diff --git a/examples/security/README.md b/examples/security/README.md new file mode 100644 index 00000000..fc67ab67 --- /dev/null +++ b/examples/security/README.md @@ -0,0 +1,50 @@ +Users provisioning +=== + +## Configuring the admin and provisioner + +```yaml +security: + enabled: true + admin: + initialPassword: "{bcrypt}$2a$12$VDd8PrAndaJfoMJFlHFot.osSxZWQjMQZKgrEJgVZKFj6WFPvkbnS" # admin123 + provisioner: + username: graphdb-provisioner + password: provisionerpass123 +``` + +## Configuring extra users + +```yaml +security: + enabled: true + initialUsers: + users: + tester: + username: tester + password: "{bcrypt}$2a$12$Ox/aDv4TpnVrMZPmCBNdbu1WI8ekuXiYWMuMie.fpHb.uWRukej1i" # password123 + grantedAuthorities: [ "ROLE_USER" ] +``` + +**Note: The password for the additional user is created by appending the bcrypt-hashed version +of the password to the "{bcrypt}" string.** + +## Configuring users by using a Secret + +The Secret resource is defined in the [graphdb-users.yaml](./graphdb-users.yaml) file. It loads +the [users.js](./users.js) file as its content, which contains descriptions of all users. Each +user's password is stored by appending the bcrypt-hashed version of the password to the {bcrypt} string. + +```yaml +security: + enabled: true + initialUsers: + existingSecret: "graphdb-users" + secretKey: users.js +``` +#### Credentials + +| Username | Password | +|----------|----------| +| admin | admin | +| tester | tester | diff --git a/examples/security/graphdb-users.yaml b/examples/security/graphdb-users.yaml new file mode 100644 index 00000000..d37a987f --- /dev/null +++ b/examples/security/graphdb-users.yaml @@ -0,0 +1,27 @@ +# This YAML file defines a Kubernetes Secret named "graphdb-users." +# It stores the contents of the "users.js" file (located in the "files" directory) +# in base64-encoded format. This Secret securely provides sensitive data, +# such as configuration files, to Kubernetes pods. +# +# Place this Secret under the templates directory of the Helm chart. + +apiVersion: v1 +kind: Secret +metadata: + name: graphdb-users +stringData: + users.js: > + { + "users" : { + "admin" : { + "username" : "admin", + "password" : "{bcrypt}$2a$12$EgGOH5kMwtrmBooSu/iRnOSkP712nLYOdLNQsZZ2dvM28XTgzvSKq", + "grantedAuthorities" : [ "ROLE_ADMIN" ] + }, + "tester": { + "username" : "tester", + "password" : "{bcrypt}$2a$12$MYBDxuw9ziuYwnOyYbt1P.yqzkG.ufxR3r7nw8QKuHa/Cu0gpnR5a", + "grantedAuthorities" : [ "ROLE_USER" ] + } + } + }