feat: restructure config/secret handling, harden chart, and add CI (v6.0.0)#78
Merged
Conversation
BREAKING CHANGE: `secret.enabled` and `secret.useExisting` are removed. Non-sensitive settings now always render into a ConfigMap and sensitive ones (admin password/token, cookie signing key, S3 keys, OAuth2 client secret) into a Secret, both mounted into the pod. Use `secret.existingSecret` to bring your own Secret (e.g. SOPS-encrypted). - Move the cookie signing key into the Secret; allow sourcing it from an existing Secret via kellnr.registry.cookieSigningKeySecretRef (#67) - Mount ConfigMap and Secret simultaneously; add extraEnvVars / extraEnvVarsCM / extraEnvVarsSecret escape hatches (#68, #61) - Add startup/liveness/readiness probes against /api/v1/health - Disable ServiceAccount token automount by default - Expose registry download* and s3 *Timeout settings - Add values.schema.json and a `helm test` connection hook - Bump chart to 6.0.0 and document the upgrade
- Add lint-test workflow running chart-testing lint plus a kind-based install that exercises the new `helm test` hook on pull requests - Add .github/ct.yaml (target-branch, chart-dirs, skip maintainer check) - Scope release triggers to main, apply least-privilege per-job permissions, and add a concurrency group - Bump chart-releaser-action v1.2.1->v1.7.0, create-pull-request v6->v8, setup-helm v4->v5, checkout v4->v6
ct lint runs yamllint, whose comments rule requires two spaces before inline comments; the chart uses the `value # default` one-space style throughout. Add a yamllint config (relaxed comments rule) and point ct at it via lint-conf.
Add a "Configuration storage (ConfigMap and Secret)" section covering secret.existingSecret and pointing to the extra-env settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restructures how the chart handles configuration and secrets, hardens the defaults, and adds real CI. This is a breaking change (chart
v6.0.0).Closes #67, closes #68, closes #61.
Config / secret restructure (breaking)
Previously
secret.enabledflipped the entire config between a ConfigMap or a Secret. The chart now always renders both and mounts them together — non-sensitive values in a ConfigMap, sensitive ones in a Secret — so secrets are never stored in a plaintext ConfigMap.kellnr.registry.cookieSigningKeySecretRef.extraEnvVars,extraEnvVarsCM,extraEnvVarsSecretescape hatches.secret.enabled/secret.useExistingare removed;secret.existingSecretreplaces the bring-your-own-Secret (e.g. SOPS) path.Sensitive vars routed to the Secret:
ADMIN_PWD,ADMIN_TOKEN,COOKIE_SIGNING_KEY,S3__ACCESS_KEY/SECRET_KEY,OAUTH2__CLIENT_SECRET(Postgres pwd keeps its existingsecretKeyRef).Hardening & additions
/api/v1/health, enabled by default and tunable.automountServiceAccountToken: false).registry.downloadTimeoutSeconds/downloadMaxConcurrent/downloadCounterFlushSeconds,s3.connectTimeoutSeconds/requestTimeoutSeconds.values.schema.jsonvalidates values (e.g. requireskellnr.origin.hostname).helm testconnection hook that curls the health endpoint through the Service.CI
ct lint+ a kind-basedct installthat runs the newhelm testhook (previously nothing ran on PRs).main, least-privilege per-job permissions, a concurrency group, and updated action versions (chart-releaserv1.2.1→v1.7.0, create-pull-requestv6→v8, setup-helmv4→v5, checkoutv4→v6).Upgrade notes
See the Chart version 6.0.0 section added to the README. Most inline users need no change;
secret.useExistingusers move tosecret.existingSecret.Testing
helm lintpasses (schema included); rendered and verified all modes — both sources mounted, sensitive routing, cookie inline vs.secretKeyRef,existingSecret, probes (render + disable), SA token off, new env vars, schema rejection of bad input, and thehelm testpod. All three workflow YAMLs parse and the version increment satisfiesct.