Skip to content

Commit 72fb1d5

Browse files
lexfreilexfrei
committed
fix(cloudflare-tunnel): name the credentials Secret namespace
Make the cluster-scoped credentials reference self-contained without changing its controller-namespace fallback. Preserve explicit overrides and quote namespace names that YAML would otherwise coerce. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 03fb377 commit 72fb1d5

5 files changed

Lines changed: 45 additions & 4 deletions

File tree

‎docs/cloudflare-tunnel-gateway.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ The Cloudflare account ID is auto-detected when the API token has access to a si
2424

2525
## The credentials Secret
2626

27-
Both planes read one Secret, named `cloudflare-tunnel-credentials`, in the package namespace `cozy-cloudflare-tunnel-gateway-controller`. The package pins the Secret name; the `tunnel-token` key is the chart's own default, and a chart test holds both in place across re-vendoring. `api-token` is likewise the controller's default for the credentials key, which the package leaves unset:
27+
Both planes read one Secret, named `cloudflare-tunnel-credentials`, in the package namespace `cozy-cloudflare-tunnel-gateway-controller`. The rendered `GatewayClassConfig` explicitly names the release namespace for its credentials Secret, matching the controller's default; `gatewayClassConfig.cloudflareCredentialsSecretRef.namespace` can override it. The proxy's Secret reference remains local to its pod namespace. The `tunnel-token` and `api-token` keys use the chart's defaults:
2828

2929
| Key | Read by | Contents |
3030
| --- | --- | --- |

‎packages/core/platform/tests/sources_cloudflare_tunnel_gateway_controller_test.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,6 @@ tests:
3636
- equal:
3737
path: spec.variants[0].components[0].install.releaseName
3838
value: cloudflare-tunnel-gateway-controller
39+
- equal:
40+
path: spec.variants[0].components[0].install.namespace
41+
value: cozy-cloudflare-tunnel-gateway-controller

‎packages/system/cloudflare-tunnel-gateway-controller/charts/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ metadata:
88
spec:
99
cloudflareCredentialsSecretRef:
1010
name: {{ required "gatewayClassConfig.cloudflareCredentialsSecretRef.name is required" .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.name }}
11-
{{- if .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace }}
12-
namespace: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace }}
13-
{{- end }}
11+
namespace: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace | default .Release.Namespace | quote }}
1412
{{- if .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.key }}
1513
key: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.key }}
1614
{{- end }}

‎packages/system/cloudflare-tunnel-gateway-controller/patches/credentials-namespace.diff‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml b/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
2+
--- a/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
3+
+++ b/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
4+
@@ -9,8 +9,6 @@ spec:
5+
cloudflareCredentialsSecretRef:
6+
name: {{ required "gatewayClassConfig.cloudflareCredentialsSecretRef.name is required" .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.name }}
7+
- {{- if .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace }}
8+
- namespace: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace }}
9+
- {{- end }}
10+
+ namespace: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace | default .Release.Namespace | quote }}
11+
{{- if .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.key }}
12+
key: {{ .Values.gatewayClassConfig.cloudflareCredentialsSecretRef.key }}
13+
{{- end }}

‎packages/system/cloudflare-tunnel-gateway-controller/tests/wiring_test.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,33 @@ tests:
4949
path: spec.template.spec.containers[0].args
5050
content: --proxy-token-secret=cozy-cloudflare-tunnel-gateway-controller/cloudflare-tunnel-credentials
5151

52+
- it: names the credentials namespace used by the standard PackageSource installation
53+
template: charts/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
54+
asserts:
55+
- equal:
56+
path: spec.cloudflareCredentialsSecretRef.namespace
57+
value: cozy-cloudflare-tunnel-gateway-controller
58+
59+
- it: defaults credentials to a nonstandard release namespace
60+
release:
61+
namespace: alternate-tunnel
62+
template: charts/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
63+
asserts:
64+
- equal:
65+
path: spec.cloudflareCredentialsSecretRef.namespace
66+
value: alternate-tunnel
67+
68+
- it: preserves an explicit credentials namespace override as a string
69+
release:
70+
namespace: alternate-tunnel
71+
template: charts/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml
72+
set:
73+
cloudflare-tunnel-gateway-controller.gatewayClassConfig.cloudflareCredentialsSecretRef.namespace: "null"
74+
asserts:
75+
- equal:
76+
path: spec.cloudflareCredentialsSecretRef.namespace
77+
value: "null"
78+
5279
- it: passes the tunnel ID through to the GatewayClassConfig behind the cloudflare-tunnel class
5380
asserts:
5481
- template: charts/cloudflare-tunnel-gateway-controller/templates/gatewayclassconfig.yaml

0 commit comments

Comments
 (0)