Skip to content

Commit 4c0b478

Browse files
mbillowmbillow
committed
refactor: move config values to templated config map
1 parent 3f2a8a3 commit 4c0b478

6 files changed

Lines changed: 80 additions & 13 deletions

File tree

‎chart/templates/configmap.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{- if .Values.pint.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "pint.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "pint.labels" . | nindent 4 }}
9+
data:
10+
PINT_CLIENT_ID: {{ .Values.config.clientID | quote }}
11+
PINT_SERVER_URL: {{ .Values.config.serverURL | quote }}
12+
PINT_IPA_HOST: {{ .Values.config.ipaHost | quote }}
13+
PINT_IPA_SERVICE_ACCOUNT: {{ .Values.config.ipaServiceAccount | quote }}
14+
PINT_IPA_CA_NAME: {{ .Values.config.ipaCAName | quote }}
15+
PINT_IPA_RADSEC_CA_NAME: {{ .Values.config.ipaRadSecCAName | quote }}
16+
PINT_IPA_ROOT_CA_NAME: {{ .Values.config.ipaRootCAName | quote }}
17+
PINT_WIFI_SSID: {{ .Values.config.wifiSSID | quote }}
18+
PINT_RADIUS_SERVER: {{ .Values.config.radiusServer | quote }}
19+
{{- if .Values.config.ipaCertProfile }}
20+
PINT_IPA_CERT_PROFILE: {{ .Values.config.ipaCertProfile | quote }}
21+
{{- end }}
22+
{{- if .Values.config.ipaRadSecClientCertProfile }}
23+
PINT_IPA_RADSEC_CLIENT_CERT_PROFILE: {{ .Values.config.ipaRadSecClientCertProfile | quote }}
24+
{{- end }}
25+
{{- if .Values.config.ipaRadSecServerCertProfile }}
26+
PINT_IPA_RADSEC_SERVER_CERT_PROFILE: {{ .Values.config.ipaRadSecServerCertProfile | quote }}
27+
{{- end }}
28+
{{- if .Values.config.ipaSkipTLSVerify }}
29+
PINT_IPA_SKIP_TLS_VERIFY: "true"
30+
{{- end }}
31+
{{- end }}

‎chart/templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ spec:
2525
- containerPort: 8080
2626
name: http
2727
envFrom:
28+
- configMapRef:
29+
name: {{ include "pint.fullname" . }}
2830
- secretRef:
2931
name: {{ .Values.envSecret }}
3032
env:

‎chart/values-dev.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,20 @@
55
pint:
66
enabled: false
77

8+
# Stub config values for dev; PINT itself runs locally so these are unused,
9+
# but they keep 'helm lint' and 'helm template' happy.
10+
config:
11+
clientID: pint-dev
12+
serverURL: http://localhost:8080
13+
ipaHost: localhost:8088
14+
ipaServiceAccount: pint
15+
ipaCAName: ipa
16+
ipaRadSecCAName: radsec
17+
ipaRootCAName: ipa
18+
ipaSkipTLSVerify: true
19+
wifiSSID: CSH
20+
radiusServer: localhost:2083
21+
822
freeradius:
923
image:
1024
tag: dev

‎chart/values.yaml‎

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,37 @@ pint:
1414
tag: "" # defaults to Chart.appVersion
1515
pullPolicy: IfNotPresent
1616

