Adds secrets checksum, updated kubetail-* manifest values files (#60)

kubetail-org · Sep 24, 2024 · 8ca4d59 · 8ca4d59
1 parent b9b3e75
commit 8ca4d59
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 24 deletions.
diff --git a/charts/kubetail/Chart.yaml b/charts/kubetail/Chart.yaml
@@ -8,7 +8,7 @@ keywords:
 - private
 - realtime
 type: application
-version: 0.7.0-rc2
+version: 0.7.0-rc3
 appVersion: "0.7.0-rc4"
 home: https://github.com/kubetail-org/kubetail
 maintainers:

diff --git a/charts/kubetail/templates/_helpers.tpl b/charts/kubetail/templates/_helpers.tpl
@@ -217,6 +217,19 @@ Server Secret name
 {{ if .Values.kubetail.server.secret.name }}{{ .Values.kubetail.server.secret.name }}{{ else }}{{ include "kubetail.fullname" . }}-server{{ end }}
 {{- end }}
 
+{{/*
+Server Secret data
+*/}}
+{{- define "kubetail.server.secretData" -}}
+{{- $currentValsRef := dict "data" dict -}}
+{{- $currentResource := (lookup "v1" "Secret" (include "kubetail.namespace" .) (include "kubetail.server.secretName" .)) -}}
+{{- if $currentResource -}}
+{{- $_ := set $currentValsRef "data" (index $currentResource "data") -}}
+{{- end -}}
+KUBETAIL_SERVER_CSRF_SECRET: {{ .Values.kubetail.secrets.KUBETAIL_SERVER_CSRF_SECRET | default $currentValsRef.data.KUBETAIL_SERVER_CSRF_SECRET | default ((randAlphaNum 32) | b64enc | quote) }}
+KUBETAIL_SERVER_SESSION_SECRET: {{ .Values.kubetail.secrets.KUBETAIL_SERVER_SESSION_SECRET | default $currentValsRef.data.KUBETAIL_SERVER_SESSION_SECRET | default ((randAlphaNum 32) | b64enc | quote) }}
+{{- end }}
+
 {{/*
 Server Service name
 */}}

diff --git a/charts/kubetail/templates/server/deployment.yaml b/charts/kubetail/templates/server/deployment.yaml
@@ -1,6 +1,7 @@
 {{- $dep := index .Values "kubetail" "server" "deployment" -}}
 {{- $podTmpl := index .Values "kubetail" "server" "podTemplate" }}
 {{- $container := index .Values "kubetail" "server" "container" -}}
+{{- $secret := index .Values "kubetail" "server" "secret" -}}
 kind: Deployment
 apiVersion: apps/v1
 metadata:
@@ -25,6 +26,9 @@ spec:
       annotations:
         {{- include "kubetail.annotations" (list $ $podTmpl.annotations) | indent 8 }}
         checksum/config: {{ include "kubetail.server.config" . | sha256sum | quote }}
+        {{- if $secret.enabled }}
+        checksum/secret: {{ include "kubetail.server.secretData" . | sha256sum | quote }}
+        {{- end }}
     spec:
       automountServiceAccountToken: true
       {{- if eq .Values.kubetail.authMode "cluster" }}

diff --git a/charts/kubetail/templates/server/secret.yaml b/charts/kubetail/templates/server/secret.yaml
@@ -11,11 +11,5 @@ metadata:
     {{- include "kubetail.annotations" (list $ $secret.annotations) | indent 4 }}
 type: Opaque
 data:
-  {{- $currentValsRef := dict "data" dict }}
-  {{- $currentResource := (lookup "v1" "Secret" (include "kubetail.namespace" .) (include "kubetail.server.secretName" .)) }}
-  {{- if $currentResource }}
-  {{- $_ := set $currentValsRef "data" (index $currentResource "data") }}
-  {{- end }}
-  KUBETAIL_SERVER_CSRF_SECRET: {{ .Values.kubetail.secrets.KUBETAIL_SERVER_CSRF_SECRET | default $currentValsRef.data.KUBETAIL_SERVER_CSRF_SECRET | default ((randAlphaNum 32) | b64enc | quote) }}
-  KUBETAIL_SERVER_SESSION_SECRET: {{ .Values.kubetail.secrets.KUBETAIL_SERVER_SESSION_SECRET | default $currentValsRef.data.KUBETAIL_SERVER_SESSION_SECRET | default ((randAlphaNum 32) | b64enc | quote) }}
+  {{- include "kubetail.server.secretData" . | nindent 2 }}
 {{- end }}
diff --git a/hack/kubetail-values-clusterauth.yaml b/hack/kubetail-values-clusterauth.yaml
@@ -3,11 +3,6 @@ namespaceOverride: kubetail
 kubetail:
   authMode: cluster
 
-  config: |
-    session:
-      secret: REPLACEME
-    csrf:
-      secret: REPLACEME
-
-  secret:
-    enabled: false
+  secrets:
+    KUBETAIL_SERVER_CSRF_SECRET: "cmVwbGFjZW1l"
+    KUBETAIL_SERVER_SESSION_SECRET: "cmVwbGFjZW1l"
diff --git a/hack/kubetail-values-tokenauth.yaml b/hack/kubetail-values-tokenauth.yaml
@@ -3,11 +3,6 @@ namespaceOverride: kubetail
 kubetail:
   authMode: token
 
-  config: |
-    session:
-      secret: REPLACEME
-    csrf:
-      secret: REPLACEME
-
-  secret:
-    enabled: false
+  secrets:
+    KUBETAIL_SERVER_CSRF_SECRET: "cmVwbGFjZW1l"
+    KUBETAIL_SERVER_SESSION_SECRET: "cmVwbGFjZW1l"