From 8dd9ab88ee0d88d3a1e11d9df085d8123edef2cd Mon Sep 17 00:00:00 2001 From: Andrew Mellen Date: Tue, 8 Oct 2019 23:00:41 -0400 Subject: [PATCH 1/4] Make claim token a secret --- charts/kube-plex/README.md | 4 +++- charts/kube-plex/templates/_helpers.tpl | 11 +++++++++++ charts/kube-plex/templates/deployment.yaml | 6 ++++-- charts/kube-plex/templates/secret-claimToken.yaml | 14 ++++++++++++++ charts/kube-plex/values.yaml | 7 ++++++- 5 files changed, 38 insertions(+), 4 deletions(-) create mode 100644 charts/kube-plex/templates/secret-claimToken.yaml diff --git a/charts/kube-plex/README.md b/charts/kube-plex/README.md index 7a505c09..d3f157e4 100644 --- a/charts/kube-plex/README.md +++ b/charts/kube-plex/README.md @@ -13,7 +13,9 @@ The following tables lists the configurable parameters of the Plex chart and the | `kubePlex.image.repository` | Image repository | `quay.io/munnerz/kube-plex` | | `kubePlex.image.tag` | Image tag. | `latest`| | `kubePlex.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `claimToken` | Plex Claim Token to authenticate your acount | `` | +| `claimToken.secret` | Premade secret holding the Plex Claim Token to authenticate your acount. Must set this or `claimToken.value` | `` | +| `claimToken.secretKey` | The key in the above secret that holds the Plex Claim Toke | `claimToken` | +| `claimToken.value` | The plain-text Plex Claim Token. Set this if not using `claimToken.secret` | `` | | `timezone` | Timezone plex instance should run as, e.g. 'America/New_York' | `Europe/London` | | `service.type` | Kubernetes service type for the plex GUI/API | `ClusterIP` | | `service.port` | Kubernetes port where the plex GUI/API is exposed| `32400` | diff --git a/charts/kube-plex/templates/_helpers.tpl b/charts/kube-plex/templates/_helpers.tpl index f0d83d2e..e4f99a18 100644 --- a/charts/kube-plex/templates/_helpers.tpl +++ b/charts/kube-plex/templates/_helpers.tpl @@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- $name := default .Chart.Name .Values.nameOverride -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} + +{{/* +Create the secret name for the claimToken +*/}} +{{- define "claimTokenSecretName" -}} +{{- if .Values.claimToken.secret -}} + {{ printf "%s" .Values.claimToken.secret }} +{{- else -}} + {{ printf "%s-%s" (include "fullname" .) "claim-token" | trunc 63 -}} +{{- end -}} +{{- end -}} diff --git a/charts/kube-plex/templates/deployment.yaml b/charts/kube-plex/templates/deployment.yaml index 2538af95..d3270d0a 100644 --- a/charts/kube-plex/templates/deployment.yaml +++ b/charts/kube-plex/templates/deployment.yaml @@ -83,9 +83,11 @@ spec: env: - name: TZ value: "{{ .Values.timezone }}" - # TODO: move this to a secret? - name: PLEX_CLAIM - value: "{{ .Values.claimToken }}" + valueFrom: + secretKeyRef: + name: {{ template "claimTokenSecretName" . }} + key: {{ .Values.claimToken.secretKey }} # kube-plex env vars - name: PMS_INTERNAL_ADDRESS value: http://{{ template "fullname" . }}:32400 diff --git a/charts/kube-plex/templates/secret-claimToken.yaml b/charts/kube-plex/templates/secret-claimToken.yaml new file mode 100644 index 00000000..2fa49ccb --- /dev/null +++ b/charts/kube-plex/templates/secret-claimToken.yaml @@ -0,0 +1,14 @@ +{{- if not .Values.claimToken.secret -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "claimTokenSecretName" . }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + {{ .Values.claimToken.secretKey }}: {{ .Values.claimToken.value | b64enc | quote }} +{{- end -}} diff --git a/charts/kube-plex/values.yaml b/charts/kube-plex/values.yaml index 49c3f090..5bafd4a2 100644 --- a/charts/kube-plex/values.yaml +++ b/charts/kube-plex/values.yaml @@ -14,7 +14,12 @@ kubePlex: pullPolicy: Always # Override this with the plex claim token from plex.tv/claim -claimToken: "" +claimToken: + ## secret containing your claimToken. if not set it will create a secret instead using claimToken.value + secret: + secretKey: claimToken + ## only specify value if you are passing in the plain text claimToken + value: # Set the timezone of the plex server timezone: Europe/London From 8644af35c8ca1adc8058662fa6820b3b5d28c554 Mon Sep 17 00:00:00 2001 From: Andrew Mellen Date: Tue, 8 Oct 2019 23:34:33 -0400 Subject: [PATCH 2/4] Docs fix --- charts/kube-plex/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/kube-plex/README.md b/charts/kube-plex/README.md index d3f157e4..588545ba 100644 --- a/charts/kube-plex/README.md +++ b/charts/kube-plex/README.md @@ -37,11 +37,11 @@ The following tables lists the configurable parameters of the Plex chart and the | `persistence.transcode.subPath` | SubPath to use for existing Claim | `nil` | | `persistence.transcode.storageClass` | Type of persistent volume claim | `-` | | `persistence.data.size` | Size of persistent volume claim | `40Gi` | -| `persistence.data.existingClaim`| Use an existing PVC to persist data | `nil` | +| `persistence.data.claimName`| Use an