Skip to content

Commit b7cde12

Browse files
gmenhergmenher
committed
fix(helm): address gateway config review findings
Signed-off-by: Gaizka Menendez Hernandez <[email protected]>
1 parent 4329258 commit b7cde12

18 files changed

Lines changed: 361 additions & 69 deletions

‎deploy/helm/openshell/skaffold.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ deploy:
148148
supervisor.image.tag: '{{.IMAGE_TAG_openshell_supervisor}}'
149149
sandboxRuntime.image.repository: '{{.IMAGE_REPO_openshell_sandbox}}'
150150
sandboxRuntime.image.tag: '{{.IMAGE_TAG_openshell_sandbox}}'
151-
gatewayConfig.openshell\\.drivers\\.kubernetes.supervisor_image: '{{.IMAGE_REPO_openshell_supervisor}}:{{.IMAGE_TAG_openshell_supervisor}}'
151+
gatewayConfig.openshell\.drivers\.kubernetes.supervisor_image: '{{.IMAGE_REPO_openshell_supervisor}}:{{.IMAGE_TAG_openshell_supervisor}}'
152152
profiles:
153153
# Full HA test path: installs Envoy Gateway and layers both HA replicas and
154154
# Gateway API routing values onto the OpenShell release.

‎deploy/helm/openshell/templates/_helpers.tpl‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -246,15 +246,16 @@ into per-generation Secrets in workspace namespaces, as a JSON array. Empty in
246246
shared workspace mode.
247247
*/}}
248248
{{- define "openshell.workspaceSecretSourceNames" -}}
249-
{{- $workspaceMode := .Values.server.drivers.kubernetes.workspaceMode | default "shared" -}}
249+
{{- $kubernetesConfig := include "openshell.effectiveKubernetesConfig" . | fromYaml -}}
250+
{{- $workspaceMode := get $kubernetesConfig "workspace_mode" | default "shared" -}}
250251
{{- $names := list -}}
251252
{{- if and (ne $workspaceMode "shared") (not .Values.server.disableTls) -}}
252253
{{- $names = append $names .Values.server.tls.clientTlsSecretName -}}
253254
{{- end -}}
254255
{{- if eq $workspaceMode "managed" -}}
255-
{{- range .Values.server.sandboxImagePullSecrets -}}
256-
{{- if .name -}}
257-
{{- $names = append $names .name -}}
256+
{{- range (get $kubernetesConfig "image_pull_secrets" | default list) -}}
257+
{{- if . -}}
258+
{{- $names = append $names . -}}
258259
{{- end -}}
259260
{{- end -}}
260261
{{- end -}}
@@ -505,11 +506,12 @@ absent fields so every chart consumer observes the same configuration.
505506
{{- end -}}
506507
{{- if and (get $legacyServer "enableUserNamespaces") (not (hasKey $kubernetes "enable_user_namespaces")) -}}{{- $_ := set $kubernetes "enable_user_namespaces" true -}}{{- end -}}
507508
{{- if and (get $legacyServer "hostGatewayIP") (not (hasKey $kubernetes "host_gateway_ip")) -}}{{- $_ := set $kubernetes "host_gateway_ip" (get $legacyServer "hostGatewayIP") -}}{{- end -}}
508-
{{- if not (hasKey $kubernetes "namespace") -}}{{- $_ := set $kubernetes "namespace" (include "openshell.sandboxNamespace" .) -}}{{- end -}}
509+
{{/* Namespace and ServiceAccount refer to chart-created resources. */}}
510+
{{- $_ := set $kubernetes "namespace" (include "openshell.sandboxNamespace" .) -}}
509511
{{- if not (hasKey $kubernetes "default_image") -}}{{- $_ := set $kubernetes "default_image" (include "openshell.sandboxImage" .) -}}{{- end -}}
