Skip to content

Commit fe0d6d6

Browse files
github-actions[bot]github-actions[bot]
committed
chore: sync from governance-studio-infrastructure @ 3695417
Updated: charts docs/auth0 docs/entra docs/keycloak govctl Source: eqtylab/guardian-infrastructure@3695417
1 parent 7ab2ac5 commit fe0d6d6

27 files changed

Lines changed: 257 additions & 56 deletions

‎charts/governance-platform/README.md‎

Lines changed: 52 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -315,25 +315,25 @@ These global values are automatically inherited by all subcharts:
315315

316316
Centralized secret configuration for all platform components:
317317

318-
| Key | Type | Default | Description |
319-
| ------------------------------------------------------- | ------ | ------------------------------ | ------------------------------------------------------------------------------------- |
320-
| global.secrets.create | bool | `false` | Auto-create secrets from values (dev only) |
321-
| global.secrets.database.secretName | string | `"platform-database"` | Database credentials secret name |
322-
| global.secrets.auth.provider | string | `"auth0"` | Auth provider (auth0, entra, or keycloak) |
323-
| global.secrets.auth.auth0.secretName | string | `"platform-auth0"` | Auth0 credentials secret name |
324-
| global.secrets.auth.entra.secretName | string | `"platform-entra"` | Microsoft Entra ID credentials secret name |
325-
| global.secrets.auth.keycloak.secretName | string | `"platform-keycloak"` | Keycloak credentials secret name |
326-
| global.secrets.storage.aws_s3.secretName | string | `"platform-aws-s3"` | AWS S3 credentials secret name |
327-
| global.secrets.storage.azure_blob.secretName | string | `"platform-azure-blob"` | Azure Blob credentials secret name |
328-
| global.secrets.storage.gcs.secretName | string | `"platform-gcs"` | GCS credentials secret name |
329-
| global.secrets.keyManagement.provider | string | `"azure_key_vault"` | Key management provider for credential signing (aws_kms, azure_key_vault, or gcp_kms) |
330-
| global.secrets.keyManagement.aws_kms.secretName | string | `"platform-aws-kms"` | AWS KMS credentials secret name |
331-
| global.secrets.keyManagement.azure_key_vault.secretName | string | `"platform-azure-key-vault"` | Azure Key Vault credentials secret name |
332-
| global.secrets.keyManagement.gcp_kms.secretName | string | `"platform-gcp-kms"` | GCP KMS credentials secret name |
333-
| global.secrets.encryption.secretName | string | `"platform-encryption-key"` | Platform encryption key secret name |
334-
| global.secrets.authService.secretName | string | `"platform-auth-service"` | Auth service secrets (session, JWT, API keys) |
335-
| global.secrets.governanceWorker.secretName | string | `"platform-governance-worker"` | Governance worker credentials secret name |
336-
| global.secrets.imageRegistry.secretName | string | `"platform-image-pull-secret"` | Container registry credentials secret name |
318+
| Key | Type | Default | Description |
319+
| ------------------------------------------------------- | ------ | ------------------------------ | -------------------------------------------------------------------------------------------------------------------- |
320+
| global.secrets.create | bool | `false` | Auto-create secrets from values (dev only) |
321+
| global.secrets.database.secretName | string | `"platform-database"` | Database credentials secret name |
322+
| global.secrets.auth.provider | string | `"auth0"` | Auth provider (auth0, entra, or keycloak) |
323+
| global.secrets.auth.auth0.secretName | string | `"platform-auth0"` | Auth0 credentials secret name |
324+
| global.secrets.auth.entra.secretName | string | `"platform-entra"` | Microsoft Entra ID credentials secret name |
325+
| global.secrets.auth.keycloak.secretName | string | `"platform-keycloak"` | Keycloak credentials secret name |
326+
| global.secrets.storage.aws_s3.secretName | string | `"platform-aws-s3"` | AWS S3 credentials secret name (not required when services use IAM role access — see Storage Provider Configuration) |
327+
| global.secrets.storage.azure_blob.secretName | string | `"platform-azure-blob"` | Azure Blob credentials secret name |
328+
| global.secrets.storage.gcs.secretName | string | `"platform-gcs"` | GCS credentials secret name |
329+
| global.secrets.keyManagement.provider | string | `"azure_key_vault"` | Key management provider for credential signing (aws_kms, azure_key_vault, or gcp_kms) |
330+
| global.secrets.keyManagement.aws_kms.secretName | string | `"platform-aws-kms"` | AWS KMS credentials secret name |
331+
| global.secrets.keyManagement.azure_key_vault.secretName | string | `"platform-azure-key-vault"` | Azure Key Vault credentials secret name |
332+
| global.secrets.keyManagement.gcp_kms.secretName | string | `"platform-gcp-kms"` | GCP KMS credentials secret name |
333+
| global.secrets.encryption.secretName | string | `"platform-encryption-key"` | Platform encryption key secret name |
334+
| global.secrets.authService.secretName | string | `"platform-auth-service"` | Auth service secrets (session, JWT, API keys) |
335+
| global.secrets.governanceWorker.secretName | string | `"platform-governance-worker"` | Governance worker credentials secret name |
336+
| global.secrets.imageRegistry.secretName | string | `"platform-image-pull-secret"` | Container registry credentials secret name |
337337

