Skip to content

Commit 01477b7

Browse files
abuzhynskyabuzhynsky
authored
Consolidate configmap and secret into single configmap (#70)
Fix existingSecret with operator Signed-off-by: Ales Buzhinsky <buzhinsky@targetprocess.com>
1 parent 6c77557 commit 01477b7

12 files changed

Lines changed: 121 additions & 167 deletions

‎charts/pomerium/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v1
22
name: pomerium
3-
version: 7.0.1
3+
version: 8.0.0
44
appVersion: 0.6.2
55
home: http://www.pomerium.io/
66
icon: https://www.pomerium.io/logo-long.svg

‎charts/pomerium/README.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@
1616
- [Self Provisioned](#self-provisioned-1)
1717
- [Configuration](#configuration)
1818
- [Changelog](#changelog)
19+
- [8.0.0](#800)
1920
- [7.0.0](#700)
2021
- [6.0.0](#600)
2122
- [5.0.0](#500)
2223
- [4.0.0](#400)
2324
- [3.0.0](#300)
2425
- [2.0.0](#200)
2526
- [Upgrading](#upgrading)
27+
- [8.0.0](#800-1)
2628
- [7.0.0](#700-1)
2729
- [5.0.0](#500-1)
2830
- [4.0.0](#400-1)
@@ -137,7 +139,6 @@ A full listing of Pomerium's configuration variables can be found on the [config
137139
| `config.rootDomain` | Root Domain specifies the sub-domain handled by pomerium. [See more](https://www.pomerium.io/docs/reference/reference.html#proxy-root-domains). | `corp.pomerium.io` |
138140
| `config.administrators` | Comma seperated list of email addresses of administrative users [See more](https://www.pomerium.io/configuration/#administrators). | Optional |
139141
| `config.existingSecret` | Name of the existing Kubernetes Secret. | |
140-
| `config.existingConfig` | Name of the existing Config Map deployed on Kubernetes. | |
141142
| `config.existingCASecret` | Name of the existing CA Secret. | |
142143
| `config.generateSigningKey` | Generate a signing key to sign jwt in proxy responses. Manual signing key can be set in values. | `true` |
143144
| `config.forceGenerateSigningKey` | Force recreation of generated signing key. You will need to restart your deployments after running | `false` |
@@ -216,6 +217,10 @@ A full listing of Pomerium's configuration variables can be found on the [config
216217

217218
## Changelog
218219

220+
### 8.0.0
221+
222+
- Pomerium `ConfigMap` and `Secret` were combined into a single `Secret`. See [v8.0.0 Upgrade Nodes](#800-1) to migrate
223+
219224
### 7.0.0
220225

221226
- Add automatic signing key generation. See [v7.0.0 Upgrade Nodes](#700-1) to migrate
@@ -248,6 +253,17 @@ A full listing of Pomerium's configuration variables can be found on the [config
248253

249254
## Upgrading
250255

256+
### 8.0.0
257+
258+
- `config.existingConfig` `ConfigMap` has been merged with `config.existingSecret` `Secret`. All keys from `config.existingConfig` were moved to the `config.existingSecret`
259+
- `config.existingSecret` structure has been changed:
260+
261+
- all top level keys were moved under the `config.yaml` section
262+
- naming of the top level keys was changed from `cookie-secret` to `cookie_secret` according to [the `config.yaml` format](https://www.pomerium.io/configuration/#shared-settings) (basically `'-'` was changed to the `'_'`)
263+
264+
- `config.existingConfig` and `config.existingSecret` cannot be used separately anymore
265+
- If `config.existingConfig` and `config.existingSecret` options weren't used no actions are required
266+
251267
### 7.0.0
252268

253269
- A signing key is now automatically generated, similar to TLS secrets.

