		})
 
@@ -362,6 +369,10 @@ var _ = Describe("PravegaSegmentstore", func() {
 						SegmentStoreServiceAnnotations:  annotationsMap,
 						SegmentStorePodLabels:           annotationsMap,
 						SegmentStoreExternalServiceType: corev1.ServiceTypeLoadBalancer,
+						SegmentStoreSecret: &v1beta1.SegmentStoreSecret{
+							Secret:    "seg-secret",
+							MountPath: "/tmp/mount",
+						},
 						Image: &v1beta1.ImageSpec{
 							Repository: "bar/pravega",
 						},

test/e2e/resources/crd.yaml

@@ -2188,6 +2188,10 @@ spec:
                       repository:
                         type: string
                     type: object
+                  influxDBSecret:
+                    description: Name of Secret containing Password based Authentication
+                      Parameters like username, password
+                    type: string
                   longtermStorage:
                     description: LongTermStorage is the configuration of Pravega's
                       tier 2 storage. If no configuration is provided, it will assume