Skip to content

Commit

Permalink
fix: fixed problem where chart couldnt be deployed
Browse files Browse the repository at this point in the history
problem was occuring because of the value 'username' in postgresql.auth.username in values.yaml. When setting this value postgresql automatically also sets a password for the root user which couldnt be found in our backend-secrets-postgres.yaml file because we only set a datasource password an no root password.
  • Loading branch information
PaMarzec committed Feb 20, 2024
1 parent 21ed3a4 commit 3f704e6
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 10 deletions.
11 changes: 8 additions & 3 deletions charts/puris/templates/backend-deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,11 @@ spec:
secretKeyRef:
name: "{{ .Values.postgresql.auth.existingSecret }}"
key: "postgres-password"
- name: ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: "{{ .Values.postgresql.auth.existingSecret }}"
key: "password"
{{- else }}
- name: DATASOURCE_URL
value: "{{ .Values.backend.puris.datasource.url }}"
Expand All @@ -58,13 +63,13 @@ spec:
- name: DATASOURCE_PASSWORD
valueFrom:
secretKeyRef:
name: "{{ .Values.backend.puris.secret }}"
name: "{{ .Values.backend.puris.existingSecret }}"
key: "puris-datasource-password"
{{- end }}
- name: EDC_CONTROLPLANE_KEY
valueFrom:
secretKeyRef:
name: "{{ .Values.backend.puris.secret }}"
name: "{{ .Values.backend.puris.existingSecret }}"
key: "puris-edc-controlplane-key"
- name: EDC_CONTROLPLANE_MANAGEMENT_URL
value: "{{ .Values.backend.puris.edc.controlplane.management.url }}"
Expand Down Expand Up @@ -93,7 +98,7 @@ spec:
- name: PURIS_API_KEY
valueFrom:
secretKeyRef:
name: "{{ .Values.backend.puris.secret }}"
name: "{{ .Values.backend.puris.existingSecret }}"
key: "puris-api-key"
- name: PURIS_DEMONSTRATOR_ROLE
value: "{{ .Values.backend.puris.demonstrator.role }}"
Expand Down
6 changes: 4 additions & 2 deletions charts/puris/templates/backend-secrets-postgres.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,12 @@ data:
# if secret exists, use value provided from values file (to cover update scenario) or existing value from secret
# use data map instead of stringData to prevent base64 encoding of already base64-encoded existing value from secret
# use index function for secret keys with hyphen otherwise '$secret.data.secretKey' works too
postgres-password: {{ ( .Values.postgresql.auth.password | b64enc ) | default ( index $secret.data "postgres-password" ) | quote }}
password: {{ ( .Values.postgresql.auth.password | b64enc ) | default ( index $secret.data "password" ) | quote }}
postgres-password: {{ ( .Values.postgresql.auth.passwordPostgres | b64enc ) | default ( index $secret.data "postgres-password" ) | quote }}
{{ else -}}
stringData:
# if secret doesn't exist, use provided value from values file or generate a random one
postgres-password: {{ .Values.postgresql.auth.password | default ( randAlphaNum 32 ) | quote }}
password: {{ .Values.postgresql.auth.password | default ( randAlphaNum 32 ) | quote }}
postgres-password: {{ .Values.postgresql.auth.passwordPostgres | default ( randAlphaNum 32 ) | quote }}
{{ end }}
{{- end -}}
4 changes: 2 additions & 2 deletions charts/puris/templates/backend-secrets.yaml
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ .Values.backend.puris.secret }}
name: {{ .Values.backend.puris.existingSecret }}

Check notice

Code scanning / KICS

Using Kubernetes Native Secret Management

External secret storage is not in use
namespace: {{ .Release.Namespace }}
type: Opaque
# use lookup function to check if secret exists
{{- $secret := (lookup "v1" "Secret" .Release.Namespace .Values.backend.puris.secret) }}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace .Values.backend.puris.existingSecret) }}
{{ if $secret -}}
data:
# if secret exists, use value provided from values file (to cover update scenario) or existing value from secret
Expand Down
8 changes: 5 additions & 3 deletions charts/puris/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -358,7 +358,7 @@ backend:

puris:
# -- Secret for backend passwords. For more information look into 'backend-secrets.yaml' file.
secret: "secret-backend-puris"
existingSecret: "secret-backend-puris"
api:
# -- The API key of the PURIS application. Secret-key 'puris-api-key'.
key: "test"
Expand Down Expand Up @@ -463,7 +463,9 @@ postgresql:
database: "postgres"
# -- Secret containing the password. For more information look into 'backend-secrets-postgres.yaml' file.
existingSecret: "secret-postgres-init"
# -- Username for the database.
# -- Username for the root user and for the database.
username: "puris"
# -- Password for the root user. Secret-key 'password'
password: ""

Check failure

Code scanning / CodeQL

Empty password in configuration file High

Empty password in configuration file.
# -- Password for the database. Secret-key 'postgres-password'.
password: "password"
passwordPostgres: "password"

0 comments on commit 3f704e6

Please sign in to comment.