helm-chart: Improve templates (#1555)

- Prevent template injection by using `quote`
- Using `nindent` instead of `indent` to allow indenting templates for readability
- Using `with` to reduce duplication

Signed-off-by: Marco Franssen <[email protected]>

Author: marcofranssen

charts/fluent-operator/templates/NOTES.txt

@@ -1,6 +1,7 @@
 Thank you for installing  {{ .Chart.Name }}
-Your release is named    {{ .Release.Name }}
+Your release is named     {{ .Release.Name }}
 
-To learn more about the release ,try:
-   $ helm status  {{ .Release.Name }}  -n  {{ .Release.Namespace }}
-   $ helm get  {{ .Release.Name }}  -n {{ .Release.Namespace }}
+To learn more about the release, try:
+
+   $ helm status {{ .Release.Name }} -n  {{ .Release.Namespace }}
+   $ helm get {{ .Release.Name }} -n {{ .Release.Namespace }}

charts/fluent-operator/templates/_helpers.tpl

@@ -51,15 +51,15 @@ helm.sh/chart: {{ include "fluent-operator.chart" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
 {{- end }}
 
 {{/*
 Selector labels
 */}}
 {{- define "fluent-operator.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "fluent-operator.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
 {{- end }}
 
 {{/*

charts/fluent-operator/templates/fluent-operator-clusterRoleBinding.yaml

@@ -13,5 +13,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: fluent-operator
-  namespace: {{ .Release.Namespace }}
-{{- end }}
+  namespace: {{ .Release.Namespace | quote }}
+{{- end }}

charts/fluent-operator/templates/fluent-operator-deployment.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/component: operator
     app.kubernetes.io/name: fluent-operator
   annotations:
-    {{- toYaml .Values.operator.annotations| nindent 4 }}
+    {{- toYaml .Values.operator.annotations | nindent 4 }}
 spec:
   selector:
     matchLabels:
@@ -19,12 +19,12 @@ spec:
       labels:
         app.kubernetes.io/component: operator
         app.kubernetes.io/name: fluent-operator
-        {{- if .Values.operator.labels }}
-        {{- toYaml .Values.operator.labels | nindent 8 }}
+        {{- with .Values.operator.labels }}
+        {{- toYaml . | nindent 8 }}
         {{- end }}
-      {{- if .Values.operator.annotations }}
+      {{- with .Values.operator.annotations }}
       annotations:
-        {{- toYaml .Values.operator.annotations| nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
       {{- if eq .Values.containerRuntime "docker" }}
@@ -90,7 +90,7 @@ spec:
         image: {{ .Values.operator.container.repository }}:{{ .Values.operator.container.tag }}
         {{- if .Values.operator.securityContext }}
         securityContext:
-          {{ toYaml .Values.operator.securityContext | nindent 10 }}
+          {{- toYaml .Values.operator.securityContext | nindent 10 }}
         {{- end }}
         resources:
           {{- toYaml .Values.operator.resources | nindent 10 }}
@@ -111,27 +111,27 @@ spec:
         - name: env
           mountPath: /fluent-operator
       serviceAccountName: fluent-operator
-      {{- if .Values.operator.priorityClassName }}
-      priorityClassName: {{ .Values.operator.priorityClassName | quote }}
+      {{- with .Values.operator.priorityClassName }}
+      priorityClassName: {{ . | quote }}
       {{- end }}
-      {{- if .Values.operator.imagePullSecrets }}
+      {{- with .Values.operator.imagePullSecrets }}
       imagePullSecrets:
-        {{ toYaml .Values.operator.imagePullSecrets | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.operator.tolerations }}
+      {{- with .Values.operator.tolerations }}
       tolerations:
-        {{ toYaml .Values.operator.tolerations | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.operator.nodeSelector }}
+      {{- with .Values.operator.nodeSelector }}
       nodeSelector:
-        {{ toYaml .Values.operator.nodeSelector | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.operator.affinity }}
+      {{- with .Values.operator.affinity }}
       affinity:
-        {{ toYaml .Values.operator.affinity | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.operator.podSecurityContext }}
+      {{- with .Values.operator.podSecurityContext }}
       securityContext:
-        {{ toYaml .Values.operator.podSecurityContext | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
-{{- end }}
+{{- end }}

