Skip to content

helm: add collabora.config and configFromSecrets values#15931

Open
Rash419 wants to merge 1 commit into
mainfrom
helm-structured-config
Open

helm: add collabora.config and configFromSecrets values#15931
Rash419 wants to merge 1 commit into
mainfrom
helm-structured-config

Conversation

@Rash419

@Rash419 Rash419 commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

A single unstructured extra_params string of --o: flags does not scale and cannot carry secrets. collabora.config is a flat map of coolwsd setting paths rendered into the ConfigMap and mounted at /etc/coolwsd/overrides.d, where coolwsd of version 26.04 or later picks it up. The map is flat because index and attribute syntax like monitors.monitor[0][@retryInterval] has no natural nested YAML form, and flat keys can be copied straight from an existing extra_params.

collabora.configFromSecrets binds setting paths to Kubernetes Secrets. It is a map keyed by the setting path, because helm merges maps per key across values files while lists are replaced wholesale. With create true the chart creates the Secret from the given value, and rotation rolls the pods through the confighash annotation. With create false an existing Secret is referenced. Either way coolwsd reads the value from the mounted file, so it never appears in the ConfigMap, the pod spec or the logs.

Entries are validated at template time: setting paths that would break the key=value file format, values with newlines, invalid Secret names and keys, and the admin_console credentials, which the chart always injects as environment variables that would override the new layer anyway.

extra_params keeps working and stays the default for ssl.enable=false because the current appVersion image does not read overrides.d yet. Flip the default to config once appVersion is on 26.04.

Change-Id: I2b1f12ec829519d1aa4f142e1e4ad14d4a702ff6

Depends on gerrit change: https://gerrit.collaboraoffice.com/c/online/+/4270/2

A single unstructured extra_params string of --o: flags does not scale
and cannot carry secrets. collabora.config is a flat map of coolwsd
setting paths rendered into the ConfigMap and mounted at
/etc/coolwsd/overrides.d, where coolwsd of version 26.04 or later picks
it up. The map is flat because index and attribute syntax like
monitors.monitor[0][@retryInterval] has no natural nested YAML form,
and flat keys can be copied straight from an existing extra_params.

collabora.configFromSecrets binds setting paths to Kubernetes Secrets.
It is a map keyed by the setting path, because helm merges maps per key
across values files while lists are replaced wholesale. With create
true the chart creates the Secret from the given value, and rotation
rolls the pods through the confighash annotation. With create false an
existing Secret is referenced. Either way coolwsd reads the value from
the mounted file, so it never appears in the ConfigMap, the pod spec or
the logs.

Entries are validated at template time: setting paths that would break
the key=value file format, values with newlines, invalid Secret names
and keys, and the admin_console credentials, which the chart always
injects as environment variables that would override the new layer
anyway.

extra_params keeps working and stays the default for ssl.enable=false
because the current appVersion image does not read overrides.d yet.
Flip the default to config once appVersion is on 26.04.

Signed-off-by: Rashesh Padia <rashesh.padia@collabora.com>
Change-Id: I2b1f12ec829519d1aa4f142e1e4ad14d4a702ff6
@timar

timar commented Jul 1, 2026

Copy link
Copy Markdown
Member

I'm sorry @Rash419 I did not notice this PR, and it cannot be rebased to main without conflicts. Please rebase it, and ping me again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: To Review

Development

Successfully merging this pull request may close these issues.

2 participants