Skip to content

Commit a2e32e6

Browse files
butonicbutonic
authored
Merge pull request opencloud-eu#63 from Tim-herbie/feature/support-secrets
Add support for existing secrets and replace plaintext values with secrets
2 parents 3e59ef5 + 95d7881 commit a2e32e6

File tree

18 files changed

+326
-67
lines changed

18 files changed

+326
-67
lines changed

‎charts/opencloud/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ maintainers:
1010
email: [email protected]
1111
url: https://opencloud.eu
1212
type: application
13-
version: 0.2.0
13+
version: 0.2.1
1414
# renovate: datasource=docker depName=opencloudeu/opencloud-rolling
1515
appVersion: latest
1616
kubeVersion: ""

‎charts/opencloud/README.md‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,7 @@ This will prepend `my-registry.com/` to all image references in the chart. For e
250250
| `opencloud.logColor` | Enable log color | `false` |
251251
| `opencloud.logPretty` | Enable pretty logging | `false` |
252252
| `opencloud.insecure` | Insecure mode (for self-signed certificates) | `true` |
253+
| `opencloud.existingSecret` | Name of the existing secret | `` |
253254
| `opencloud.adminPassword` | Admin password | `admin` |
254255
| `opencloud.createDemoUsers` | Create demo users | `false` |
255256
| `opencloud.resources` | CPU/Memory resource requests/limits | `{}` |
@@ -261,12 +262,14 @@ This will prepend `my-registry.com/` to all image references in the chart. For e
261262
| `opencloud.smtp.host` | SMTP host | `` |
262263
| `opencloud.smtp.port` | SMTP port | `587` |
263264
| `opencloud.smtp.sender` | SMTP sender | `` |
265+
| `opencloud.smtp.existingSecret` | Name of the existing secret | `` |
264266
| `opencloud.smtp.username` | SMTP username | `` |
265267
| `opencloud.smtp.password` | SMTP password | `` |
266268
| `opencloud.smtp.insecure` | SMTP insecure | `false` |
267269
| `opencloud.smtp.authentication` | SMTP authentication | `plain` |
268270
| `opencloud.smtp.encryption` | SMTP encryption | `starttls` |
269271
| `opencloud.storage.s3.internal.enabled` | Enable internal MinIO instance | `true` |
272+
| `opencloud.storage.s3.internal.existingSecret` | Name of the existing secret | `` |
270273
| `opencloud.storage.s3.internal.rootUser` | MinIO root user | `opencloud` |
271274
| `opencloud.storage.s3.internal.rootPassword` | MinIO root password | `opencloud-secret-key` |
272275
| `opencloud.storage.s3.internal.bucketName` | MinIO bucket name | `opencloud-bucket` |
@@ -279,6 +282,7 @@ This will prepend `my-registry.com/` to all image references in the chart. For e
279282
| `opencloud.storage.s3.external.enabled` | Enable external S3 | `false` |
280283
| `opencloud.storage.s3.external.endpoint` | External S3 endpoint URL | `""` |
281284
| `opencloud.storage.s3.external.region` | External S3 region | `default` |
285+
| `opencloud.storage.s3.external.existingSecret` | Name of the existing secret | `` |
282286
| `opencloud.storage.s3.external.accessKey` | External S3 access key | `""` |
283287
| `opencloud.storage.s3.external.secretKey` | External S3 secret key | `""` |
284288
| `opencloud.storage.s3.external.bucket` | External S3 bucket | `""` |
@@ -297,6 +301,7 @@ By default the chart deploys an internal keycloak. It can be disabled and replac
297301
| `keycloak.internal.image.tag` | Keycloak image tag | `26.1.4` |
298302
| `keycloak.internal.image.pullPolicy` | Image pull policy | `IfNotPresent` |
299303
| `keycloak.internal.replicas` | Number of replicas | `1` |
304+
| `keycloak.internal.existingSecret` | Name of the existing secret | `` |
300305
| `keycloak.internal.adminUser` | Admin user | `admin` |
301306
| `keycloak.internal.adminPassword` | Admin password | `admin` |
302307
| `keycloak.internal.realm` | Realm name | `openCloud` |
@@ -327,6 +332,7 @@ keycloak:
327332
| --------- | ----------- | ------- |
328333
| `postgres.enabled` | Enable PostgreSQL | `true` |
329334
| `postgres.database` | Database name | `keycloak` |
335+
| `postgres.existingSecret` | Name of the existing secret | `` |
330336
| `postgres.user` | Database user | `keycloak` |
331337
| `postgres.password` | Database password | `keycloak` |
332338
| `postgres.resources` | CPU/Memory resource requests/limits | `{}` |
@@ -349,9 +355,8 @@ keycloak:
349355
| `onlyoffice.persistence.enabled` | Enable persistence | `true` |
350356
| `onlyoffice.persistence.size` | Size of the persistent volume | `2Gi` |
351357
| `onlyoffice.resources` | CPU/Memory resource requests/limits | `{}` |
352-
| `onlyoffice.config.coAuthoring.token.enable.request.inbox` | Enable token for incoming requests | `true` |
353-
| `onlyoffice.config.coAuthoring.token.enable.request.outbox` | Enable token for outgoing requests | `true` |
354-
| `onlyoffice.config.coAuthoring.token.enable.browser` | Enable token for browser requests | `true` |
358+
| `onlyoffice.config.coAuthoring.secret.existingSecret` | Name of the existing secret | `` |
359+
| `onlyoffice.config.coAuthoring.secret.session.string` | Session string for onlyoffice | `` |
355360
| `onlyoffice.collaboration.enabled` | Enable collaboration service | `true` |
356361

