Skip to content

Commit 3aa5f88

Browse files
klinch0klinch0
authored
fix keycloak-configure secrets drift (#506)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced management of Kubernetes secrets for `k8s-client`, `kubeapps-client`, and `kubeapps-auth-config`. - Improved handling of client secrets by reusing existing configurations when available. - **Bug Fixes** - Addressed issues with static secret definitions, streamlining the configuration process. - **Chores** - Removed outdated secret and Keycloak client definitions for cleaner configuration management. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 parent 7da85d6 commit 3aa5f88

1 file changed

Lines changed: 62 additions & 22 deletions

File tree

‎packages/system/keycloak-configure/templates/configure-kk.yaml‎

Lines changed: 62 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,67 @@
11
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
22
{{- $host := index $cozyConfig.data "root-host" }}
3-
{{- $k8sClient := randAlphaNum 32 -}}
4-
{{- $kubeappsClient := randAlphaNum 32 -}}
53
{{- $rootSaConfigMap := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }}
6-
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
4+
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
5+
6+
{{- $existingK8sSecret := lookup "v1" "Secret" .Release.Namespace "k8s-client" }}
7+
{{- $existingKubeappsSecret := lookup "v1" "Secret" .Release.Namespace "kubeapps-client" }}
8+
{{- $existingAuthConfig := lookup "v1" "Secret" "cozy-dashboard" "kubeapps-auth-config" }}
9+
10+
{{ $k8sClient := "" }}
11+
{{- if $existingK8sSecret }}
12+
{{- $k8sClient = index $existingK8sSecret.data "client-secret-key" | b64dec }}
13+
{{- else }}
14+
{{- $k8sClient = randAlphaNum 32 }}
15+
{{- end }}
16+
17+
{{ $kubeappsClient := "" }}
18+
{{- if $existingKubeappsSecret }}
19+
{{- $kubeappsClient = index $existingKubeappsSecret.data "client-secret-key" | b64dec }}
20+
{{- else }}
21+
{{- $kubeappsClient = randAlphaNum 32 }}
22+
{{- end }}
23+
24+
{{ $cookieSecret := "" }}
25+
{{- if $existingAuthConfig }}
26+
{{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
27+
{{- else }}
28+
{{- $cookieSecret = randAlphaNum 16 }}
29+
{{- end }}
30+
31+
---
32+
33+
apiVersion: v1
34+
kind: Secret
35+
metadata:
36+
name: k8s-client
37+
namespace: {{ .Release.Namespace }}
38+
type: Opaque
39+
data:
40+
client-secret-key: {{ $k8sClient | b64enc }}
41+
42+
---
43+
44+
apiVersion: v1
45+
kind: Secret
46+
metadata:
47+
name: kubeapps-client
48+
namespace: {{ .Release.Namespace }}
49+
type: Opaque
50+
data:
51+
client-secret-key: {{ $kubeappsClient | b64enc }}
52+
53+
---
54+
55+
apiVersion: v1
56+
kind: Secret
57+
metadata:
58+
name: kubeapps-auth-config
59+
namespace: cozy-dashboard
60+
type: Opaque
61+
data:
62+
cookieSecret: {{ $cookieSecret | b64enc }}
63+
64+
---
765

866
apiVersion: v1.edp.epam.com/v1alpha1
967
kind: ClusterKeycloak
@@ -54,14 +112,6 @@ spec:
54112

55113
---
56114

57-
apiVersion: v1
58-
kind: Secret
59-
metadata:
60-
name: k8s-client
61-
type: Opaque
62-
stringData:
63-
client-secret-key: {{ $k8sClient }}
64-
65115
---
66116

67117
apiVersion: v1.edp.epam.com/v1
@@ -119,16 +169,6 @@ spec:
119169

120170
---
121171

122-
apiVersion: v1
123-
kind: Secret
124-
metadata:
125-
name: kubeapps-client
126-
type: Opaque
127-
stringData:
128-
client-secret-key: {{ $kubeappsClient }}
129-
130-
---
131-
132172
apiVersion: v1.edp.epam.com/v1
133173
kind: KeycloakClient
134174
metadata:
@@ -168,7 +208,7 @@ data:
168208
provider: "oidc"
169209
clientID: "kubeapps"
170210
clientSecret: {{ $kubeappsClient }}
171-
cookieSecret: {{ randAlphaNum 16 | b64enc | quote }}
211+
cookieSecret: {{ $cookieSecret }}
172212
extraFlags:
173213
- --ssl-insecure-skip-verify
174214
- --cookie-secure=false

0 commit comments

Comments
 (0)