Add secret to preview environments

.werft/jobs/build/helm/values.payment.yaml

@@ -15,7 +15,7 @@ components:
         secretName: chargebee-config
     - name: stripe-config
       secret:
-        secretName: stripe-config
+        secretName: stripe-api-keys
 
   paymentEndpoint:
-    disabled: false
+    disabled: false

.werft/jobs/build/installer/installer.ts

@@ -3,6 +3,7 @@ import { exec } from "../../../util/shell";
 import { Werft } from "../../../util/werft";
 import { getNodePoolIndex } from "../deploy-to-preview-environment";
 import { renderPayment } from "../payment/render";
+import { CORE_DEV_KUBECONFIG_PATH } from "../const";
 
 const BLOCK_NEW_USER_CONFIG_PATH = './blockNewUsers';
 const WORKSPACE_SIZE_CONFIG_PATH = './workspaceSizing';
@@ -66,6 +67,7 @@ export class Installer {
             this.configureIDE(slice)
             this.configureObservability(slice)
             this.configureAuthProviders(slice)
+            this.configureStripeAPIKeys(slice)
             this.configureSSHGateway(slice)
             this.configurePublicAPIServer(slice)
             this.configureUsage(slice)
@@ -79,8 +81,9 @@ export class Installer {
             if (this.options.withPayment) {
                 // let installer know that there is a chargbee config
                 exec(`yq w -i ${this.options.installerConfigPath} experimental.webapp.server.chargebeeSecret chargebee-config`, { slice: slice });
+
                 // let installer know that there is a stripe config
-                exec(`yq w -i ${this.options.installerConfigPath} experimental.webapp.server.stripeSecret stripe-config`, { slice: slice });
+                exec(`yq w -i ${this.options.installerConfigPath} experimental.webapp.server.stripeSecret stripe-api-keys`, { slice: slice });
             }
 
         } catch (err) {
@@ -161,6 +164,19 @@ EOF`)
         done`, { slice: slice })
     }
 
+    private configureStripeAPIKeys(slice: string) {
+        exec(
+            `kubectl --kubeconfig ${CORE_DEV_KUBECONFIG_PATH} -n werft get secret stripe-api-keys -o yaml > stripe-api-keys.secret.yaml`,
+            { slice },
+        );
+        exec(`yq w -i stripe-api-keys.secret.yaml metadata.namespace "default"`, { slice });
+        exec(`yq d -i stripe-api-keys.secret.yaml metadata.creationTimestamp`, { slice });
+        exec(`yq d -i stripe-api-keys.secret.yaml metadata.uid`, { slice });
+        exec(`yq d -i stripe-api-keys.secret.yaml metadata.resourceVersion`, { slice });
+        exec(`kubectl --kubeconfig "${this.options.kubeconfigPath}" apply -f stripe-api-keys.secret.yaml`, { slice });
+        exec(`rm -f stripe-api-keys.secret.yaml`, { slice });
+    }
+
     private configureSSHGateway(slice: string) {
         exec(`cat /workspace/host-key.yaml \
                 | yq w - metadata.namespace ${this.options.deploymentNamespace} \

components/server/ee/src/user/stripe-service.ts

@@ -17,10 +17,10 @@ export class StripeService {
 
     protected getStripe(): Stripe {
         if (!this._stripe) {
-            if (!this.config.stripeSettings?.secretKey) {
+            if (!this.config.stripeSecrets?.secretKey) {
                 throw new Error("Stripe is not properly configured");
             }
-            this._stripe = new Stripe(this.config.stripeSettings.secretKey, { apiVersion: "2020-08-27" });
+            this._stripe = new Stripe(this.config.stripeSecrets.secretKey, { apiVersion: "2020-08-27" });
         }
         return this._stripe;
     }

components/server/ee/src/workspace/gitpod-server-impl.ts

@@ -1851,7 +1851,7 @@ export class GitpodServerEEImpl extends GitpodServerImpl {
     async getStripePublishableKey(ctx: TraceContext): Promise<string> {
         const user = this.checkAndBlockUser("getStripePublishableKey");
         await this.ensureIsUsageBasedFeatureFlagEnabled(user);
-        const publishableKey = this.config.stripeSettings?.publishableKey;
+        const publishableKey = this.config.stripeSecrets?.publishableKey;
         if (!publishableKey) {
             throw new ResponseError(
                 ErrorCodes.INTERNAL_SERVER_ERROR,