510512
{{- if not (hasKey $kubernetes "gateway_id") -}}{{- $_ := set $kubernetes "gateway_id" (get (.Values.server.sandboxJwt | default dict) "gatewayId" | default (include "openshell.fullname" .)) -}}{{- end -}}
511513
{{- if not (hasKey $kubernetes "grpc_endpoint") -}}{{- $_ := set $kubernetes "grpc_endpoint" (include "openshell.grpcEndpoint" .) -}}{{- end -}}
512-
{{- if not (hasKey $kubernetes "service_account_name") -}}{{- $_ := set $kubernetes "service_account_name" (include "openshell.sandboxServiceAccountName" .) -}}{{- end -}}
514+
{{- $_ := set $kubernetes "service_account_name" (include "openshell.sandboxServiceAccountName" .) -}}
513515
{{- if not (hasKey $kubernetes "sa_token_ttl_secs") -}}{{- $_ := set $kubernetes "sa_token_ttl_secs" (get (.Values.server.sandboxJwt | default dict) "k8sSaTokenTtlSecs" | default 3600) -}}{{- end -}}
514516
{{- if not (hasKey $kubernetes "image_pull_secrets") -}}
515517
{{- $imagePullSecrets := list -}}{{- range (get $legacyServer "sandboxImagePullSecrets" | default list) }}{{- if .name }}{{- $imagePullSecrets = append $imagePullSecrets .name }}{{- end }}{{- end -}}

‎deploy/helm/openshell/templates/_toml.tpl‎

Lines changed: 74 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,17 @@ field must not require a Helm template change.
1919
{{- end -}}
2020
{{- end -}}
2121

22-
{{/* Render a scalar. Strings alone are Helm-templated. */}}
22+
{{/* Render a scalar. Strings are serialized literally. */}}
2323
{{- define "openshell.toml.scalar" -}}
24-
{{- $root := index . 0 -}}
2524
{{- $value := index . 1 -}}
2625
{{- if kindIs "string" $value -}}
27-
{{- $rendered := tpl $value $root -}}
28-
{{- if regexMatch "-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----" $rendered -}}
26+
{{- if regexMatch "-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----" $value -}}
2927
{{- fail "gatewayConfig must not contain an inline private key; provide it through a Secret-backed file mount" -}}
3028
{{- end -}}
31-
{{- if regexMatch "^[A-Za-z][A-Za-z0-9+.-]*://[^/@[:space:]]*@" $rendered -}}
29+
{{- if regexMatch "^[A-Za-z][A-Za-z0-9+.-]*://[^/@[:space:]]*@" $value -}}
3230
{{- fail "gatewayConfig must not contain inline URL credentials; provide them through a Secret-backed environment variable, file, or volume" -}}
3331
{{- end -}}
34-
{{- $rendered | quote -}}
32+
{{- $value | quote -}}
3533
{{- else if or
3634
(kindIs "bool" $value)
3735
(kindIs "int" $value)
@@ -105,15 +103,18 @@ Top-level lists represent TOML arrays of tables and preserve their YAML order. *
105103
{{- $legacyServer := .Values.server | default dict -}}
106104
{{- $gateway := get $config "openshell.gateway" | default dict -}}
107105
{{- if not (hasKey $gateway "name") -}}{{- $_ := set $gateway "name" (get $legacyServer "name" | default (include "openshell.fullname" .)) -}}{{- end -}}
108-
{{- if not (hasKey $gateway "bind_address") -}}{{- $_ := set $gateway "bind_address" (printf "0.0.0.0:%v" .Values.service.port) -}}{{- end -}}
109-
