Adapt for memos 0.30.0 - #5
Conversation
|
Warning Review limit reached
Next review available in: 39 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughThe Helm chart adds managed application settings through a generated ConfigMap and Deployment mounts. It adds database, instance, and grouped application configuration values. It adds conditional Gateway API HTTPRoute rendering and installation notes. README documentation covers database, application, and OAuth2 identity-provider configuration. The chart version becomes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 53: Replace every newly added tilde code fence in README.md with backtick
fences, including the fences near the referenced sections, so the README
complies with the configured MD048 Markdownlint rule.
In `@templates/deployment.yaml`:
- Around line 79-89: The deployment template currently renders duplicate
MEMOS_DSN entries when both database.connectionString and
database.existingSecret are configured. Make these inputs mutually exclusive by
changing the conditional flow around database.connectionString and
database.existingSecret, preferably failing template rendering when both are
nonempty; otherwise use an else-if structure and document the connectionString
precedence in the existing configuration documentation.
In `@templates/httproute.yaml`:
- Around line 24-37: Update the HTTPRoute rules loop to emit a list item
immediately for each entry in .Values.httpRoute.rules. Nest matches, filters,
and backendRefs under that item, while allowing rules without matches to remain
valid and use the default "/" prefix behavior.
In `@templates/NOTES.txt`:
- Around line 2-14: Update the HTTPRoute visit message near APP_HOSTNAME to
avoid hardcoding https://; derive the scheme from a configurable value or print
a scheme-neutral hostname and path. Preserve the existing hostname and rule-path
rendering for both HTTP and HTTPS listener configurations.
In `@templates/settings.yaml`:
- Around line 8-33: Update templates/settings.yaml (lines 8-33) so
credential-bearing settings, especially settings.idps[*].config with
clientSecret, are supplied through Secret-backed settings-file support rather
than serialized into the ConfigMap; retain only non-sensitive settings in the
ConfigMap. Update README.md (lines 101-130) to replace the plaintext
clientSecret example with the Secret-backed configuration flow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6b3d290a-e7c2-4adb-99c6-a5f1411e3d4f
📒 Files selected for processing (8)
CHANGELOG.mdChart.yamlREADME.mdtemplates/NOTES.txttemplates/deployment.yamltemplates/httproute.yamltemplates/settings.yamlvalues.yaml
| {{- if .Values.database.connectionString }} | ||
| - name: MEMOS_DSN | ||
| value: {{ .Values.database.connectionString }} | ||
| {{- end }} | ||
| {{- if .Values.database.existingSecret }} | ||
| - name: MEMOS_DSN | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: {{ .Values.database.existingSecret.name }} | ||
| key: {{ .Values.database.existingSecret.key }} | ||
| {{- end }} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
According to the current Kubernetes API documentation, what is the behavior when a container env list contains multiple EnvVar entries with the same name?
💡 Result:
According to the Kubernetes API documentation and established behavior, when a container's environment variable list (env) contains multiple entries with the same name, the values defined in the env list take precedence over values defined in envFrom [1][2][3]. While Kubernetes allows these duplicates to be persisted, they are generally discouraged [4][5]. The behavior associated with duplicate env entries is as follows: 1. Precedence: Values defined explicitly in the env list take precedence over those defined via envFrom [1][2][3]. 2. Patching and Updates: The presence of duplicate names in the env list can cause significant issues with kubectl apply and other patching mechanisms [4][5]. Because the env list uses the name field as a merge key, these tools often treat the key as ambiguous [5]. Consequently, attempting to update or remove one duplicate entry can result in all entries with that name being deleted or cause patch errors [4][5][6][7]. 3. Validation: Historically, Kubernetes has not strictly enforced uniqueness for the name field within the env list at the API level, allowing such configurations to be created and run [7]. However, it is strongly recommended to avoid duplicate names to prevent unexpected application behavior and operational issues with tooling [4][5]. Users are advised to maintain unique names for all environment variables within a container's configuration [4][5].