components/server/src/config.ts

@@ -20,12 +20,12 @@ import { filePathTelepresenceAware } from "@gitpod/gitpod-protocol/lib/env";
 export const Config = Symbol("Config");
 export type Config = Omit<
     ConfigSerialized,
-    "blockedRepositories" | "hostUrl" | "chargebeeProviderOptionsFile" | "stripeSettingsFile" | "licenseFile"
+    "blockedRepositories" | "hostUrl" | "chargebeeProviderOptionsFile" | "stripeSecretsFile" | "licenseFile"
 > & {
     hostUrl: GitpodHostUrl;
     workspaceDefaults: WorkspaceDefaults;
     chargebeeProviderOptions?: ChargebeeProviderOptions;
-    stripeSettings?: { publishableKey: string; secretKey: string };
+    stripeSecrets?: { publishableKey: string; secretKey: string };
     builtinAuthProvidersConfigured: boolean;
     blockedRepositories: { urlRegExp: RegExp; blockUser: boolean }[];
     inactivityPeriodForRepos?: number;
@@ -151,7 +151,7 @@ export interface ConfigSerialized {
      * Payment related options
      */
     chargebeeProviderOptionsFile?: string;
-    stripeSettingsFile?: string;
+    stripeSecretsFile?: string;
     enablePayment?: boolean;
 
     /**
@@ -215,12 +215,14 @@ export namespace ConfigFile {
         const chargebeeProviderOptions = readOptionsFromFile(
             filePathTelepresenceAware(config.chargebeeProviderOptionsFile || ""),
         );
-        let stripeSettings: { publishableKey: string; secretKey: string } | undefined;
-        if (config.enablePayment && config.stripeSettingsFile) {
+        let stripeSecrets: { publishableKey: string; secretKey: string } | undefined;
+        if (config.enablePayment && config.stripeSecretsFile) {
             try {
-                stripeSettings = JSON.parse(fs.readFileSync(filePathTelepresenceAware(config.stripeSettingsFile), "utf-8"));
+                stripeSecrets = JSON.parse(
+                    fs.readFileSync(filePathTelepresenceAware(config.stripeSecretsFile), "utf-8"),
+                );
             } catch (error) {
-                console.error("Could not load Stripe settings", error);
+                console.error("Could not load Stripe secrets", error);
             }
         }
         let license = config.license;
@@ -249,7 +251,7 @@ export namespace ConfigFile {
             authProviderConfigs,
             builtinAuthProvidersConfigured,
             chargebeeProviderOptions,
-            stripeSettings,
+            stripeSecrets,
             license,
             workspaceGarbageCollection: {
                 ...config.workspaceGarbageCollection,

install/installer/pkg/components/server/configmap.go

@@ -218,7 +218,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
 		VSXRegistryUrl:               fmt.Sprintf("https://open-vsx.%s", ctx.Config.Domain), // todo(sje): or "https://{{ .Values.vsxRegistry.host | default "open-vsx.org" }}" if not using OpenVSX proxy
 		EnablePayment:                chargebeeSecret != "" || stripeSecret != "",
 		ChargebeeProviderOptionsFile: fmt.Sprintf("%s/providerOptions", chargebeeMountPath),
-		StripeSettingsFile:           fmt.Sprintf("%s/settings", stripeMountPath),
+		StripeSecretsFile:            fmt.Sprintf("%s/apikeys", stripeMountPath),
 		InsecureNoDomain:             false,
 		PrebuildLimiter: map[string]int{
 			// default limit for all cloneURLs

install/installer/pkg/components/server/deployment.go

@@ -194,7 +194,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
 
 			volumes = append(volumes,
 				corev1.Volume{
-					Name: "stripe-config",
+					Name: "stripe-secret",
 					VolumeSource: corev1.VolumeSource{
 						Secret: &corev1.SecretVolumeSource{
 							SecretName: stripeSecret,
@@ -203,7 +203,7 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
 				})
 
 			volumeMounts = append(volumeMounts, corev1.VolumeMount{
-				Name:      "stripe-config",
+				Name:      "stripe-secret",
 				MountPath: stripeMountPath,
 				ReadOnly:  true,
 			})

install/installer/pkg/components/server/types.go

@@ -32,7 +32,7 @@ type ConfigSerialized struct {
 	ImageBuilderAddr                  string   `json:"imageBuilderAddr"`
 	VSXRegistryUrl                    string   `json:"vsxRegistryUrl"`
 	ChargebeeProviderOptionsFile      string   `json:"chargebeeProviderOptionsFile"`
-	StripeSettingsFile                string   `json:"stripeSettingsFile"`
+	StripeSecretsFile                 string   `json:"stripeSecretsFile"`
 	EnablePayment                     bool     `json:"enablePayment"`
 
 	WorkspaceHeartbeat         WorkspaceHeartbeat         `json:"workspaceHeartbeat"`