357362
If you use Traefik and enable OnlyOffice, this chart will automatically create a `Middleware`
@@ -369,6 +374,7 @@ This ensures the `X-Forwarded-Proto: https` header is added as required by OnlyO
369374
| `collabora.image.repository` | Collabora image repository | `collabora/code` |
370375
| `collabora.image.tag` | Collabora image tag | `24.04.13.2.1` |
371376
| `collabora.image.pullPolicy` | Image pull policy | `IfNotPresent` |
377+
| `collabora.existingSecret` | Name of the existing secret | `` |
372378
| `collabora.adminUser` | Admin user | `admin` |
373379
| `collabora.adminPassword` | Admin password | `admin` |
374380
| `collabora.ssl.enabled` | Enable SSL | `true` |
@@ -402,7 +408,7 @@ The following HTTPRoutes are created when `httpRoute.enabled` is set to `true`:
402408
- Port: 9200
403409
- Headers: Removes Permissions-Policy header to prevent browser console errors
404410

405-
2. **Keycloak HTTPRoute** (when `keycloak.enabled` is `true`):
411+
2. **Keycloak HTTPRoute** (when `keycloak.internal.enabled` is `true`):
406412
- Hostname: `global.domain.keycloak`
407413
- Service: `{{ release-name }}-keycloak`
408414
- Port: 8080

‎charts/opencloud/files/onlyoffice/local.json.gotmpl‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,9 @@
1515
"outbox": {
1616
"header": "Authorization"
1717
}
18-
},
19-
"secret": {
20-
"inbox": {
21-
"string": "{{ .Values.onlyoffice.config.coAuthoring.secret.inbox.string }}"
22-
},
23-
"outbox": {
24-
"string": "{{ .Values.onlyoffice.config.coAuthoring.secret.outbox.string }}"
25-
},
26-
"session": {
27-
"string": "{{ .Values.onlyoffice.config.coAuthoring.secret.session.string }}"
28-
}
2918
}
3019
}
3120
},
32-
"rabbitmq": {
33-
"url": "{{ .Values.onlyoffice.config.rabbitmq.url }}"
34-
},
3521
"FileConverter": {
3622
"converter": {
3723
"inputLimits": [

‎charts/opencloud/templates/NOTES.txt‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,7 @@ IMPORTANT: This is a development deployment. For production use, you MUST change
1414
3. PostgreSQL: user: keycloak, password: keycloak
1515
4. MinIO: rootUser: opencloud, rootPassword: opencloud-secret-key
1616
5. OnlyOffice Database: sql.dbUser: onlyoffice, sql.dbPass: onlyoffice
17-
6. OnlyOffice Secret Keys: secret.inbox/outbox/session.string: B8LjkNqGxn6gf8bkuBUiMwyuCFwFddnu
18-
7. RabbitMQ: url: amqp://guest:guest@localhost
17+
6. RabbitMQ: url: amqp://guest:guest@localhost
1918

