Conversation
WalkthroughThis pull request updates the plane-enterprise Helm chart. It bumps the application version from 1.1.4 to 1.1.5 and introduces a new Kubernetes Secret resource for the silo service. Conditional logic is added across multiple workload YAML files to include references to the new secret ( Changes
Sequence Diagram(s)sequenceDiagram
participant Values as .Values.services.silo.enabled
participant Chart as Helm Chart Template
participant Secret as Silo Secret Resource
participant Workload as Deployment/Job/Worker
Values->>Chart: Check if silo is enabled
alt If enabled
Chart->>Secret: Create or fetch SILO_HMAC_SECRET_KEY secret
Secret-->>Chart: Provide secret details
Chart->>Workload: Include secret reference in env configuration
else Not enabled
Chart->>Workload: Skip secret configuration
end
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
charts/plane-enterprise/templates/config-secrets/silo.yaml (5)
1-16: Secret Resource Template Review
- The new Kubernetes Secret is conditionally created based on
.Values.services.silo.enabled, which is a proper guard.- The logic first checks if a custom HMAC secret key is provided via
.Values.env.silo_envs.hmac_secret_key. If not, it attempts to retrieve an existing Secret via thelookupfunction; otherwise, it generates a random 32-character string.- Suggestion: When retrieving the secret key from an existing Secret (line 12), note that values in a Secret’s
.datafield are typically base64 encoded. If the intention is to work with plain text instringData, consider decoding the value using theb64decfunction. For example:- SILO_HMAC_SECRET_KEY: {{ (lookup "v1" "Secret" .Release.Namespace (printf "%s-silo-secrets" .Release.Name)).data.SILO_HMAC_SECRET_KEY | default (randAlphaNum 32) | quote }} + SILO_HMAC_SECRET_KEY: {{ (lookup "v1" "Secret" .Release.Namespace (printf "%s-silo-secrets" .Release.Name)).data.SILO_HMAC_SECRET_KEY | b64dec | default (randAlphaNum 32) | quote }}🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
30-36: ConfigMap HMAC Key Logic Consistency
- The ConfigMap section (lines 30–36) replicates the logic for setting
SILO_HMAC_SECRET_KEYsimilar to the Secret. This ensures that if a key is provided in values it is used; otherwise, the template tries to retrieve an existing value before generating a new one.- Suggestion: Since similar logic is repeated in both the Secret and ConfigMap resources, consider abstracting this into a common template helper to reduce duplication and ensure consistency in future changes.
38-44: CORS Configuration Logic Review
- The conditional block for
CORS_ALLOWED_ORIGINScovers the wildcard scenario and a nuanced concatenation of origins.- Note: Ensure that the concatenated URLs (line 41) meet the intended format and that commas are the appropriate delimiter for your use case. If this pattern is reused elsewhere, consider consolidating it into a helper template.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 44-44: trailing spaces
(trailing-spaces)
50-56: RabbitMQ URL Configuration Check
- The template provides conditional construction of the
AMQP_URLbased on whether a local setup or an external URL is provided.- Suggestion: For consistency, consider quoting the external URL value in line 53 if it is intended to be a string literal.
61-67: Database URL Conditional Logic
- The conditional structure for setting
DATABASE_URLis clear: it selects between a local PostgreSQL setup, a remote URL, or an empty string.- Nitpick: For templating consistency, consider using the dash syntax (e.g.,
{{- else }}) throughout the conditional blocks.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
charts/plane-enterprise/Chart.yaml(1 hunks)charts/plane-enterprise/templates/config-secrets/silo.yaml(1 hunks)charts/plane-enterprise/templates/workloads/api.deployment.yaml(1 hunks)charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml(1 hunks)charts/plane-enterprise/templates/workloads/migrator.job.yaml(1 hunks)charts/plane-enterprise/templates/workloads/silo.deployment.yaml(1 hunks)charts/plane-enterprise/templates/workloads/worker.deployment.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- charts/plane-enterprise/Chart.yaml
🔇 Additional comments (13)
charts/plane-enterprise/templates/workloads/migrator.job.yaml (1)
35-39: Conditional Secret Injection in Job SpecificationThe conditional block for including the silo secret reference is correctly implemented. By wrapping the secret reference within an
ifblock that checks.Values.services.silo.enabled, the chart cleanly ensures that the{{ .Release.Name }}-silo-secretsis only injected when the silo service is enabled. Verify that the YAML indentation remains consistent when rendered.charts/plane-enterprise/templates/workloads/worker.deployment.yaml (1)
47-51: Consistent Conditional Secret Injection for Worker DeploymentThe conditional block that adds the silo secret reference is properly structured. This ensures that the
{{ .Release.Name }}-silo-secretsis only included when.Values.services.silo.enabledis true. The implementation is consistent with similar modifications in other workload files.charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml (1)
47-51: Conditional Secret Reference in Beat-worker DeploymentThe additional block introduces a conditional secret reference that integrates seamlessly with the existing environment variable configuration. The approach ensures that silo secrets are only included when enabled, mirroring the pattern used in the other deployments.
charts/plane-enterprise/templates/workloads/api.deployment.yaml (1)
69-73: Secret Injection via Conditional Block in API DeploymentThe change adds a conditional block to insert the silo secret reference into the API deployment’s
envFromlist only when.Values.services.silo.enabledis true. This maintains consistency across deployments and ensures secure, environment-specific secret management.charts/plane-enterprise/templates/workloads/silo.deployment.yaml (1)
83-85: Mandatory Secret Reference in Silo DeploymentThe silo deployment now explicitly includes the
{{ .Release.Name }}-silo-secretsreference as part of the container's environment sources. Since this file is conditionally rendered when.Values.services.silo.enabledis true, the direct inclusion is appropriate and consistent with the approach used in other workload configurations.charts/plane-enterprise/templates/config-secrets/silo.yaml (8)
46-49: URL Endpoint Configurations
- The API endpoints (
APP_BASE_URL,API_BASE_URL, andSILO_API_BASE_URL) are correctly templated using.Valuesand.Releasevariables.- The use of default values (e.g.,
"cluster.local") appears consistent with standard configurations.
58-59: Payment and Feature Flag Server Endpoints
- The definitions for
PAYMENT_SERVER_BASE_URLandFEATURE_FLAG_SERVER_BASE_URLuse the expected service discovery patterns and templating.
69-73: Redis URL Configuration
- The Redis configuration correctly differentiates between a local setup and a remote URL scenario.
- The use of quoting for the remote URL in line 72 ensures that an empty default is explicitly set.
76-78: Sentry Configuration Review
- The Sentry-related keys (
SENTRY_DSN,SENTRY_ENVIRONMENT, andSENTRY_TRACES_SAMPLE_RATE) are configured with defaults that help prevent misconfiguration.
80-84: Slack Integration Secrets
- The template conditionally includes Slack integration secrets based on whether the Slack connector is enabled.
- The approach of providing a default empty string with proper quoting is sound.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 80-80: trailing spaces
(trailing-spaces)
86-93: GitHub Integration Secrets
- The GitHub integration section cleanly handles client IDs, secrets, app names, and private keys using the same conditional and default logic as other connector configurations.
95-99: GitLab Integration Secrets
- The GitLab connector is configured similarly to the Slack and GitHub sections, ensuring consistency in secret management.
100-101: Template Conditional Closure
- The template correctly terminates the block with
{{- end }}, ensuring that resources are only generated when.Values.services.silo.enabledis true.- This closure prevents unintentional resource creation.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 101-101: no new line character at the end of file
(new-line-at-end-of-file)
2 participants
Summary by CodeRabbit
Chores
New Features