charts/fluent-operator/templates/fluentbit-clusterfilter-containerd.yaml

@@ -1,6 +1,6 @@
-{{- if .Values.Kubernetes -}}
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.filter.containerd.enable -}}
+{{- if .Values.Kubernetes }}
+{{- if .Values.fluentbit.enable }}
+{{- if .Values.fluentbit.filter.containerd.enable }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterFilter
 metadata:

charts/fluent-operator/templates/fluentbit-clusterfilter-kubernetes.yaml

@@ -1,6 +1,6 @@
-{{- if .Values.Kubernetes -}}
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.filter.kubernetes.enable -}}
+{{- if .Values.Kubernetes }}
+{{- if .Values.fluentbit.enable }}
+{{- if .Values.fluentbit.filter.kubernetes.enable }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterFilter
 metadata:
@@ -17,7 +17,7 @@ spec:
       kubeTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
       {{- $params := omit .Values.fluentbit.filter.kubernetes "enable" }}
       {{- if .Values.fluentbit.output.stdout.enable }}
-      {{- $_ := set $params "k8sLoggingExclude" true -}}
+      {{- $_ := set $params "k8sLoggingExclude" true }}
       {{- end }}
       {{- with $params }}
       {{- . | toYaml | nindent 6 }}

charts/fluent-operator/templates/fluentbit-clusterfilter-multiline.yaml

@@ -1,6 +1,6 @@
-{{- if .Values.Kubernetes -}}
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.filter.multiline.enable -}}
+{{- if .Values.Kubernetes }}
+{{- if .Values.fluentbit.enable }}
+{{- if .Values.fluentbit.filter.multiline.enable }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterFilter
 metadata:

charts/fluent-operator/templates/fluentbit-clusterfilter-systemd.yaml

@@ -1,6 +1,6 @@
-{{- if .Values.Kubernetes -}}
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.filter.systemd.enable -}}
+{{- if .Values.Kubernetes }}
+{{- if .Values.fluentbit.enable }}
+{{- if .Values.fluentbit.filter.systemd.enable }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterFilter
 metadata:

charts/fluent-operator/templates/fluentbit-clusterinput-metrics.yaml

@@ -1,5 +1,5 @@
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.input.fluentBitMetrics -}}
+{{- if .Values.fluentbit.enable }}
+{{- with .Values.fluentbit.input.fluentBitMetrics }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterInput
 metadata:
@@ -9,6 +9,6 @@ metadata:
     fluentbit.fluent.io/component: logging
 spec:
   fluentBitMetrics:
-{{ toYaml .Values.fluentbit.input.fluentBitMetrics | indent 4}}
+    {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- end }}

charts/fluent-operator/templates/fluentbit-clusterinput-nodeExporterMetrics.yaml

@@ -1,6 +1,6 @@
-{{- if .Values.Kubernetes -}}
-{{- if .Values.fluentbit.enable -}}
-{{- if .Values.fluentbit.input.nodeExporterMetrics -}}
+{{- if .Values.Kubernetes }}
+{{- if .Values.fluentbit.enable }}
+{{- with .Values.fluentbit.input.nodeExporterMetrics }}
 apiVersion: fluentbit.fluent.io/v1alpha2
 kind: ClusterInput
 metadata:
@@ -10,7 +10,7 @@ metadata:
     fluentbit.fluent.io/component: logging
 spec:
   nodeExporterMetrics:
-{{ toYaml .Values.fluentbit.input.nodeExporterMetrics | indent 4}}
+    {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- end }}
 {{- end }}