2019
Using default credentials in production environments poses significant security risks.
2120

@@ -29,12 +28,12 @@ The following services have been deployed:
2928
- S3 Storage: {{ if .Values.opencloud.storage.s3.external.enabled }}{{ .Values.opencloud.storage.s3.external.endpoint }}{{ else if .Values.opencloud.storage.s3.internal.enabled }}MinIO ({{ include "opencloud.minio.fullname" . }}){{ else }}Not configured{{ end }}
3029
- S3 Bucket: {{ if .Values.opencloud.storage.s3.external.enabled }}{{ .Values.opencloud.storage.s3.external.bucket }}{{ else if .Values.opencloud.storage.s3.internal.enabled }}{{ .Values.opencloud.storage.s3.internal.bucketName }}{{ else }}Not configured{{ end }}
3130

32-
{{- if .Values.keycloak.enabled }}
31+
{{- if .Values.keycloak.internal.enabled }}
3332
2. Keycloak (Authentication):
3433
- Service: {{ include "opencloud.keycloak.fullname" . }}
3534
- Port: 8080
36-
- Username: {{ .Values.keycloak.adminUser }}
37-
- Password: {{ .Values.keycloak.adminPassword }}
35+
- Username: {{ .Values.keycloak.internal.adminUser }}
36+
- Password: {{ .Values.keycloak.internal.adminPassword }}
3837
{{- end }}
3938

4039
{{- if .Values.opencloud.storage.s3.internal.enabled }}
@@ -61,7 +60,7 @@ All HTTPRoutes are configured to use the Gateway named "{{ .Values.httpRoute.gat
6160

6261
Make sure the Gateway exists and is properly configured to accept traffic for the following domains:
6362
- OpenCloud: {{ include "opencloud.domain" . }} (Service: {{ include "opencloud.opencloud.fullname" . }}, Port: 9200)
64-
{{- if .Values.keycloak.enabled }}
63+
{{- if .Values.keycloak.internal.enabled }}
6564
- Keycloak: {{ include "opencloud.keycloak.domain" . }} (Service: {{ include "opencloud.keycloak.fullname" . }}, Port: 8080)
6665
{{- end }}
6766
{{- if .Values.opencloud.storage.s3.internal.enabled }}
@@ -77,7 +76,7 @@ to expose these services externally.
7776

7877
Example domains for your ingress configuration:
7978
- OpenCloud: {{ include "opencloud.domain" . }} (Service: {{ include "opencloud.opencloud.fullname" . }}, Port: 9200)
80-
{{- if .Values.keycloak.enabled }}
79+
{{- if .Values.keycloak.internal.enabled }}
8180
- Keycloak: {{ include "opencloud.keycloak.domain" . }} (Service: {{ include "opencloud.keycloak.fullname" . }}, Port: 8080)
8281
{{- end }}
8382
{{- if .Values.opencloud.storage.s3.internal.enabled }}

‎charts/opencloud/templates/collabora/deployment.yaml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,23 @@ spec:
3838
--o:welcome.enable=false \
3939
--o:net.frame_ancestors={{ include "opencloud.domain" . }}
4040
- name: username
41-
value: "{{ .Values.collabora.admin.user | default "admin" }}"
41+
valueFrom:
42+
secretKeyRef:
43+
name: {{- if .Values.collabora.existingSecret }}
44+
{{ .Values.collabora.existingSecret }}
45+
{{- else }}
46+
{{ include "opencloud.fullname" . }}-collabora
47+
{{- end }}
48+
key: username
4249
- name: password
43-
value: "{{ .Values.collabora.admin.password | default "admin" }}"
50+
valueFrom:
51+
secretKeyRef:
52+
name: {{- if .Values.collabora.existingSecret }}
53+
{{ .Values.collabora.existingSecret }}
54+
{{- else }}
55+
{{ include "opencloud.fullname" . }}-collabora
56+
{{- end }}
57+
key: password
4458
ports:
4559
- containerPort: 9980
4660
name: http

‎charts/opencloud/templates/collabora/secrets.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if and (not .Values.collabora.existingSecret) .Values.collabora.enabled }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "opencloud.fullname" . }}-collabora
6+
type: Opaque
7+
stringData:
8+
username: {{ .Values.collabora.username }}
9+
password: {{ .Values.collabora.password }}
10+
{{- end }}