{{- if and .Values.service.healthPort (not (hasKey $gateway "health_bind_address")) -}}{{- $_ := set $gateway "health_bind_address" (printf "0.0.0.0:%v" .Values.service.healthPort) -}}{{- end -}}
110-
{{- if and .Values.service.metricsPort (not (hasKey $gateway "metrics_bind_address")) -}}{{- $_ := set $gateway "metrics_bind_address" (printf "0.0.0.0:%v" .Values.service.metricsPort) -}}{{- end -}}
106+
{{/* The Service and probes own listener ports, so keep runtime listeners aligned. */}}
107+
{{- $_ := set $gateway "bind_address" (printf "0.0.0.0:%v" .Values.service.port) -}}
108+
{{- if .Values.service.healthPort -}}{{- $_ := set $gateway "health_bind_address" (printf "0.0.0.0:%v" .Values.service.healthPort) -}}{{- else -}}{{- $_ := unset $gateway "health_bind_address" -}}{{- end -}}
109+
{{- if .Values.service.metricsPort -}}{{- $_ := set $gateway "metrics_bind_address" (printf "0.0.0.0:%v" .Values.service.metricsPort) -}}{{- else -}}{{- $_ := unset $gateway "metrics_bind_address" -}}{{- end -}}
111110
{{- range $legacyKey, $runtimeKey := dict "logLevel" "log_level" "enableLoopbackServiceHttp" "enable_loopback_service_http" "enableWebsocketTunnel" "enable_websocket_tunnel" "policyValidationFailureMode" "policy_validation_failure_mode" -}}
112111
{{- if not (hasKey $gateway $runtimeKey) -}}{{- $_ := set $gateway $runtimeKey (get $legacyServer $legacyKey) -}}{{- end -}}
113112
{{- end -}}
114113
{{- if not (hasKey $gateway "compute_driver") -}}{{- $_ := set $gateway "compute_driver" "kubernetes" -}}{{- end -}}
115-
{{- if and .Values.certManager.enabled .Values.certManager.serverDnsNames (not (hasKey $gateway "server_sans")) -}}
116-
{{- $_ := set $gateway "server_sans" (deepCopy .Values.certManager.serverDnsNames) -}}
114+
{{- $serverDnsNames := .Values.pkiInitJob.serverDnsNames | default list -}}
115+
{{- if .Values.certManager.enabled -}}{{- $serverDnsNames = .Values.certManager.serverDnsNames | default list -}}{{- end -}}
116+
{{- if and $serverDnsNames (not (hasKey $gateway "server_sans")) -}}
117+
{{- $_ := set $gateway "server_sans" (deepCopy $serverDnsNames) -}}
117118
{{- end -}}
118119
{{- $_ := set $config "openshell.gateway" $gateway -}}
119120
{{- $gatewayJwt := get $config "openshell.gateway.gateway_jwt" | default dict -}}
@@ -143,26 +144,43 @@ Top-level lists represent TOML arrays of tables and preserve their YAML order. *
143144
{{- $_ := set $config "openshell.drivers.kubernetes.managed_ssh_ingress" (dict "enabled" .Values.networkPolicy.enabled "gateway_namespace" .Release.Namespace "gateway_pod_selector" (dict "app.kubernetes.io/name" (include "openshell.name" .) "app.kubernetes.io/instance" .Release.Name)) -}}
144145
{{- end -}}
145146
{{- $legacyOidc := get $legacyServer "oidc" | default dict -}}
146-
{{- if and (get $legacyOidc "issuer") (not (hasKey $config "openshell.gateway.oidc")) -}}
147-
{{- $_ := set $config "openshell.gateway.oidc" (dict "issuer" (get $legacyOidc "issuer") "dangerously_allow_insecure_http" (get $legacyOidc "dangerouslyAllowInsecureHttp") "jwks_allowed_origins" (get $legacyOidc "jwksAllowedOrigins") "audience" (get $legacyOidc "audience") "jwks_ttl_secs" (get $legacyOidc "jwksTtl") "roles_claim" (get $legacyOidc "rolesClaim") "admin_role" (get $legacyOidc "adminRole") "user_role" (get $legacyOidc "userRole") "scopes_claim" (get $legacyOidc "scopesClaim")) -}}