Citations:
- 1: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/
- 2: https://stackoverflow.com/questions/66288565/duplicated-env-variable-names-in-pod-definition-what-is-the-precedence-rule-to
- 3: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/
- 4: Env variable is missing in container, after cleanup of duplications in deployment kubernetes/kubernetes#121541
- 5:
kubectl apply(client-side) removes all entries when attempting to remove a single duplicated entry in a persisted object kubernetes/kubernetes#58477 - 6:
kubectl apply(client-side) removes all entries when attempting to remove a single duplicated entry in a persisted object kubernetes/kubernetes#58477 - 7: Failed to create three way merge patch when container environment variable specified multiple times kubernetes/kubernetes#86163
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate deployment.yaml and values docs =="
fd -a 'deployment.yaml|README|values\.yaml|\.yaml$' . | sed 's#^\./##' | head -200
echo
echo "== templates/deployment.yaml relevant section =="
if [ -f templates/deployment.yaml ]; then
nl -ba templates/deployment.yaml | sed -n '60,105p'
else
fd -a 'deployment.yaml' .
fi
echo
echo "== search MEMOS_DSN and database values doc =="
rg -n "MEMOS_DSN|database:|existingSecret|connectionString|existingSecret:" -S .Repository: usememos/helm
Length of output: 774
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== templates/deployment.yaml relevant section =="
sed -n '60,105p' templates/deployment.yaml
echo
echo "== search MEMOS_DSN and database values doc =="
rg -n "MEMOS_DSN|database:|existingSecret|connectionString|existingSecret:" -S .
echo
echo "== values.yaml database section =="
sed -n '1,160p' values.yamlRepository: usememos/helm
Length of output: 5939
Make MEMOS_DSN inputs mutually exclusive.
values.yaml and README.md present database.connectionString and database.existingSecret as an either-or choice. If both are set, this template emits two MEMOS_DSN env entries; the connectionString value will take precedence over the secretKeyRef, but Kubernetes still keeps both entries and can make later kubectl apply updates ambiguous. Fail when both are nonempty, or replace the second block with else if so connectionString takes precedence and document that precedence.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/deployment.yaml` around lines 79 - 89, The deployment template
currently renders duplicate MEMOS_DSN entries when both
database.connectionString and database.existingSecret are configured. Make these
inputs mutually exclusive by changing the conditional flow around
database.connectionString and database.existingSecret, preferably failing
template rendering when both are nonempty; otherwise use an else-if structure
and document the connectionString precedence in the existing configuration
documentation.
| {{- range .Values.httpRoute.rules }} | ||
| {{- with .matches }} | ||
| - matches: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .filters }} | ||
| filters: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| backendRefs: | ||
| - name: {{ $fullName }} | ||
| port: {{ $svcPort }} | ||
| weight: 1 | ||
| {{- end }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
In the current Gateway API HTTPRoute v1 specification, are HTTPRouteRule.matches optional, and what match applies when the field is omitted?
💡 Result:
In the Gateway API v1 specification, the matches field within an HTTPRouteRule is optional [1][2]. When the matches field is omitted, it defaults to a prefix path match on "/" [1][2]. This default behavior has the effect of matching every HTTP request [1][2]. The Gateway API defines this via a structural default in the CRD definition: +kubebuilder:default={{path:{ type: "PathPrefix", value: "/"}}} [2] If no matches are explicitly provided in an HTTPRouteRule, the implementation automatically treats the rule as matching all traffic directed to the route [1][3]. This makes it a convenient way to define a "catch-all" or default rule for a route [1][4].
Citations:
- 1: https://gateway-api.sigs.k8s.io/reference/api-types/httproute/
- 2: https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1/httproute_types.go
- 3: https://docs.okd.io/latest/rest_api/network_apis/httproute-gateway-networking-k8s-io-v1.html
- 4: https://gateway-api.sigs.k8s.io/api-types/httproute/?h=filter
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files named httproute.yaml:"
fd -a 'httproute\.yaml$' . || true
echo
echo "Relevant template snippet:"
if [ -f templates/httproute.yaml ]; then
sed -n '1,80p' templates/httproute.yaml | cat -n
fi
echo
echo "Values examples and schema:"
rg -n "httpRoute|matches|filters" . --glob '!**/.git/**' --glob '!**/node_modules/**' --glob '!**/dist/**' | head -200Repository: usememos/helm
Length of output: 3203
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Template around rules:"
sed -n '23,38p' templates/httproute.yaml | cat -n
echo
echo "Static probe of the template's list-marker invariant:"
python3 - <<'PY'
from pathlib import Path
import re
path = Path("templates/httproute.yaml")
text = path.read_text()
start = text.index(" rules:\n")
end = text.index("{{- end }}", start) + len("{{- end }}")
snippet = text[start:end]
# The current template places the list marker only inside {{- with .matches }}.
print("current_snippet_has_marker_inside_matches:", "{{- with .matches }}\n - matches:" in snippet)
print("current_snippet_has_direct_rule_marker:", bool(re.search(r"{{-?\s*range\s*\.*httpRoute\.rules\s*\}}\n\s*-\s+matches:", snippet)))
PYRepository: usememos/helm
Length of output: 791
Emit a rule list item for every HTTPRoute rule.
