Add optional password secret

charts/portainer/templates/deployment.yaml

@@ -37,9 +37,15 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           {{- end }}
-      {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.edgeNodePort))) }}
-          args:  [ '--tunnel-port','{{ .Values.service.edgeNodePort }}' ]
-      {{- end }}          
+          args:
+          {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.edgeNodePort))) }}
+            - "--tunnel-port"
+            - "{{ .Values.service.edgeNodePort }}"
+          {{- end }}          
+          {{- if (not (empty .Values.admin.password)) }}
+            - "--admin-password"
+            - "'${ADMIN_PASSWORD_HASH}'"
+          {{- end }}          
           volumeMounts:
             - name: data
               mountPath: /data
@@ -60,3 +66,11 @@ spec:
               port: 9000
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          env:
+            {{- if (not (empty .Values.admin.password)) }}
+            - name: ADMIN_PASSWORD_HASH
+              valueFrom:
+                secretKeyRef:
+                  name: portainer-initial-credentials
+                  key: password
+            {{- end }}

charts/portainer/templates/secret.yml

@@ -0,0 +1,13 @@
+{{ $htpasswdString := htpasswd .Values.admin.username .Values.admin.password -}}
+{{ $htpasswdHash := split ":" $htpasswdString -}}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: portainer-initial-credentials
+  namespace: {{ .Release.Namespace }}  
+  labels:
+    {{- include "portainer.selectorLabels" . | nindent 8 }}
+data:
+  username: {{ default "" .Values.admin.username | b64enc | quote }}
+  password: {{ $htpasswdHash._1 | b64enc | quote }}

charts/portainer/values.yaml

@@ -4,6 +4,10 @@
 
 replicaCount: 1
 
+admin:
+  username: admin
+  password: 
+
 # If enterpriseEdition is enabled, then use the values below _instead_ of those in .image
 enterpriseEdition: 
   enabled: false