147+
{{- $oidcConfig := get $config "openshell.gateway.oidc" | default dict -}}
148+
{{- if or (hasKey $config "openshell.gateway.oidc") (get $legacyOidc "issuer") -}}
149+
{{- if get $legacyOidc "issuer" -}}
150+
{{- if not (hasKey $oidcConfig "issuer") -}}{{- $_ := set $oidcConfig "issuer" (get $legacyOidc "issuer") -}}{{- end -}}
151+
{{- if not (hasKey $oidcConfig "dangerously_allow_insecure_http") -}}{{- $_ := set $oidcConfig "dangerously_allow_insecure_http" (get $legacyOidc "dangerouslyAllowInsecureHttp") -}}{{- end -}}
152+
{{- if not (hasKey $oidcConfig "jwks_allowed_origins") -}}{{- $_ := set $oidcConfig "jwks_allowed_origins" (get $legacyOidc "jwksAllowedOrigins") -}}{{- end -}}
153+
{{- if not (hasKey $oidcConfig "audience") -}}{{- $_ := set $oidcConfig "audience" (get $legacyOidc "audience") -}}{{- end -}}
154+
{{- if not (hasKey $oidcConfig "jwks_ttl_secs") -}}{{- $_ := set $oidcConfig "jwks_ttl_secs" (get $legacyOidc "jwksTtl") -}}{{- end -}}
155+
{{- if and (get $legacyOidc "rolesClaim") (not (hasKey $oidcConfig "roles_claim")) -}}{{- $_ := set $oidcConfig "roles_claim" (get $legacyOidc "rolesClaim") -}}{{- end -}}
156+
{{- if and (get $legacyOidc "adminRole") (not (hasKey $oidcConfig "admin_role")) -}}{{- $_ := set $oidcConfig "admin_role" (get $legacyOidc "adminRole") -}}{{- end -}}
157+
{{- if and (get $legacyOidc "userRole") (not (hasKey $oidcConfig "user_role")) -}}{{- $_ := set $oidcConfig "user_role" (get $legacyOidc "userRole") -}}{{- end -}}
158+
{{- if and (get $legacyOidc "scopesClaim") (not (hasKey $oidcConfig "scopes_claim")) -}}{{- $_ := set $oidcConfig "scopes_claim" (get $legacyOidc "scopesClaim") -}}{{- end -}}
159+
{{- end -}}
160+
{{- $_ := set $config "openshell.gateway.oidc" $oidcConfig -}}
148161
{{- end -}}
149162
{{- $legacyOtlp := get $legacyServer "otlp" | default dict -}}
150-
{{- if and (get $legacyOtlp "endpoint") (not (hasKey $config "openshell.gateway.otlp")) -}}{{- $_ := set $config "openshell.gateway.otlp" (dict "endpoint" (get $legacyOtlp "endpoint") "service_name" (get $legacyOtlp "serviceName")) -}}{{- end -}}
163+
{{- $otlpConfig := get $config "openshell.gateway.otlp" | default dict -}}
164+
{{- if or (hasKey $config "openshell.gateway.otlp") (get $legacyOtlp "endpoint") -}}
165+
{{- if get $legacyOtlp "endpoint" -}}
166+
{{- if not (hasKey $otlpConfig "endpoint") -}}{{- $_ := set $otlpConfig "endpoint" (get $legacyOtlp "endpoint") -}}{{- end -}}
167+
{{- if not (hasKey $otlpConfig "service_name") -}}{{- $_ := set $otlpConfig "service_name" (get $legacyOtlp "serviceName") -}}{{- end -}}
168+
{{- end -}}
169+
{{- $_ := set $config "openshell.gateway.otlp" $otlpConfig -}}
170+
{{- end -}}
151171
{{- $legacyAuth := get $legacyServer "auth" | default dict -}}
152172