338338
### Global Database Configuration
339339

@@ -652,6 +652,39 @@ integrity-service:
652652
integrityAppBlobStoreAwsFolder: "your-integrity-store-folder"
653653
```
654654

655+
#### Using IAM roles instead of static credentials (IRSA)
656+
657+
If you run on EKS and authenticate via IAM Roles for Service Accounts (IRSA) — or any other IAM identity-based mechanism such as an instance profile — you do not need to provide an access key / secret access key, and the `platform-aws-s3` secret is not required.
658+
659+
Set `awsS3UseIamRole` (governance-service) and/or `integrityAppBlobStoreAwsUseIamRole` (integrity-service) to `true`. This omits the `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` env vars and the secret reference entirely, so the AWS SDK falls back to its default credential chain. Annotate each service's service account with the role ARN:
660+
661+
```yaml
662+
governance-service:
663+
serviceAccount:
664+
create: true
665+
annotations:
666+
eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<governance-s3-role>
667+
config:
668+
storageProvider: "aws_s3"
669+
awsS3Region: "us-east-1"
670+
awsS3BucketName: "your-governance-artifacts-bucket"
671+
awsS3UseIamRole: true
672+
673+
integrity-service:
674+
serviceAccount:
675+
create: true
676+
annotations:
677+
eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<integrity-s3-role>
678+
config:
679+
integrityAppBlobStoreType: "aws_s3"
680+
integrityAppBlobStoreAwsRegion: "us-east-1"
681+
integrityAppBlobStoreAwsBucket: "your-integrity-store-bucket"
682+
integrityAppBlobStoreAwsFolder: "your-integrity-store-folder"
683+
integrityAppBlobStoreAwsUseIamRole: true
684+
```
685+
686+
With IAM roles in use, leave `global.secrets.storage.aws_s3` unset (or `global.secrets.create: false`) — no S3 credentials secret will be created or referenced.
687+
655688
### Azure Blob Storage
656689

657690
```yaml

‎charts/governance-platform/examples/secrets-sample.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@ global:
8585
storage:
8686
# --- AWS S3 ---
8787
# Used by: governance-service, integrity-service (when using aws_s3)
88+
# Optional: omit this block entirely when using IAM role access (IRSA). Set
89+
# awsS3UseIamRole / integrityAppBlobStoreAwsUseIamRole: true on the services
90+
# instead, and annotate their service accounts with eks.amazonaws.com/role-arn
8891
aws_s3:
8992
secretName: "platform-aws-s3"
9093
values:
@@ -239,7 +242,8 @@ global:
239242
# --from-literal=jwt-secret="$(openssl rand -base64 32)" \
240243
# --namespace governance
241244
#
242-
# # AWS S3 Credentials (if using S3)
245+
# # AWS S3 Credentials (if using S3 with static keys)
246+
# # Skip this when using IAM role access (IRSA) - set awsS3UseIamRole: true instead
243247
# kubectl create secret generic platform-aws-s3 \
244248
# --from-literal=access-key-id=YOUR_AWS_ACCESS_KEY \
245249
# --from-literal=secret-access-key=YOUR_AWS_SECRET_KEY \