17-
# Pre-existing Secret containing sensitive PINT environment variables.
18-
# Required when pint.enabled=true. Must contain:
19-
# PINT_CLIENT_ID, PINT_CLIENT_SECRET, PINT_SERVER_URL,
20-
# PINT_LOGIN_URL, PINT_CALLBACK_URL,
21-
# PINT_IPA_HOST, PINT_IPA_SERVICE_ACCOUNT, PINT_IPA_PASSWORD,
22-
# PINT_IPA_CA_NAME, PINT_IPA_RADSEC_CA_NAME, PINT_IPA_ROOT_CA_NAME,
23-
# PINT_WIFI_SSID, PINT_RADIUS_SERVER
24-
# Non-sensitive config (namespace, secret names, pod selector) is injected
25-
# directly by the chart and does not need to be in this Secret.
17+
# Non-sensitive PINT application configuration rendered into a ConfigMap.
18+
# Sensitive values (PINT_CLIENT_SECRET, PINT_IPA_PASSWORD) must still be
19+
# provided in the Secret named by envSecret below.
20+
config:
21+
# OIDC
22+
clientID: ""
23+
serverURL: ""
24+
25+
# FreeIPA
26+
ipaHost: ""
27+
ipaServiceAccount: ""
28+
ipaCAName: ""
29+
ipaRadSecCAName: ""
30+
ipaRootCAName: "ipa"
31+
# Optional Dogtag cert profiles; leave blank to use CA defaults.
32+
ipaCertProfile: ""
33+
ipaRadSecClientCertProfile: ""
34+
ipaRadSecServerCertProfile: ""
35+
ipaSkipTLSVerify: false
36+
37+
# WiFi
38+
wifiSSID: ""
39+
40+
# RADIUS
41+
radiusServer: ""
42+
43+
# Pre-existing Secret containing sensitive PINT credentials.
44+
# Required when pint.enabled=true. Must contain only:
45+
# PINT_CLIENT_SECRET - OIDC client secret
46+
# PINT_IPA_PASSWORD - FreeIPA service account password
47+
# All other config is rendered into a ConfigMap from the config block above.
2648
envSecret: pint-env
2749

2850
# Names of the K8s Secrets PINT creates and manages at runtime.

‎internal/config/config.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,6 @@ func Load() (*Config, error) {
5757
cfg.ClientID = require("PINT_CLIENT_ID")
5858
cfg.ClientSecret = require("PINT_CLIENT_SECRET")
5959
cfg.ServerURL = require("PINT_SERVER_URL")
60-
cfg.LoginURL = require("PINT_LOGIN_URL")
61-
cfg.CallbackURL = require("PINT_CALLBACK_URL")
6260
cfg.IPAHost = require("PINT_IPA_HOST")
6361
cfg.IPAServiceAccount = require("PINT_IPA_SERVICE_ACCOUNT")
6462
cfg.IPAPassword = require("PINT_IPA_PASSWORD")
@@ -85,6 +83,8 @@ func Load() (*Config, error) {
8583
cfg.IPACertProfile = os.Getenv("PINT_IPA_CERT_PROFILE")
8684
cfg.RadSecClientCertProfile = os.Getenv("PINT_IPA_RADSEC_CLIENT_CERT_PROFILE")
8785
cfg.RadSecServerCertProfile = os.Getenv("PINT_IPA_RADSEC_SERVER_CERT_PROFILE")
86+
cfg.LoginURL = cfg.ServerURL + "/auth/login"
87+
cfg.CallbackURL = cfg.ServerURL + "/auth/callback"
8888
cfg.IPAPrincipal = principalFromDN(cfg.IPAServiceAccount)
8989
cfg.IPAServiceHostname = hostnameFromPrincipal(cfg.IPAPrincipal)
9090

‎internal/config/config_test.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@ func fullEnv() map[string]string {
1919
"PINT_CLIENT_ID": "test-client",
2020
"PINT_CLIENT_SECRET": "test-secret",
2121
"PINT_SERVER_URL": "http://localhost:8080",
22-
"PINT_LOGIN_URL": "http://localhost:8080/auth/login",
23-
"PINT_CALLBACK_URL": "http://localhost:8080/auth/callback",
2422
"PINT_IPA_HOST": "ipa.example.com",
2523
"PINT_IPA_SERVICE_ACCOUNT": "pint",
2624
"PINT_IPA_PASSWORD": "hunter2",

0 commit comments

Comments
 (0)