{{- if and (get $legacyAuth "allowUnauthenticatedUsers") (not (hasKey $config "openshell.gateway.auth")) -}}{{- $_ := set $config "openshell.gateway.auth" (dict "allow_unauthenticated_users" true) -}}{{- end -}}
153173
{{- $legacyOcsf := get $legacyServer "ocsfLog" | default dict -}}
154-
{{- if and (get $legacyOcsf "enabled") (not (hasKey $config "openshell.gateway.ocsf_log")) -}}
155-
{{- $rotation := get $legacyOcsf "rotation" | default "daily" -}}
156-
{{- if not (has $rotation (list "daily" "never")) -}}{{- fail "server.ocsfLog.rotation must be daily or never" -}}{{- end -}}
157-
{{- $path := get $legacyOcsf "path" -}}{{- if not $path -}}{{- fail "server.ocsfLog.path must be set when server.ocsfLog.enabled is true" -}}{{- end -}}
158-
{{- $queueCapacity := 10000 -}}{{- if and (hasKey $legacyOcsf "queueCapacity") (ne (get $legacyOcsf "queueCapacity") nil) -}}{{- $queueCapacity = get $legacyOcsf "queueCapacity" -}}{{- end -}}
159-
{{- $queueMaxBytes := 16777216 -}}{{- if and (hasKey $legacyOcsf "queueMaxBytes") (ne (get $legacyOcsf "queueMaxBytes") nil) -}}{{- $queueMaxBytes = get $legacyOcsf "queueMaxBytes" -}}{{- end -}}
160-
{{- if or (lt (int $queueCapacity) 1) (lt (int $queueMaxBytes) 1) -}}{{- fail "server.ocsfLog.queueCapacity and queueMaxBytes must be positive" -}}{{- end -}}
161-
{{- $schemaVersion := get $legacyOcsf "schemaVersion" | default "" -}}
162-
{{- if not (has $schemaVersion (list "" "1.1" "1.3")) -}}{{- fail "server.ocsfLog.schemaVersion must be empty, 1.1, or 1.3" -}}{{- end -}}
163-
{{- $ocsfConfig := dict "path" $path "rotation" $rotation "queue_capacity" (int $queueCapacity) "queue_max_bytes" (int $queueMaxBytes) -}}
164-
{{- if $schemaVersion -}}{{- $_ := set $ocsfConfig "schema_version" $schemaVersion -}}{{- end -}}
165-
{{- if eq $rotation "daily" -}}{{- $maxFiles := 7 -}}{{- if and (hasKey $legacyOcsf "maxFiles") (ne (get $legacyOcsf "maxFiles") nil) -}}{{- $maxFiles = get $legacyOcsf "maxFiles" -}}{{- end -}}{{- if lt (int $maxFiles) 1 -}}{{- fail "server.ocsfLog.maxFiles must be positive when rotation is daily" -}}{{- end -}}{{- $_ := set $ocsfConfig "max_files" (int $maxFiles) -}}{{- end -}}
174+
{{- $ocsfConfig := get $config "openshell.gateway.ocsf_log" | default dict -}}
175+
{{- if or (hasKey $config "openshell.gateway.ocsf_log") (get $legacyOcsf "enabled") -}}
176+
{{- if get $legacyOcsf "enabled" -}}
177+
{{- if not (hasKey $ocsfConfig "path") -}}{{- $path := get $legacyOcsf "path" -}}{{- if not $path -}}{{- fail "server.ocsfLog.path must be set when server.ocsfLog.enabled is true" -}}{{- end -}}{{- $_ := set $ocsfConfig "path" $path -}}{{- end -}}
178+
{{- if not (hasKey $ocsfConfig "rotation") -}}{{- $rotation := get $legacyOcsf "rotation" | default "daily" -}}{{- if not (has $rotation (list "daily" "never")) -}}{{- fail "server.ocsfLog.rotation must be daily or never" -}}{{- end -}}{{- $_ := set $ocsfConfig "rotation" $rotation -}}{{- end -}}
179+
{{- if not (hasKey $ocsfConfig "queue_capacity") -}}{{- $queueCapacity := 10000 -}}{{- if and (hasKey $legacyOcsf "queueCapacity") (ne (get $legacyOcsf "queueCapacity") nil) -}}{{- $queueCapacity = get $legacyOcsf "queueCapacity" -}}{{- end -}}{{- if lt (int $queueCapacity) 1 -}}{{- fail "server.ocsfLog.queueCapacity and queueMaxBytes must be positive" -}}{{- end -}}{{- $_ := set $ocsfConfig "queue_capacity" (int $queueCapacity) -}}{{- end -}}