‎charts/governance-platform/examples/values-auth0.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,9 @@ governance-service:
128128
# storageProvider: "aws_s3"
129129
# awsS3Region: "us-east-1"
130130
# awsS3BucketName: "your-governance-artifacts-bucket"
131+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
132+
# # credential chain. Requires serviceAccount below annotated with the role ARN
133+
# awsS3UseIamRole: true
131134

132135
# Storage Configuration - Azure Blob
133136
storageProvider: "azure_blob"
@@ -221,6 +224,9 @@ integrity-service:
221224
# integrityAppBlobStoreAwsRegion: "us-east-1"
222225
# integrityAppBlobStoreAwsBucket: "your-integrity-store-bucket"
223226
# integrityAppBlobStoreAwsFolder: "your-integrity-store-folder"
227+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
228+
# # credential chain. Requires serviceAccount below annotated with the role ARN
229+
# integrityAppBlobStoreAwsUseIamRole: true
224230

225231
# Storage Configuration - GCS (uncomment to use instead)
226232
# integrityAppBlobStoreType: "gcs"

‎charts/governance-platform/examples/values-entra.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,9 @@ governance-service:
123123
# storageProvider: "aws_s3"
124124
# awsS3Region: "us-east-1"
125125
# awsS3BucketName: "your-governance-artifacts-bucket"
126+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
127+
# # credential chain. Requires serviceAccount below annotated with the role ARN
128+
# awsS3UseIamRole: true
126129

127130
# Storage Configuration - Azure Blob
128131
storageProvider: "azure_blob"
@@ -219,6 +222,9 @@ integrity-service:
219222
# integrityAppBlobStoreAwsRegion: "us-east-1"
220223
# integrityAppBlobStoreAwsBucket: "your-integrity-store-bucket"
221224
# integrityAppBlobStoreAwsFolder: "your-integrity-store-folder"
225+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
226+
# # credential chain. Requires serviceAccount below annotated with the role ARN
227+
# integrityAppBlobStoreAwsUseIamRole: true
222228

223229
# Storage Configuration - GCS (uncomment to use instead)
224230
# integrityAppBlobStoreType: "gcs"

‎charts/governance-platform/examples/values-keycloak.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ governance-service:
130130
# storageProvider: "aws_s3"
131131
# awsS3Region: "us-east-1"
132132
# awsS3BucketName: "your-governance-artifacts-bucket"
133+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
134+
# # credential chain. Requires serviceAccount below annotated with the role ARN
135+
# awsS3UseIamRole: true
133136

134137
# Storage Configuration - Azure Blob
135138
storageProvider: "azure_blob"
@@ -227,6 +230,9 @@ integrity-service:
227230
# integrityAppBlobStoreAwsRegion: "us-east-1"
228231
# integrityAppBlobStoreAwsBucket: "your-integrity-store-bucket"
229232
# integrityAppBlobStoreAwsFolder: "your-integrity-store-folder"
233+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
234+
# # credential chain. Requires serviceAccount below annotated with the role ARN
235+
# integrityAppBlobStoreAwsUseIamRole: true
230236

231237
# Storage Configuration - GCS (uncomment to use instead)
232238
# integrityAppBlobStoreType: "gcs"

‎charts/governance-platform/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1937,6 +1937,12 @@ governance-service:
19371937
# Only used when storageProvider is "aws_s3"
19381938
awsS3SecretAccessKey: ""
19391939

