Skip to main content
Version: Next

Step 4 - Add Secrets

Required Secrets

GKE IAM user​

  • GKE IAM user is covered in prerequisites section with all the permissions required: To enable the Halo access to the storage bucket that contain CDR reports, an IAM user (compute@developer.gserviceaccount.com) needs the Compute Storage User/Admin role.

Cloud Storage Bucket​

To enable Halo's access to the reporting Cloud Storage Bucket ('saname').

  • Enable your current project as the default project for interoperable access within the interoperability settings within your Cloud Storage settings.

    • Go to Cloud Storage settings > click on INTEROPERABILITY tab > click on "Default project for interoperable access" and select your project from the drop down.

  • Create Access key and secret for storage, same as above, we need to add more clear steps or a link to google docs steps on how to do this.

    • Go to Cloud Storage settings > click on INTEROPERABILITY tab > in "Default project for interoperable access" section click on "Create key". Note: Principals can access Cloud Storage data according to their project roles. To modify other permissions, use these group IDs to identify these roles.

      Add your Access key and Secret for Storage to Kubernetes Secrets"

      kubectl create secret generic storage-access -n cdrplatform --from-literal=storage-access-key=<Add-Value> --from-literal=storage-secret-key=<Add-Value>

MongoDB connection string​

To enable Glasswall Halo's Policy API to create and manage the policies in MongoDB, and Async API to create and manage the requests, MongoDB needs to be deployed using Helm charts listed in Step 8.

Add the MongoDB passwords to Kubernetes Secrets​

Two users will be created by the MongoDB Helm chart and the corresponding user's password needs to be set in Kubernetes Secrets.

kubectl create secret generic cdrplatform-secrets -n cdrplatform --from-literal=mongodb-cdrp-password=<Add-Value> --from-literal=mongodb-admin-password=<Add-Value>