Skip to content

Commit 5684195

Browse files
bkenezbkenez
authored
fix: refactor autogenerated secrets (#3988)
1 parent 5a08afd commit 5684195

File tree

4 files changed

+324
-78
lines changed

4 files changed

+324
-78
lines changed

‎charts/camunda-platform-8.8/templates/common/_helpers.tpl‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -832,6 +832,65 @@ false
832832
{{- end -}}
833833
{{- end -}}
834834
835+
{{/*
836+
shouldAutogenerateSecret
837+
Determines whether a secret should be autogenerated for a given component configuration.
838+
Returns "true" if autogeneration should occur, "false" otherwise.
839+
840+
This function handles both legacy (< 8.8) and new (>= 8.8) secret configuration patterns:
841+
1. If the component has no secret configuration at all -> autogenerate
842+
2. If the component explicitly references the autogenerated secret name -> autogenerate
843+
3. Otherwise -> do not autogenerate (user has their own secret config)
844+
845+
Note: This helper assumes it's called within the context where global autogeneration is enabled,
846+
since the secret template only renders when .Values.global.secrets.autoGenerated is true.
847+
848+
Usage:
849+
{{ if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
850+
"config" .Values.identity.firstUser
851+
"autogeneratedSecretName" .Values.global.secrets.name
852+
"plaintextKey" "password"
853+
"legacyKeyField" "existingSecretKey"
854+
)) "true" }}
855+
856+
Parameters:
857+
- config: The component's configuration object
858+
- autogeneratedSecretName: The name of the autogenerated secret
859+
- plaintextKey: The key to check for plaintext values (optional)
860+
- legacyKeyField: The legacy key field name (optional, defaults to "existingSecretKey")
861+
*/}}
862+
{{- define "camundaPlatform.shouldAutogenerateSecret" -}}
863+
{{- $config := .config | default dict -}}
864+
{{- $autogenSecretName := .autogeneratedSecretName | default "" -}}
865+
{{- $plaintextKey := .plaintextKey | default "password" -}}
866+
{{- $legacyKeyField := .legacyKeyField | default "existingSecretKey" -}}
867+
868+
{{- $result := "false" -}}
869+
870+
{{/* Check if component has no secret configuration */}}
871+
{{- $hasSecretConfig := include "camundaPlatform.hasSecretConfig" (dict
872+
"config" $config
873+
"plaintextKey" $plaintextKey
874+
"legacyKeyField" $legacyKeyField
875+
) -}}
876+
877+
{{- if eq $hasSecretConfig "false" -}}
878+
{{/* No secret config found -> autogenerate */}}
879+
{{- $result = "true" -}}
880+
{{- else -}}
881+
{{/* Check if component explicitly references the autogenerated secret */}}
882+
{{- if and $config.existingSecret (eq (toString $config.existingSecret) (toString $autogenSecretName)) -}}
883+
{{/* Legacy format points to autogen secret -> autogenerate */}}
884+
{{- $result = "true" -}}
885+
{{- else if and $config.secret $config.secret.existingSecret (eq (toString $config.secret.existingSecret) (toString $autogenSecretName)) -}}
886+
{{/* New format points to autogen secret -> autogenerate */}}
887+
{{- $result = "true" -}}
888+
{{- end -}}
889+
{{- end -}}
890+
891+
{{- $result -}}
892+
{{- end -}}
893+
835894
{{/*
836895
********************************************************************************
837896
Release highlights.

‎charts/camunda-platform-8.8/templates/common/secret-camunda.yaml‎

Lines changed: 66 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -17,64 +17,86 @@ metadata:
1717
"context" $) | nindent 4 }}
1818
type: Opaque
1919
data:
20-
{{- $identityAuthAdmin := (
21-
and (typeIs "string" .Values.global.identity.auth.admin.existingSecret)
22-
(eq .Values.global.identity.auth.admin.existingSecret "")
23-
) }}
24-
{{- $identityAuth := dict
25-
"connectors" (and (typeIs "string" .Values.global.identity.auth.connectors.existingSecret) (eq .Values.global.identity.auth.connectors.existingSecret ""))
26-
"console" (and (typeIs "string" .Values.global.identity.auth.console.existingSecret) (eq .Values.global.identity.auth.console.existingSecret ""))
27-
"orchestration" (and (typeIs "string" .Values.global.identity.auth.orchestration.existingSecret) (eq .Values.global.identity.auth.orchestration.existingSecret ""))
28-
"optimize" (and (typeIs "string" .Values.global.identity.auth.optimize.existingSecret) (eq .Values.global.identity.auth.optimize.existingSecret ""))
29-
}}
30-
{{- if or ($identityAuthAdmin)
31-
($identityAuth.connectors) ($identityAuth.console)
32-
($identityAuth.orchestration) ($identityAuth.optimize)
33-
}}
34-
# Identity apps auth.
35-
{{- if $identityAuthAdmin }}
36-
{{ .Values.global.identity.auth.admin.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
37-
{{- end }}
38-
{{- if $identityAuth.connectors }}
39-
{{ .Values.global.identity.auth.connectors.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
40-
{{- end }}
41-
{{- if $identityAuth.console }}
42-
{{ .Values.global.identity.auth.console.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
43-
{{- end }}
44-
{{- if $identityAuth.orchestration }}
45-
{{ .Values.global.identity.auth.orchestration.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
46-
{{- end }}
47-
{{- if $identityAuth.optimize }}
48-
{{ .Values.global.identity.auth.optimize.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
49-
{{- end }}
50-
{{- end }}
20+
{{- if .Values.global.identity.auth.enabled }}
21+
# Identity authentication client tokens.
22+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
23+
"config" .Values.global.identity.auth.admin
24+
"autogeneratedSecretName" .Values.global.secrets.name
25+
)) "true" }}
26+
{{ ((.Values.global.identity.auth.admin.secret).existingSecretKey) | default .Values.global.identity.auth.admin.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
27+
{{- end }}
28+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
29+
"config" .Values.global.identity.auth.connectors
30+
"autogeneratedSecretName" .Values.global.secrets.name
31+
)) "true" }}
32+
{{ ((.Values.global.identity.auth.connectors.secret).existingSecretKey) | default .Values.global.identity.auth.connectors.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
33+
{{- end }}
34+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
35+
"config" .Values.global.identity.auth.console
36+
"autogeneratedSecretName" .Values.global.secrets.name
37+
)) "true" }}
38+
{{ ((.Values.global.identity.auth.console.secret).existingSecretKey) | default .Values.global.identity.auth.console.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
39+
{{- end }}
40+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
41+
"config" .Values.global.identity.auth.orchestration
42+
"autogeneratedSecretName" .Values.global.secrets.name
43+
)) "true" }}
44+
{{ ((.Values.global.identity.auth.orchestration.secret).existingSecretKey) | default .Values.global.identity.auth.orchestration.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
45+
{{- end }}
46+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
47+
"config" .Values.global.identity.auth.optimize
48+
"autogeneratedSecretName" .Values.global.secrets.name
49+
)) "true" }}
50+
{{ ((.Values.global.identity.auth.optimize.secret).existingSecretKey) | default .Values.global.identity.auth.optimize.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
51+
{{- end }}
52+
53+
# Identity first user password.
54+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
55+
"config" .Values.identity.firstUser
56+
"autogeneratedSecretName" .Values.global.secrets.name
57+
"plaintextKey" "password"
58+
)) "true" }}
59+
{{ ((.Values.identity.firstUser.secret).existingSecretKey) | default .Values.identity.firstUser.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
60+
{{- end }}
5161