‎charts/pomerium/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,4 +250,20 @@ Adapted from : https://github.com/helm/charts/blob/master/stable/drone/templates
250250
{{/*Expand the configMap for operator election */}}
251251
{{- define "pomerium.operator.electionConfigMap" -}}
252252
{{- printf "%s-election" ( include "pomerium.operator.name" .) -}}
253+
{{- end -}}
254+
255+
{{/*Expand the name of the config secret */}}
256+
{{- define "pomerium.secretName" -}}
257+
{{- if and .Values.config.existingSecret (not .Values.operator.enabled) -}}
258+
{{- .Values.config.existingSecret -}}
259+
{{- else -}}
260+
{{- include "pomerium.fullname" . -}}
261+
{{- end -}}
262+
{{- end -}}
263+
264+
{{/*Expand the name of the config secret */}}
265+
{{- define "pomerium.baseSecretName" -}}
266+
{{- if .Values.operator.enabled -}}
267+
{{- default (printf "%s-base" (include "pomerium.fullname" .)) .Values.config.existingSecret -}}
268+
{{- end -}}
253269
{{- end -}}

‎charts/pomerium/templates/authenticate-deployment.yaml‎

Lines changed: 3 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
2-
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
1+
{{- $secretName := include "pomerium.secretName" . }}
32
apiVersion: apps/v1
43
kind: Deployment
54
metadata:
@@ -54,9 +53,7 @@ spec:
5453
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
5554
imagePullPolicy: {{ .Values.image.pullPolicy }}
5655
args:
57-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
5856
- --config=/etc/pomerium/config.yaml
59-
{{- end }}
6057
{{- range $key, $value := .Values.extraArgs }}
6158
{{- if $value }}
6259
- --{{ $key }}={{ $value }}
@@ -71,39 +68,12 @@ spec:
7168
value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
7269
- name: CACHE_SERVICE_URL
7370
value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.cache.fullname" .) .Release.Namespace ) .Values.authenticate.cacheServiceUrl}}
74-
- name: COOKIE_SECRET
75-
valueFrom:
76-
secretKeyRef:
77-
name: {{ $secretName }}
78-
key: cookie-secret
79-
- name: SHARED_SECRET
80-
valueFrom:
81-
secretKeyRef:
82-
name: {{ $secretName }}
83-
key: shared-secret
8471
- name: IDP_PROVIDER
8572
value: {{ .Values.authenticate.idp.provider }}
8673
- name: IDP_SCOPES
8774
value: {{ .Values.authenticate.idp.scopes }}
88-
- name: IDP_CLIENT_ID
89-
valueFrom:
90-
secretKeyRef:
91-
name: {{ $secretName }}
92-
key: idp-client-id
93-
- name: IDP_CLIENT_SECRET
94-
valueFrom:
95-
secretKeyRef:
96-
name: {{ $secretName }}
97-
key: idp-client-secret
9875
- name: IDP_PROVIDER_URL
9976
value: {{ .Values.authenticate.idp.url }}
100-
{{- if .Values.authenticate.idp.serviceAccount }}
101-
- name: IDP_SERVICE_ACCOUNT
102-
valueFrom:
103-
secretKeyRef:
104-
name: {{ $secretName }}
105-
key: idp-service-account
106-
{{- end }}
10777
- name: CERTIFICATE_FILE
10878
value: "/pomerium/cert.pem"
10979
- name: CERTIFICATE_KEY_FILE
@@ -134,10 +104,8 @@ spec:
134104
resources:
135105
{{ toYaml .Values.resources | indent 10 }}
136106
volumeMounts:
137-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
138107
- mountPath: /etc/pomerium/
139108
name: config
140-
{{- end }}
141109
- mountPath: /pomerium/cert.pem
142110
name: service-tls
143111
subPath: tls.crt
@@ -149,8 +117,8 @@ spec:
149117
subPath: ca.crt
150118
volumes:
151119
- name: config
152-
configMap:
153-
name: {{ $configName }}
120+
secret:
121+
secretName: {{ $secretName }}
154122
- name: service-tls
155123
secret:
156124
secretName: {{ template "pomerium.authenticate.tlsSecret.name" . }}