Put - directly under {{ range .Values.httpRoute.rules }}, then render matches, filters, and backendRefs inside that item. A rule without matches is valid and applies a default / prefix match, but the current template can leave filters and backendRefs as non-list entries and generate invalid YAML.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/httproute.yaml` around lines 24 - 37, Update the HTTPRoute rules
loop to emit a list item immediately for each entry in .Values.httpRoute.rules.
Nest matches, filters, and backendRefs under that item, while allowing rules
without matches to remain valid and use the default "/" prefix behavior.
| {{- if .Values.httpRoute.enabled }} | ||
| {{- if .Values.httpRoute.hostnames }} | ||
| export APP_HOSTNAME={{ .Values.httpRoute.hostnames | first }} | ||
| {{- else }} | ||
| export APP_HOSTNAME=$(kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o jsonpath="{.spec.listeners[0].hostname}") | ||
| {{- end }} | ||
| {{- if and .Values.httpRoute.rules (first .Values.httpRoute.rules).matches (first (first .Values.httpRoute.rules).matches).path.value }} | ||
| echo "Visit https://$APP_HOSTNAME{{ (first (first .Values.httpRoute.rules).matches).path.value }} to use your application" | ||
|
|
||
| NOTE: Your HTTPRoute depends on the listener configuration of your gateway and your HTTPRoute rules. | ||
| The rules can be set for path, method, header and query parameters. | ||
| You can check the gateway configuration with 'kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o yaml' | ||
| {{- end }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does Gateway API HTTPRoute v1 specify the external URL scheme, or is the scheme determined by the referenced Gateway listener protocol?
💡 Result:
The Gateway API HTTPRoute v1 resource does not specify an external URL scheme for the route as a whole [1][2]. However, it does provide a specific configuration field, scheme, within the RequestRedirect filter, which allows users to explicitly define the scheme (e.g., "http" or "https") used in the Location header of a redirect response [3][4][5]. When this scheme field is left empty in the filter, the implementation uses the scheme of the original request [3][5]. Regarding the broader question of how the scheme is determined for traffic: 1. Request Handling: The scheme of an incoming request is generally determined by the configuration of the Gateway listener that receives the traffic [6][7][8]. For example, if a Gateway has an HTTPS listener, the incoming traffic is handled as HTTPS. 2. Redirect Responses: When using the RequestRedirect filter in an HTTPRoute, the scheme specified (or defaulted) in that filter determines the scheme used in the generated Location header [3][4]. If no scheme is specified in the filter, the implementation defaults to the scheme of the original request [3][5]. 3. Port Derivation: The port used in a redirect is also influenced by the scheme [3][9]. If no port is specified in the RequestRedirect filter, implementations are expected to derive the port from the scheme (e.g., "http" defaults to 80, "https" to 443) [3][8]. If the scheme is not specified, or if no well-known port exists, the implementation typically uses the listener port [3]. In summary, while the HTTPRoute itself does not have a global "scheme" field that defines the scheme for all traffic, it allows for scheme manipulation during redirects via filters, and the overall traffic protocol is fundamentally governed by the referenced Gateway listener configuration [3][6][7].