180+
{{- if not (hasKey $ocsfConfig "queue_max_bytes") -}}{{- $queueMaxBytes := 16777216 -}}{{- if and (hasKey $legacyOcsf "queueMaxBytes") (ne (get $legacyOcsf "queueMaxBytes") nil) -}}{{- $queueMaxBytes = get $legacyOcsf "queueMaxBytes" -}}{{- end -}}{{- if lt (int $queueMaxBytes) 1 -}}{{- fail "server.ocsfLog.queueCapacity and queueMaxBytes must be positive" -}}{{- end -}}{{- $_ := set $ocsfConfig "queue_max_bytes" (int $queueMaxBytes) -}}{{- end -}}
181+
{{- if not (hasKey $ocsfConfig "schema_version") -}}{{- $schemaVersion := get $legacyOcsf "schemaVersion" | default "" -}}{{- if not (has $schemaVersion (list "" "1.1" "1.3")) -}}{{- fail "server.ocsfLog.schemaVersion must be empty, 1.1, or 1.3" -}}{{- end -}}{{- if $schemaVersion -}}{{- $_ := set $ocsfConfig "schema_version" $schemaVersion -}}{{- end -}}{{- end -}}
182+
{{- if and (eq (get $ocsfConfig "rotation") "daily") (not (hasKey $ocsfConfig "max_files")) -}}{{- $maxFiles := 7 -}}{{- if and (hasKey $legacyOcsf "maxFiles") (ne (get $legacyOcsf "maxFiles") nil) -}}{{- $maxFiles = get $legacyOcsf "maxFiles" -}}{{- end -}}{{- if lt (int $maxFiles) 1 -}}{{- fail "server.ocsfLog.maxFiles must be positive when rotation is daily" -}}{{- end -}}{{- $_ := set $ocsfConfig "max_files" (int $maxFiles) -}}{{- end -}}
183+
{{- end -}}
166184
{{- $_ := set $config "openshell.gateway.ocsf_log" $ocsfConfig -}}
167185
{{- end -}}
168186
{{- $legacyRateLimit := get $legacyServer "grpcRateLimit" | default dict -}}
@@ -196,14 +214,27 @@ Top-level lists represent TOML arrays of tables and preserve their YAML order. *
196214
{{- $_ := set $config "openshell.credential_drivers.kubernetes-secrets" (dict "namespace" (default .Release.Namespace $legacyKubernetesSecrets.namespace)) -}}
197215
{{- else if $legacyVault.enabled -}}
198216
{{- $_ := set $gatewayForCredentials "credential_drivers" (list "vault") -}}
199-
{{- $vaultConfig := dict "address" $legacyVault.address "auth_method" $legacyVault.authMethod "role" $legacyVault.role -}}
217+
{{- end -}}
218+
{{- end -}}
219+
{{- $_ := set $config "openshell.gateway" $gatewayForCredentials -}}
220+
{{- $effectiveCredentialDrivers := get $gatewayForCredentials "credential_drivers" | default list -}}
221+
{{- if has "kubernetes-secrets" $effectiveCredentialDrivers -}}
222+
{{- $kubernetesSecretsConfig := get $config "openshell.credential_drivers.kubernetes-secrets" | default dict -}}
223+
{{- if not (hasKey $kubernetesSecretsConfig "namespace") -}}
224+
{{- $_ := set $kubernetesSecretsConfig "namespace" (include "openshell.credentialKubernetesSecretsNamespace" .) -}}
225+
{{- end -}}
226+
{{- $_ := set $config "openshell.credential_drivers.kubernetes-secrets" $kubernetesSecretsConfig -}}
227+
{{- end -}}
228+
{{- if and $legacyVault.enabled (has "vault" $effectiveCredentialDrivers) -}}
229+
{{- $vaultConfig := get $config "openshell.credential_drivers.vault" | default dict -}}
