helm: add collabora.config and configFromSecrets values#15931
Open
Rash419 wants to merge 1 commit into
Open
Conversation
A single unstructured extra_params string of --o: flags does not scale and cannot carry secrets. collabora.config is a flat map of coolwsd setting paths rendered into the ConfigMap and mounted at /etc/coolwsd/overrides.d, where coolwsd of version 26.04 or later picks it up. The map is flat because index and attribute syntax like monitors.monitor[0][@retryInterval] has no natural nested YAML form, and flat keys can be copied straight from an existing extra_params. collabora.configFromSecrets binds setting paths to Kubernetes Secrets. It is a map keyed by the setting path, because helm merges maps per key across values files while lists are replaced wholesale. With create true the chart creates the Secret from the given value, and rotation rolls the pods through the confighash annotation. With create false an existing Secret is referenced. Either way coolwsd reads the value from the mounted file, so it never appears in the ConfigMap, the pod spec or the logs. Entries are validated at template time: setting paths that would break the key=value file format, values with newlines, invalid Secret names and keys, and the admin_console credentials, which the chart always injects as environment variables that would override the new layer anyway. extra_params keeps working and stays the default for ssl.enable=false because the current appVersion image does not read overrides.d yet. Flip the default to config once appVersion is on 26.04. Signed-off-by: Rashesh Padia <rashesh.padia@collabora.com> Change-Id: I2b1f12ec829519d1aa4f142e1e4ad14d4a702ff6
Member
|
I'm sorry @Rash419 I did not notice this PR, and it cannot be rebased to main without conflicts. Please rebase it, and ping me again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A single unstructured extra_params string of --o: flags does not scale and cannot carry secrets. collabora.config is a flat map of coolwsd setting paths rendered into the ConfigMap and mounted at /etc/coolwsd/overrides.d, where coolwsd of version 26.04 or later picks it up. The map is flat because index and attribute syntax like monitors.monitor[0][@retryInterval] has no natural nested YAML form, and flat keys can be copied straight from an existing extra_params.
collabora.configFromSecrets binds setting paths to Kubernetes Secrets. It is a map keyed by the setting path, because helm merges maps per key across values files while lists are replaced wholesale. With create true the chart creates the Secret from the given value, and rotation rolls the pods through the confighash annotation. With create false an existing Secret is referenced. Either way coolwsd reads the value from the mounted file, so it never appears in the ConfigMap, the pod spec or the logs.
Entries are validated at template time: setting paths that would break the key=value file format, values with newlines, invalid Secret names and keys, and the admin_console credentials, which the chart always injects as environment variables that would override the new layer anyway.
extra_params keeps working and stays the default for ssl.enable=false because the current appVersion image does not read overrides.d yet. Flip the default to config once appVersion is on 26.04.
Change-Id: I2b1f12ec829519d1aa4f142e1e4ad14d4a702ff6
Depends on gerrit change: https://gerrit.collaboraoffice.com/c/online/+/4270/2