Citations:
- 1: https://gateway-api.sigs.k8s.io/api-types/httproute/?h=httprout
- 2: https://gateway-api.sigs.k8s.io/reference/api-types/httproute/
- 3: https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1/httproute_types.go
- 4: https://gateway-api.sigs.k8s.io/guides/user-guides/http-redirect-rewrite/
- 5: https://github.com/kubernetes-sigs/gateway-api/blob/6d76ec6e/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
- 6: https://yandex.cloud/en/docs/application-load-balancer/k8s-ref/http-route
- 7: Port Redirect Semantics for HTTP and HTTPS Are Confusing kubernetes-sigs/gateway-api#1806
- 8: HTTPS Redirect Should Not Include Port In Location Header kgateway-dev/kgateway#13579
- 9: https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/main/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | sed -n '1,120p' | rg -n '(^templates/NOTES.txt|^values.yaml|Chart.yaml|helm|gateway|httpRoute)' || true
echo "== NOTES relevant =="
if [ -f templates/NOTES.txt ]; then
nl -ba templates/NOTES.txt | sed -n '1,60p'
fi
echo "== values httpRoute =="
if [ -f values.yaml ]; then
rg -n -C 4 'httpRoute:|parentRefs:|hostnames:|rules:' values.yaml || true
fi
echo "== templates search =="
rg -n -C 3 'httpRoute|parentRefs|hostnames|rules|matches|Notes.txt' .Repository: usememos/helm
Length of output: 288
🌐 Web query:
Gateway API HTTPRoute Spec HTTPRoute is a request router v1 beta API external URL scheme HTTPS route does not specify scheme
💡 Result:
In the Kubernetes Gateway API, an HTTPRoute does not define the scheme of the traffic it handles directly in its specification; rather, the scheme (HTTP vs. HTTPS) is determined by the protocol configuration of the Gateway listener to which the HTTPRoute is attached [1][2]. Key points regarding the interaction between HTTPRoute and traffic schemes: 1. Listener Protocol: The scheme is defined at the Gateway resource level within the listeners section [1][2]. A listener configured with protocol: HTTPS will handle encrypted traffic, while one configured with protocol: HTTP handles plain-text traffic [1][2]. HTTPRoutes are then bound to these specific listeners using the parentRefs field (optionally utilizing sectionName to target a specific listener) [3][4][2]. 2. Request Redirect Filter: While the HTTPRoute specification does not use a scheme field to define the entry point, it does support a RequestRedirect filter [4]. This filter includes a scheme field that can be used to instruct a client to redirect from one scheme to another (e.g., redirecting HTTP to HTTPS) [4][5]. For example, a common pattern involves attaching an HTTPRoute to an HTTP listener that contains a RequestRedirect filter with scheme: https, forcing clients to switch to the HTTPS listener [4][2]. 3. Specification Status: The behavior of how scheme and port interact within the RequestRedirect filter is part of the formal API specification and includes support for conformance testing to ensure consistent implementation [6][7]. In summary, to handle HTTPS traffic, you must define an HTTPS listener in your Gateway resource [1][2]. Your HTTPRoute then attaches to this listener to route the already-terminated traffic to your backend services [4][1]. If you wish to enforce HTTPS, you typically use a separate HTTPRoute on the HTTP listener with a RequestRedirect filter [4][2].
Citations:
- 1: https://gateway-api.sigs.k8s.io/guides/user-guides/tls/
- 2: https://kgateway.dev/blog/configuring-https-routes-gateway-api/
- 3: https://gateway-api.sigs.k8s.io/api-types/httproute/?h=httprout
- 4: https://gateway-api.sigs.k8s.io/guides/user-guides/http-redirect-rewrite/
- 5: https://kgateway.dev/docs/envoy/2.0.x/traffic-management/redirect/https/
- 6: Spec unclear for scheme redirects in HTTPRoute kubernetes-sigs/gateway-api#1909
- 7: https://github.com/kubernetes-sigs/gateway-api/blob/6d76ec6e/conformance/tests/httproute-redirect-port-and-scheme.yaml
🌐 Web query:
Sigs Gateway API HTTPRoute v1beta1 v1 scheme redirect filter original request scheme
💡 Result:
In the Kubernetes Gateway API, the RequestRedirect filter (available in HTTPRoute v1 and v1beta1) manages how URL components, including the scheme, are handled during a redirect [1][2][3]. Regarding the scheme and original request behavior: 1. Scheme Handling: When the scheme field in the RequestRedirect filter is left empty, the Gateway API uses the scheme of the original request [3]. If a scheme is explicitly provided (e.g., "https"), the redirect response will use that scheme [1][3]. 2. Interaction with Ports: The interaction between scheme and port is explicitly defined to ensure consistent behavior [3]. - If the port field in the filter is empty, the implementation must derive the port based on the redirect scheme [3]. - If the scheme is set, the port is typically set to the well-known port for that scheme (e.g., port 80 for "http", port 443 for "https") [3]. - If the scheme is not set (i.e., it defaults to the original request's scheme), and no port is provided in the filter, the Gateway implementation typically defaults to the Gateway Listener port [3]. 3. Preservation of Other Components: Redirect filters are designed to change only the specified URL components while preserving the others (such as the hostname, path, and port) from the original request, unless those components are also explicitly overridden in the filter configuration [1]. Implementations are required to follow these guidelines to ensure predictable behavior across different environments [3]. Conformance tests exist within the Gateway API project to verify that these port and scheme combinations are handled correctly by implementations [4].