1940+
# -- Use AWS IAM role for S3 access instead of static credentials
1941+
# @default -- `false`
1942+
# Omits the credential env vars so the AWS SDK uses its default chain (IRSA, instance profile)
1943+
# Only used when storageProvider is "aws_s3"
1944+
awsS3UseIamRole: false
1945+
19401946
# -- Azure Storage Account Name
19411947
# @default -- `""`
19421948
# **REQUIRED for Azure**: Storage account name
@@ -2784,6 +2790,12 @@ integrity-service:
27842790
# Only used when integrityAppBlobStoreType is "aws_s3"
27852791
integrityAppBlobStoreAwsSecretAccessKey: ""
27862792

2793+
# -- Use AWS IAM role for S3 access instead of static credentials
2794+
# @default -- `false`
2795+
# Omits the credential env vars so the AWS SDK uses its default chain (IRSA, instance profile)
2796+
# Only used when integrityAppBlobStoreType is "aws_s3"
2797+
integrityAppBlobStoreAwsUseIamRole: false
2798+
27872799
# -- Azure Storage Account
27882800
# @default -- `""`
27892801
# **REQUIRED for Azure**: Storage account name

‎charts/governance-service/README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -458,12 +458,13 @@ All config values support global fallbacks when deployed via umbrella chart.
458458

459459
**AWS S3 (only used when storageProvider is "aws_s3"):**
460460

461-
| Key | Type | Default | Description |
462-
| --------------------------- | ------ | ------- | -------------------------------------------------------------------------- |
463-
| config.awsS3Region | string | `""` | AWS region (**REQUIRED**) |
464-
| config.awsS3BucketName | string | `""` | AWS S3 bucket name (**REQUIRED**) |
465-
| config.awsS3AccessKeyId | string | `""` | AWS access key ID (auto-configured from global.secrets.storage.aws_s3) |
466-
| config.awsS3SecretAccessKey | string | `""` | AWS secret access key (auto-configured from global.secrets.storage.aws_s3) |
461+
| Key | Type | Default | Description |
462+
| --------------------------- | ------ | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
463+
| config.awsS3Region | string | `""` | AWS region (**REQUIRED**) |
464+
| config.awsS3BucketName | string | `""` | AWS S3 bucket name (**REQUIRED**) |
465+
| config.awsS3AccessKeyId | string | `""` | AWS access key ID (auto-configured from global.secrets.storage.aws_s3) |
466+
| config.awsS3SecretAccessKey | string | `""` | AWS secret access key (auto-configured from global.secrets.storage.aws_s3) |
467+
| config.awsS3UseIamRole | bool | `false` | Use the IAM role credential chain (IRSA/instance profile) instead of static keys; omits the credential env vars and the platform-aws-s3 secret reference |
467468

468469
**Azure Blob Storage (only used when storageProvider is "azure_blob"):**
469470

‎charts/governance-service/examples/values-auth0.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ config:
5454
# storageProvider: "aws_s3"
5555
# awsS3Region: "us-east-1"
5656
# awsS3BucketName: "your-governance-artifacts-bucket"
57+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
58+
# # credential chain. Requires the service account annotated with the role ARN
59+
# awsS3UseIamRole: true
5760

5861
# Storage Configuration - Azure Blob
5962
storageProvider: "azure_blob"

‎charts/governance-service/examples/values-entra.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ config:
5454
# storageProvider: "aws_s3"
5555
# awsS3Region: "us-east-1"
5656
# awsS3BucketName: "your-governance-artifacts-bucket"
57+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
58+
# # credential chain. Requires the service account annotated with the role ARN
59+
# awsS3UseIamRole: true
5760

5861
# Storage Configuration - Azure Blob
5962
storageProvider: "azure_blob"

‎charts/governance-service/examples/values-keycloak.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ config:
5454
# storageProvider: "aws_s3"
5555
# awsS3Region: "us-east-1"
5656
# awsS3BucketName: "your-governance-artifacts-bucket"
57+
# # IAM role access (IRSA): set true to skip static keys and use the IAM role
58+
# # credential chain. Requires the service account annotated with the role ARN
59+
# awsS3UseIamRole: true
5760

5861
# Storage Configuration - Azure Blob
5962
storageProvider: "azure_blob"

0 commit comments

Comments
 (0)