52-
{{- if and .Values.identity.firstUser.existingSecret (eq .Values.identity.firstUser.existingSecret .Values.global.secrets.name) }}
53-
# Identity login.
54-
{{ .Values.identity.firstUser.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
62+
# Identity Keycloak admin password.
63+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
64+
"config" .Values.identityKeycloak.auth
65+
"autogeneratedSecretName" .Values.global.secrets.name
66+
"plaintextKey" "adminPassword"
67+
)) "true" }}
68+
{{ ((.Values.identityKeycloak.auth.secret).passwordSecretKey) | default .Values.identityKeycloak.auth.passwordSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
69+
{{- end }}
5570
{{- end }}
5671

57-
{{- if and .Values.identityPostgresql.enabled (or (eq .Values.identityPostgresql.auth.existingSecret "") (eq .Values.identityPostgresql.auth.existingSecret .Values.global.secrets.name)) }}
5872
# Identity PostgreSQL.
73+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
74+
"config" .Values.identityPostgresql.auth
75+
"autogeneratedSecretName" .Values.global.secrets.name
76+
"plaintextKey" "postgresPassword"
77+
)) "true" }}
5978
{{ .Values.identityPostgresql.auth.secretKeys.adminPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
6079
{{ .Values.identityPostgresql.auth.secretKeys.userPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
6180
{{- end }}
6281

63-
{{- if and .Values.identityKeycloak.auth.existingSecret (eq .Values.identityKeycloak.auth.existingSecret .Values.global.secrets.name) }}
64-
# Identity Keycloak login.
65-
{{ .Values.identityKeycloak.auth.passwordSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
66-
{{- end }}
67-
68-
{{- if and .Values.identityKeycloak.postgresql.auth.existingSecret (eq .Values.identityKeycloak.postgresql.auth.existingSecret .Values.global.secrets.name) }}
82+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
83+
"config" .Values.identityKeycloak.postgresql.auth
84+
"autogeneratedSecretName" .Values.global.secrets.name
85+
"plaintextKey" "postgresPassword"
86+
)) "true" }}
6987
# Identity Keycloak PostgreSQL.
7088
{{ .Values.identityKeycloak.postgresql.auth.secretKeys.adminPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
7189
{{ .Values.identityKeycloak.postgresql.auth.secretKeys.userPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
7290
{{- end }}
7391

74-
{{- if and .Values.webModelerPostgresql.enabled (or (eq .Values.webModelerPostgresql.auth.existingSecret "") (eq .Values.webModelerPostgresql.auth.existingSecret .Values.global.secrets.name)) }}
75-
# WebModeler PostgreSQL.
92+
# Web Modeler PostgreSQL.
93+
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
94+
"config" .Values.webModelerPostgresql.auth
95+
"autogeneratedSecretName" .Values.global.secrets.name
96+
"plaintextKey" "postgresPassword"
97+
)) "true" }}
7698
{{ .Values.webModelerPostgresql.auth.secretKeys.adminPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
7799
{{ .Values.webModelerPostgresql.auth.secretKeys.userPasswordKey }}: "{{ randAlphaNum 16 | b64enc }}"
78100
{{- end }}
79101

80-
{{- end }}
102+
{{- end }}

‎charts/camunda-platform-8.8/test/unit/common/golden/secret-camunda.golden.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ metadata:
2121
helm.sh/resource-policy: keep
2222
type: Opaque
2323
data:
24-
# Identity apps auth.
25-
# Identity login.
26-
# Identity Keycloak login.
27-
# Identity Keycloak PostgreSQL.
24+
25+
# Identity PostgreSQL.
26+
# Identity Keycloak PostgreSQL.
27+
28+
# Web Modeler PostgreSQL.

0 commit comments

Comments
 (0)