Citations:
- 1: https://gateway-api.sigs.k8s.io/guides/user-guides/http-redirect-rewrite/
- 2: https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1beta1/httproute_types.go
- 3: https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1/httproute_types.go
- 4: https://github.com/kubernetes-sigs/gateway-api/blob/6d76ec6e/conformance/tests/httproute-redirect-port-and-scheme.yaml
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files
echo "== NOTES.txt =="
if [ -f templates/NOTES.txt ]; then
awk '{printf "%5d\t%s\n", NR, $0}' templates/NOTES.txt | sed -n '1,80p'
fi
echo "== values.yaml httpRoute area =="
if [ -f values.yaml ]; then
awk '{printf "%5d\t%s\n", NR, $0}' values.yaml | sed -n '1,180p'
fi
echo "== chart dependencies/references =="
for f in Chart.yaml values.yaml templates/*.yaml templates/*.txt; do
[ -f "$f" ] && { echo "-- $f"; sed -n '1,220p' "$f"; }
doneRepository: usememos/helm
Length of output: 24272
Do not hardcode the URL scheme.
HTTPRoute does not define the outer URL scheme; the scheme depends on the referenced Gateway listener configuration. Printing https:// is incorrect when the attached listener is HTTP. Add a configurable scheme, or print a scheme-neutral hostname and path.
🧰 Tools
🪛 LanguageTool
[style] ~8-~8: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... if and .Values.httpRoute.rules (first .Values.httpRoute.rules).matches (first (first ...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~8-~8: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...httpRoute.rules).matches (first (first .Values.httpRoute.rules).matches).path.value }}...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/NOTES.txt` around lines 2 - 14, Update the HTTPRoute visit message
near APP_HOSTNAME to avoid hardcoding https://; derive the scheme from a
configurable value or print a scheme-neutral hostname and path. Preserve the
existing hostname and rule-path rendering for both HTTP and HTTPS listener
configurations.
| data: | ||
| {{- if .Values.settings.general }} | ||
| memos-instance-setting-general.json: > | ||
| {{- .Values.settings.general | toJson | nindent 4 }} | ||
| {{- end }} | ||
| {{- if .Values.settings.idps }} | ||
| {{- range $idp := .Values.settings.idps }} | ||
| memos-idp-{{- $idp.name -}}.json: > | ||
| {{- $idp.config | toJson | nindent 4 }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if .Values.settings.storage }} | ||
| memos-instance-setting-storage.json: > | ||
| {{- .Values.settings.storage | toJson | nindent 4 }} | ||
| {{- end }} | ||
| {{- if .Values.settings.memo }} | ||
| memos-instance-setting-memo-related.json: > | ||
| {{- .Values.settings.memo | toJson | nindent 4 }} | ||
| {{- end }} | ||
| {{- if .Values.settings.notification }} | ||
| memos-instance-setting-notification.json: > | ||
| {{- .Values.settings.notification | toJson | nindent 4 }} | ||
| {{- end }} | ||
| {{- if .Values.settings.ai }} | ||
| memos-instance-setting-ai.json: > | ||
| {{- .Values.settings.ai | toJson | nindent 4 }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not store application credentials in the settings ConfigMap.
settings.idps[*].config is serialized into a ConfigMap, while the documented OAuth2 configuration includes clientSecret. A user who follows this example stores the OAuth2 secret as non-confidential ConfigMap data. Kubernetes documents ConfigMaps as non-confidential and states that they do not provide secrecy or encryption. (kubernetes.io)
templates/settings.yaml#L8-L33: Add Secret-backed settings-file support for sensitive configuration. Do not serialize credential-bearing settings into this ConfigMap.README.md#L101-L130: Replace the plaintextclientSecretexample with the Secret-backed configuration flow.
📍 Affects 2 files
templates/settings.yaml#L8-L33(this comment)README.md#L101-L130
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/settings.yaml` around lines 8 - 33, Update templates/settings.yaml
(lines 8-33) so credential-bearing settings, especially settings.idps[*].config
with clientSecret, are supplied through Secret-backed settings-file support
rather than serialized into the ConfigMap; retain only non-sensitive settings in
the ConfigMap. Update README.md (lines 101-130) to replace the plaintext
clientSecret example with the Secret-backed configuration flow.
1 participant
Description
Updates the Helm chart to support Memos v0.30.0, introducing Kubernetes Gateway API support and expanded configuration options.
Key Changes
HTTPRouteresources.