‎charts/pomerium/templates/authorize-deployment.yaml‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
2-
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
1+
{{- $secretName := include "pomerium.secretName" . }}
32
apiVersion: apps/v1
43
kind: Deployment
54
metadata:
@@ -56,9 +55,7 @@ spec:
5655
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
5756
imagePullPolicy: {{ .Values.image.pullPolicy }}
5857
args:
59-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
6058
- --config=/etc/pomerium/config.yaml
61-
{{- end }}
6259
{{- range $key, $value := .Values.extraArgs }}
6360
{{- if $value }}
6461
- --{{ $key }}={{ $value }}
@@ -69,11 +66,6 @@ spec:
6966
env:
7067
- name: SERVICES
7168
value: authorize
72-
- name: SHARED_SECRET
73-
valueFrom:
74-
secretKeyRef:
75-
name: {{ $secretName }}
76-
key: shared-secret
7769
- name: CERTIFICATE_FILE
7870
value: "/pomerium/cert.pem"
7971
- name: CERTIFICATE_KEY_FILE
@@ -101,10 +93,8 @@ spec:
10193
resources:
10294
{{ toYaml .Values.resources | indent 10 }}
10395
volumeMounts:
104-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
10596
- mountPath: /etc/pomerium/
10697
name: config
107-
{{- end }}
10898
- mountPath: /pomerium/cert.pem
10999
name: service-tls
110100
subPath: tls.crt
@@ -116,8 +106,8 @@ spec:
116106
subPath: ca.crt
117107
volumes:
118108
- name: config
119-
configMap:
120-
name: {{ $configName }}
109+
secret:
110+
secretName: {{ $secretName }}
121111
- name: service-tls
122112
secret:
123113
secretName: {{ template "pomerium.authorize.tlsSecret.name" . }}

‎charts/pomerium/templates/cache-deployment.yaml‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
2-
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
1+
{{- $secretName := include "pomerium.secretName" . }}
32
apiVersion: apps/v1
43
kind: Deployment
54
metadata:
@@ -54,9 +53,7 @@ spec:
5453
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
5554
imagePullPolicy: {{ .Values.image.pullPolicy }}
5655
args:
57-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
5856
- --config=/etc/pomerium/config.yaml
59-
{{- end }}
6057
{{- range $key, $value := .Values.extraArgs }}
6158
{{- if $value }}
6259
- --{{ $key }}={{ $value }}
@@ -69,11 +66,6 @@ spec:
6966
value: cache
7067
- name: CACHE_SERVICE_URL
7168
value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.cache.fullname" .) .Release.Namespace ) .Values.authenticate.cacheServiceUrl}}
72-
- name: SHARED_SECRET
73-
valueFrom:
74-
secretKeyRef:
75-
name: {{ $secretName }}
76-
key: shared-secret
7769
- name: CERTIFICATE_FILE
7870
value: "/pomerium/cert.pem"
7971
- name: CERTIFICATE_KEY_FILE
@@ -101,10 +93,8 @@ spec:
10193
resources:
10294
{{ toYaml .Values.resources | indent 10 }}
10395
volumeMounts:
104-
{{- if or (or .Values.config.existingConfig .Values.config.policy) .Values.operator.enabled }}
10596
- mountPath: /etc/pomerium/
10697
name: config
107-
{{- end }}
10898
- mountPath: /pomerium/cert.pem
10999
name: service-tls
110100
subPath: tls.crt
@@ -116,8 +106,8 @@ spec:
116106
subPath: ca.crt
117107
volumes:
118108
- name: config
119-
configMap:
120-
name: {{ $configName }}
109+
secret:
110+
secretName: {{ $secretName }}
121111
- name: service-tls
122112
secret:
123113
secretName: {{ template "pomerium.cache.tlsSecret.name" . }}