‎charts/opencloud/templates/gateway/gateway.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ spec:
4242
selector:
4343
matchLabels:
4444
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
45-
{{- if .Values.keycloak.enabled }}
45+
{{- if .Values.keycloak.internal.enabled }}
4646
{{- if .Values.global.tls.enabled }}
4747
- name: keycloak-https
4848
{{- else }}

‎charts/opencloud/templates/keycloak/deployment.yaml‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,43 @@ spec:
5252
- name: KC_DB_URL
5353
value: jdbc:postgresql://{{ include "opencloud.postgres.fullname" . }}:5432/{{ .Values.postgres.database }}
5454
- name: KC_DB_USERNAME
55-
value: {{ .Values.postgres.user }}
55+
valueFrom:
56+
secretKeyRef:
57+
name: {{- if .Values.postgres.existingSecret }}
58+
{{ .Values.postgres.existingSecret }}
59+
{{- else }}
60+
{{ include "opencloud.postgres.fullname" . }}
61+
{{- end }}
62+
key: username
5663
- name: KC_DB_PASSWORD
57-
value: {{ .Values.postgres.password }}
64+
valueFrom:
65+
secretKeyRef:
66+
name: {{- if .Values.postgres.existingSecret }}
67+
{{ .Values.postgres.existingSecret }}
68+
{{- else }}
69+
{{ include "opencloud.postgres.fullname" . }}
70+
{{- end }}
71+
key: password
5872
- name: KC_FEATURES
5973
value: impersonation
6074
- name: KEYCLOAK_ADMIN
61-
value: {{ .Values.keycloak.internal.adminUser }}
75+
valueFrom:
76+
secretKeyRef:
77+
name: {{- if .Values.keycloak.internal.existingSecret }}
78+
{{ .Values.keycloak.internal.existingSecret }}
79+
{{- else }}
80+
{{ include "opencloud.keycloak.fullname" . }}
81+
{{- end }}
82+
key: adminUser
6283
- name: KEYCLOAK_ADMIN_PASSWORD
63-
value: {{ .Values.keycloak.internal.adminPassword }}
84+
valueFrom:
85+
secretKeyRef:
86+
name: {{- if .Values.keycloak.internal.existingSecret }}
87+
{{ .Values.keycloak.internal.existingSecret }}
88+
{{- else }}
89+
{{ include "opencloud.keycloak.fullname" . }}
90+
{{- end }}
91+
key: adminPassword
6492
{{- if .Values.keycloak.internal.cors.enabled }}
6593
- name: KC_SPI_CORS_ENABLED
6694
value: "true"

‎charts/opencloud/templates/keycloak/secrets.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if and (not .Values.keycloak.internal.existingSecret) .Values.keycloak.internal.enabled }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "opencloud.keycloak.fullname" . }}
6+
type: Opaque
7+
stringData:
8+
adminUser: {{ .Values.keycloak.internal.adminUser }}
9+
adminPassword: {{ .Values.keycloak.internal.adminPassword }}
10+
{{- end }}

‎charts/opencloud/templates/minio/deployment.yaml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,23 @@ spec:
4949
args: ["server", "--console-address", ":9001", "/data"]
5050
env:
5151
- name: MINIO_ROOT_USER
52-
value: {{ .Values.opencloud.storage.s3.internal.rootUser | quote }}
52+
valueFrom:
53+
secretKeyRef:
54+
name: {{- if .Values.opencloud.storage.s3.internal.existingSecret }}
55+
{{ .Values.opencloud.storage.s3.internal.existingSecret }}
56+
{{- else }}
57+
{{ include "opencloud.minio.fullname" . }}
58+
{{- end }}
59+
key: rootUser
5360
- name: MINIO_ROOT_PASSWORD
54-
value: {{ .Values.opencloud.storage.s3.internal.rootPassword | quote }}
61+
valueFrom:
62+
secretKeyRef:
63+
name: {{- if .Values.opencloud.storage.s3.internal.existingSecret }}
64+
{{ .Values.opencloud.storage.s3.internal.existingSecret }}
65+
{{- else }}
66+
{{ include "opencloud.minio.fullname" . }}
67+
{{- end }}
68+
key: rootPassword
5569
ports:
5670
- name: api
5771
containerPort: 9000

0 commit comments

Comments
 (0)