Skip to content
Snippets Groups Projects
Unverified Commit a4343b84 authored by Simon Ostendorf's avatar Simon Ostendorf Committed by GitHub
Browse files

feat: read HCLOUD_TOKEN from file (#652)

This allows the `HCLOUD_TOKEN` (and `ROBOT_USER` and `ROBOT_PASSWORD`)
to be read from a file. This can be useful if the token is injected
using secret injection (e.g. with the vault agent injector).

If someone is interested in using this with the vault agent injector,
I used the following helm values:

```yaml
image:
  repository: <custom-image-because-changes-are-not-released>
  tag: <custom-image-because-changes-are-not-released>
podAnnotations:
  vault.hashicorp.com/agent-inject: "true"
  vault.hashicorp.com/log-format: json
  vault.hashicorp.com/role: <your-vault-role-name>
  vault.hashicorp.com/secret-volume-path-token: /vault/secrets
  vault.hashicorp.com/agent-inject-file-token: token
  vault.hashicorp.com/agent-inject-secret-token: <your-vault-mount>/data/<your-vault-path>
  vault.hashicorp.com/agent-inject-template-token: |
    {{ with secret "<your-vault-mount>/data/<your-vault-path>" -}}
     {{ .Data.data.token }}
    {{- end }}
env:
  HCLOUD_TOKEN_FILE:
    value: "/vault/secrets/token"
  HCLOUD_TOKEN: null # must be set because helm results in using value and valueFrom and that results in an error
```

This change is inspired from [external-dns cloudflare
provider](https://github.com/kubernetes-sigs/external-dns/blob/master/provider/cloudflare/cloudflare.go#L171).
I requested the same change for the
[csi-driver](https://github.com/hetznercloud/csi-driver/pull/617

) to
keep consistency in reading HCLOUD_TOKEN from file.

Closes #595

---------

Co-authored-by: default avatarJonas L. <jooola@users.noreply.github.com>
Co-authored-by: default avatarJulian Tölle <julian.toelle@hetzner-cloud.de>
parent e2b0ed63
Branches
Tags v10.49.3
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment