Following T335979: Decision request - Toolforge envvars/secrets service and T334578: [toolforge] Create a secrets management offering to avoid storing on NFS, this tasks is to implement the service to allow setting secret envvars on toolforge:
Have an envvar cli (and API) that allows setting environment variables for the app environment, that would be a superset as env vars would be secrets and not secrets (no specific cli for secrets).
The implementation is being done here: https://gitlab.wikimedia.org/repos/cloud/toolforge/envvars-api/-/merge_requests/2
It will need three components:
- An API to manage the envvars
- A cli to allow users to interact with the api (part of toolforge cli)
- An admission controller to add the envvars to the pods when creating them, this would be similar to the volume-admission-controller using the app=toolforge selector and adding any secrets in the same namespace with that label to the pod as enviroment vars named ENVVAR_<secret_name>, where secret_name is the name of the k8s secret object.
Docs are here:
- Build service specific: https://wikitech.wikimedia.org/wiki/Help:Toolforge/Build_Service#Using_environment_variables_to_pass_secrets_and_configuration
- Admin docs: https://wikitech.wikimedia.org/wiki/Portal:Toolforge/Admin/Envvars_Service
- User docs: https://wikitech.wikimedia.org/wiki/Help:Toolforge/Envvars_Service