Merge pull request #1668 from ThisIsntTheWay/main

chart: Choose whether or not to generate oidc secret
headlamp-k8s · Jan 30, 2024 · 674439a · 674439a
2 parents c374d5e + 069eb97
commit 674439a
Show file tree

Hide file tree

Showing 5 changed files with 39 additions and 26 deletions.
diff --git a/charts/headlamp/Chart.yaml b/charts/headlamp/Chart.yaml
@@ -20,7 +20,7 @@ sources:
 maintainers:
   - name: kinvolk
     url: https://kinvolk.io/
-version: 0.18.0
+version: 0.18.1
 appVersion: 0.22.0
 annotations:
   artifacthub.io/category: monitoring-logging

diff --git a/charts/headlamp/README.md b/charts/headlamp/README.md
@@ -65,11 +65,13 @@ See [MAINTAINERS.md](https://github.com/headlamp-k8s/headlamp/blob/main/MAINTAIN
 
 ### Headlamp Configuration
 
-| Key                      | Type   | Default               | Description                                |
-|--------------------------|--------|-----------------------|--------------------------------------------|
-| config.baseURL           | string | `""`                  | base url path at which headlamp should run |
-| config.oidc.clientID     | string | `""`                  | OIDC client ID                             |
-| config.oidc.clientSecret | string | `""`                  | OIDC client secret                         |
-| config.oidc.issuerURL    | string | `""`                  | OIDC issuer URL                            |
-| config.oidc.scopes       | string | `""`                  | OIDC scopes to be used                     |
-| config.pluginsDir        | string | `"/headlamp/plugins"` | directory to look for plugins              |
+| Key                       | Type   | Default               | Description                                |
+|---------------------------|--------|-----------------------|--------------------------------------------|
+| config.baseURL            | string | `""`                  | base url path at which headlamp should run |
+| config.oidc.clientID      | string | `""`                  | OIDC client ID                             |
+| config.oidc.clientSecret  | string | `""`                  | OIDC client secret                         |
+| config.oidc.issuerURL     | string | `""`                  | OIDC issuer URL                            |
+| config.oidc.scopes        | string | `""`                  | OIDC scopes to be used                     |
+| config.oidc.secret.create | bool   | `true`                | Enable this option to have the chart automatically create the OIDC secret using the specified values. |
+| config.oidc.secret.name   | string | `oidc`                | Name of the OIDC secret used by headlamp   |
+| config.pluginsDir         | string | `"/headlamp/plugins"` | directory to look for plugins              |
diff --git a/charts/headlamp/templates/deployment.yaml b/charts/headlamp/templates/deployment.yaml
@@ -35,50 +35,52 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.registry}}/{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{ with .Values.config.oidc }}
           env:
-            {{- with .Values.config.oidc.clientID }}
+            {{- if or .clientID (not .secret.create) }}
             - name: OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: oidc
+                  name: {{ .secret.name }}
                   key: clientID
             {{- end }}
-            {{- with .Values.config.oidc.clientSecret }}
+            {{- if or .clientSecret (not .secret.create) }}
             - name: OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: oidc
+                  name: {{ .secret.name }}
                   key: clientSecret
             {{- end }}
-            {{- with .Values.config.oidc.issuerURL }}
+            {{- if or .issuerURL (not .secret.create) }}
             - name: OIDC_ISSUER_URL
               valueFrom:
                 secretKeyRef:
-                  name: oidc
+                  name: {{ .secret.name }}
                   key: issuerURL
             {{- end }}
-            {{- with .Values.config.oidc.scopes }}
+            {{- if or .scopes (not .secret.create) }}
             - name: OIDC_SCOPES
               valueFrom:
                 secretKeyRef:
-                  name: oidc
+                  name: {{ .secret.name }}
                   key: scopes
             {{- end }}
+          {{- end }}
           args:
             - "-in-cluster"
             {{- with .Values.config.pluginsDir}}
             - "-plugins-dir={{ . }}"
             {{- end }}
-            {{- with .Values.config.oidc.clientID }}
+            {{- if or .Values.config.oidc.clientID (not .Values.config.oidc.secret.create) }}
             - "-oidc-client-id=$(OIDC_CLIENT_ID)"
             {{- end }}
-            {{- with .Values.config.oidc.clientSecret }}
+            {{- if or .Values.config.oidc.clientSecret (not .Values.config.oidc.secret.create) }}
             - "-oidc-client-secret=$(OIDC_CLIENT_SECRET)"
             {{- end }}
-            {{- with .Values.config.oidc.issuerURL }}
+            {{- if or .Values.config.oidc.issuerURL (not .Values.config.oidc.secret.create) }}
             - "-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)"
             {{- end }}
-            {{- with .Values.config.oidc.scopes }}
+            {{- if or .Values.config.oidc.scopes (not .Values.config.oidc.secret.create) }}
             - "-oidc-scopes=$(OIDC_SCOPES)"
             {{- end }}
             {{- with .Values.config.baseURL }}

diff --git a/charts/headlamp/templates/secret.yaml b/charts/headlamp/templates/secret.yaml
@@ -1,18 +1,22 @@
+{{- with .Values.config.oidc }}
+{{- if .secret.create -}}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: oidc
+  name: {{ .secret.name }}
 type: Opaque
 data:
-{{- with .Values.config.oidc.clientID }}
+{{- with .clientID }}
   clientID: {{ . | b64enc | quote }}
 {{- end }}
-{{- with .Values.config.oidc.clientSecret }}
+{{- with .clientSecret }}
   clientSecret: {{ . | b64enc | quote }}
 {{- end }}
-{{- with .Values.config.oidc.issuerURL }}
+{{- with .issuerURL }}
   issuerURL: {{ . | b64enc | quote }}
 {{- end }}
-{{- with .Values.config.oidc.scopes }}
+{{- with .scopes }}
   scopes: {{ . | b64enc | quote }}
 {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/headlamp/values.yaml b/charts/headlamp/values.yaml
@@ -29,6 +29,11 @@ config:
   # -- base url path at which headlamp should run
   baseURL: ""
   oidc:
+    secret:
+      # -- Generate OIDC secret. If true, will generate a secret using .config.oidc.
+      create: true
+      # -- Name of the OIDC secret.
+      name: oidc
     # -- OIDC client ID
     clientID: ""
     # -- OIDC client secret