existing PVC to persist data | `nil` | | `persistence.data.subPath` | SubPath to use for existing Claim | `nil` | | `persistence.data.storageClass` | Type of persistent volume claim | `-` | | `persistence.config.size` | Size of persistent volume claim | `20Gi` | -| `persistence.config.existingClaim`| Use an existing PVC to persist data | `nil` | +| `persistence.config.claimName`| Use an existing PVC to persist data | `nil` | | `persistence.config.subPath` | SubPath to use for existing Claim | `nil` | | `persistence.config.storageClass` | Type of persistent volume claim | `-` | | `resources` | CPU/Memory resource requests/limits | `{}` | From 9d64a70deb94e01d278a03c57ccc8c71f0835fc0 Mon Sep 17 00:00:00 2001 From: Andrew Mellen Date: Thu, 10 Oct 2019 21:57:36 -0400 Subject: [PATCH 3/4] Fix typo and update phrasing --- charts/kube-plex/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/kube-plex/README.md b/charts/kube-plex/README.md index 588545ba..ef72392c 100644 --- a/charts/kube-plex/README.md +++ b/charts/kube-plex/README.md @@ -13,8 +13,8 @@ The following tables lists the configurable parameters of the Plex chart and the | `kubePlex.image.repository` | Image repository | `quay.io/munnerz/kube-plex` | | `kubePlex.image.tag` | Image tag. | `latest`| | `kubePlex.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `claimToken.secret` | Premade secret holding the Plex Claim Token to authenticate your acount. Must set this or `claimToken.value` | `` | -| `claimToken.secretKey` | The key in the above secret that holds the Plex Claim Toke | `claimToken` | +| `claimToken.secret` | Existing secret name holding the Plex Claim Token to authenticate your acount. Must set this or `claimToken.value` | `` | +| `claimToken.secretKey` | The key in the above secret that holds the Plex Claim Token | `claimToken` | | `claimToken.value` | The plain-text Plex Claim Token. Set this if not using `claimToken.secret` | `` | | `timezone` | Timezone plex instance should run as, e.g. 'America/New_York' | `Europe/London` | | `service.type` | Kubernetes service type for the plex GUI/API | `ClusterIP` | From c3046691da671e4fe4f163c639992d820b7be896 Mon Sep 17 00:00:00 2001 From: Andrew Mellen Date: Fri, 6 Dec 2019 20:25:05 -0500 Subject: [PATCH 4/4] Use plexClaim secret for transcode pods --- charts/kube-plex/templates/deployment.yaml | 4 +++ main.go | 40 ++++++++++++++++++++-- 2 files changed, 41 insertions(+), 3 deletions(-) diff --git a/charts/kube-plex/templates/deployment.yaml b/charts/kube-plex/templates/deployment.yaml index d3270d0a..81b40176 100644 --- a/charts/kube-plex/templates/deployment.yaml +++ b/charts/kube-plex/templates/deployment.yaml @@ -83,6 +83,10 @@ spec: env: - name: TZ value: "{{ .Values.timezone }}" + - name: PLEX_CLAIM_SECRET_NAME + value: {{ template "claimTokenSecretName" . }} + - name: PLEX_CLAIM_SECRET_KEY + value: {{ .Values.claimToken.secretKey }} - name: PLEX_CLAIM valueFrom: secretKeyRef: diff --git a/main.go b/main.go index 39496fc0..3451d130 100644 --- a/main.go +++ b/main.go @@ -31,11 +31,16 @@ var namespace = os.Getenv("KUBE_NAMESPACE") var pmsImage = os.Getenv("PMS_IMAGE") var pmsInternalAddress = os.Getenv("PMS_INTERNAL_ADDRESS") +// the info about where the plex claim secret is held +// instead of passing the claim in plain text to the pods, we pass the secret +var plexClaimSecretName = os.Getenv("PLEX_CLAIM_SECRET_NAME") +var plexClaimSecretKey = os.Getenv("PLEX_CLAIM_SECRET_KEY") + func main() { env := os.Environ() args := os.Args - rewriteEnv(env) + env = rewriteEnv(env) rewriteArgs(args) cwd, err := os.Getwd() if err != nil { @@ -83,9 +88,20 @@ func main() { } } +func removeValFromEnvSlice(s []string, r string) []string { + for i, v := range s { + splitvar := strings.SplitN(v, "=", 2) + if splitvar[0] == r { + return append(s[:i], s[i+1:]...) + } + } + return s +} + // rewriteEnv rewrites environment variables to be passed to the transcoder -func rewriteEnv(in []string) { - // no changes needed +func rewriteEnv(in []string) []string { + in = removeValFromEnvSlice(in, "PLEX_CLAIM") + return in } func rewriteArgs(in []string) { @@ -101,6 +117,7 @@ func rewriteArgs(in []string) { func generatePod(cwd string, env []string, args []string) *corev1.Pod { envVars := toCoreV1EnvVar(env) + envVars = addFromSecretsToCoreV1EnvVar(envVars) return &corev1.Pod{ ObjectMeta: metav1.ObjectMeta{ GenerateName: "pms-elastic-transcoder-", @@ -165,6 +182,23 @@ func generatePod(cwd string, env []string, args []string) *corev1.Pod { } } +func addFromSecretsToCoreV1EnvVar(vars []corev1.EnvVar) []corev1.EnvVar { + secrets := []corev1.EnvVar{ + { + Name: "PLEX_CLAIM", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: plexClaimSecretName, + }, + Key: plexClaimSecretKey, + }, + }, + }, + } + return append(vars, secrets...) +} + func toCoreV1EnvVar(in []string) []corev1.EnvVar { out := make([]corev1.EnvVar, len(in)) for i, v := range in {