‎charts/pomerium/templates/configmap.yaml‎

Lines changed: 1 addition & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,4 @@
1-
{{- if not .Values.config.existingConfig }}
21
{{- if .Values.operator.enabled }}
3-
apiVersion: v1
4-
kind: ConfigMap
5-
metadata:
6-
name: {{ template "pomerium.fullname" . }}
7-
labels:
8-
app.kubernetes.io/name: {{ template "pomerium.name" . }}
9-
helm.sh/chart: {{ template "pomerium.chart" . }}
10-
app.kubernetes.io/managed-by: {{ .Release.Service }}
11-
app.kubernetes.io/instance: {{ .Release.Name }}
12-
data:
13-
config.yaml: ""
14-
15-
---
16-
{{- end }}
17-
apiVersion: v1
18-
kind: ConfigMap
19-
metadata:
20-
{{- if .Values.operator.enabled }}
21-
name: {{ template "pomerium.fullname" . }}-base
22-
{{- else }}
23-
name: {{ template "pomerium.fullname" . }}
24-
{{- end }}
25-
labels:
26-
app.kubernetes.io/name: {{ template "pomerium.name" . }}
27-
helm.sh/chart: {{ template "pomerium.chart" . }}
28-
app.kubernetes.io/managed-by: {{ .Release.Service }}
29-
app.kubernetes.io/instance: {{ .Release.Name }}
30-
data:
31-
config.yaml: |
32-
{{- if and .Values.config.existingPolicy .Values.config.extraOpts }}
33-
{{ fail "Cannot use config.extraOpts with config.existingPolicy" }}
34-
{{- end }}
35-
{{- if and .Values.config.existingPolicy .Values.config.policy }}
36-
{{ fail "Cannot use config.policy with config.existingPolicy" }}
37-
{{- end }}
38-
{{- if .Values.config.administrators }}
39-
administrators: {{ .Values.config.administrators | quote }}
40-
{{- end -}}
41-
{{- if .Values.config.extraOpts }}
42-
{{ toYaml .Values.config.extraOpts | indent 4 -}}
43-
{{- end -}}
44-
{{- if .Values.metrics.enabled }}
45-
metrics_address: :{{ .Values.metrics.port }}
46-
{{- end -}}
47-
{{- if .Values.tracing.enabled }}
48-
tracing_debug: {{ .Values.tracing.debug }}
49-
tracing_provider: {{ required "tracing_provider is required for tracing" .Values.tracing.provider }}
50-
51-
{{- if eq .Values.tracing.provider "jaeger" }}
52-
tracing_jaeger_collector_endpoint: {{ required "collector_endpoint is required for jaeoger tracing" .Values.tracing.jaeger.collector_endpoint }}
53-
tracing_jaeger_agent_endpoint: {{ required "agent_endpoint is required for jaeger tracing" .Values.tracing.jaeger.agent_endpoint }}
54-
{{- end -}}
55-
56-
{{- end -}}
57-
{{- if .Values.forwardAuth.enabled }}
58-
forward_auth_url: https://{{ template "pomerium.forwardAuth.name" . }}
59-
{{- end -}}
60-
{{- if .Values.config.policy }}
61-
policy:
62-
{{ toYaml .Values.config.policy | indent 6 }}
63-
{{- end -}}
64-
{{- end }}
65-
66-
{{- if .Values.operator.enabled }}
67-
---
68-
692
apiVersion: v1
703
kind: ConfigMap
714
metadata:
@@ -75,5 +8,4 @@ metadata:
758
helm.sh/chart: {{ template "pomerium.chart" . }}
769
app.kubernetes.io/managed-by: {{ .Release.Service }}
7710
app.kubernetes.io/instance: {{ .Release.Name }}
78-
79-
{{- end }}
11+
{{- end }}

‎charts/pomerium/templates/operator-deployment.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- $configName := default (printf "%s-base" (include "pomerium.fullname" .)) .Values.config.existingConfig }}
1+
{{- $secretName := include "pomerium.secretName" . }}
2+
{{- $baseSecretName := include "pomerium.baseSecretName" . }}
23
{{- if .Values.operator.enabled }}
34
apiVersion: apps/v1
45
kind: Deployment
@@ -64,6 +65,7 @@ spec:
6465
- --election-configmap={{ template "pomerium.operator.electionConfigMap" . }}
6566
- --election-namespace={{ .Release.Namespace }}
6667
- --election=true
68+
- --pomerium-secret={{ $secretName }}
6769
ports:
6870
- containerPort: 8080
6971
name: metrics
@@ -88,8 +90,8 @@ spec:
8890
name: config
8991
volumes:
9092
- name: config
91-
configMap:
92-
name: {{ $configName }}
93+
secret:
94+
secretName: {{ $baseSecretName }}
9395
serviceAccountName: {{ template "pomerium.operator.serviceAccountName" . }}
9496
{{- if .Values.extraVolumes }}
9597
{{- toYaml .Values.extraVolumes | indent 8 }}

0 commit comments

Comments
 (0)