230+
{{- range $legacyKey, $runtimeKey := dict "address" "address" "authMethod" "auth_method" "role" "role" -}}
231+
{{- if not (hasKey $vaultConfig $runtimeKey) -}}{{- $_ := set $vaultConfig $runtimeKey (get $legacyVault $legacyKey) -}}{{- end -}}
232+
{{- end -}}
200233
{{- range $legacyKey, $runtimeKey := dict "mount" "mount" "kvVersion" "kv_version" "kubernetesAuthMount" "kubernetes_auth_mount" "serviceAccountTokenPath" "service_account_token_path" "tokenPath" "token_path" "timeoutSecs" "timeout_secs" -}}
201-
{{- if get $legacyVault $legacyKey -}}{{- $_ := set $vaultConfig $runtimeKey (get $legacyVault $legacyKey) -}}{{- end -}}
234+
{{- if and (get $legacyVault $legacyKey) (not (hasKey $vaultConfig $runtimeKey)) -}}{{- $_ := set $vaultConfig $runtimeKey (get $legacyVault $legacyKey) -}}{{- end -}}
202235
{{- end -}}
203236
{{- $_ := set $config "openshell.credential_drivers.vault" $vaultConfig -}}
204237
{{- end -}}
205-
{{- end -}}
206-
{{- $_ := set $config "openshell.gateway" $gatewayForCredentials -}}
207238
{{/* External credential drivers own their storage. Do not configure the
208239
chart-managed encrypted database store when any driver is selected: its KEK
209240
environment variable is intentionally not mounted in that mode. */}}
@@ -274,6 +305,19 @@ owner: server.*. Override any gatewayConfig copies before serializing TOML. */}}
274305
{{- end -}}
275306
{{- $_ := set $config "openshell.gateway.tls" $gatewayTls -}}
276307
{{- end -}}
308+
{{/* A nested YAML map and its dotted top-level table would serialize to
309+
conflicting TOML definitions. Fail before rendering an invalid ConfigMap. */}}
310+
{{- range $tableName := keys $config | sortAlpha -}}
311+
{{- $fields := get $config $tableName -}}
312+
{{- if kindIs "map" $fields -}}
313+
{{- range $fieldName := keys $fields -}}
314+
{{- $nestedTableName := printf "%s.%s" $tableName $fieldName -}}
315+
{{- if hasKey $config $nestedTableName -}}
316+
{{- fail (printf "gatewayConfig defines %q both as a nested map and a dotted top-level table; use only the dotted top-level key" $nestedTableName) -}}
317+
{{- end -}}
318+
{{- end -}}
319+
{{- end -}}
320+
{{- end -}}
277321
{{- range $tableName := keys $config | sortAlpha -}}
278322
{{- $fields := get $config $tableName -}}
279323
{{- if ne $fields nil -}}

‎deploy/helm/openshell/templates/credential-secrets-namespace.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
{{- $credentialSecrets := .Values.server.credentialDrivers.kubernetesSecrets -}}
5-
{{- if and $credentialSecrets.enabled $credentialSecrets.createNamespace }}
5+
{{- if and (eq (include "openshell.credentialDriverEnabled" (list . "kubernetes-secrets")) "true") $credentialSecrets.createNamespace }}
66
{{- $namespace := include "openshell.credentialKubernetesSecretsNamespace" . -}}
77
{{- if eq $namespace .Release.Namespace -}}
88
{{- fail "server.credentialDrivers.kubernetesSecrets.createNamespace requires server.credentialDrivers.kubernetesSecrets.namespace to name a namespace other than the release namespace" -}}

0 commit comments

Comments
 (0)