Skip to content

Commit 8e37948

Browse files
hamza-m-masoodhamza-m-masood
authored
fix: remove console secret since console is a public OIDC client (#4482)
1 parent 19d9c4f commit 8e37948

File tree

41 files changed

+24
-270
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+24
-270
lines changed

‎charts/camunda-platform-8.5/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -530,8 +530,6 @@ Please see the corresponding [release guide](../../docs/release.md) to find out
530530
| `global.identity.auth.console.clientId` | defines the client id, which is used by Console in authentication flows. | `console` |
531531
| `global.identity.auth.console.audience` | defines the audience which is used by Console's client API. | `console-api` |
532532
| `global.identity.auth.console.wellKnown` | defines the uri for the well known config which is used by Console (optional). | `https://well-known-uri` |
533-
| `global.identity.auth.console.existingSecret` | A string literal secret can be provided. If not set, a random secret is generated. Recommended: reference an existing Kubernetes Secret using global.identity.auth.console.existingSecret.name. | `{}` |
534-
| `global.identity.auth.console.existingSecretKey` | defines the key within the existing secret object. | `console-secret` |
535533
| `global.identity.auth.console.redirectUrl` | defines the root URL which is used by Keycloak to access WebModeler. | `http://localhost:8080` |
536534
| `global.identity.auth.zeebe` | configuration to configure Zeebe authentication specifics on global level, which can be accessed by other sub-charts | |
537535
| `global.identity.auth.zeebe.clientId` | defines the client id, which is used by Zeebe in authentication flows. | `zeebe` |

‎charts/camunda-platform-8.5/templates/camunda/constraints.tpl‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,6 @@ Fail with a message if zeebeGateway.contextPath and zeebeGateway.ingress.rest.pa
103103
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.optimize.existingSecret.name" }}
104104
{{- end }}
105105

106-
{{ if and (.Values.global.identity.auth.enabled) (.Values.console.enabled) (not .Values.global.identity.auth.console.existingSecret) }}
107-
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.console.existingSecret.name" }}
108-
{{- end }}
109-
110106
{{ if and (.Values.global.identity.auth.enabled) (.Values.zeebe.enabled) (not .Values.global.identity.auth.zeebe.existingSecret) }}
111107
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.zeebe.existingSecret.name" }}
112108
{{- end }}
@@ -152,7 +148,6 @@ data:
152148
tasklist-secret: <base64-encoded-secret>
153149
optimize-secret: <base64-encoded-secret>
154150
connectors-secret: <base64-encoded-secret>
155-
console-secret: <base64-encoded-secret>
156151
keycloak-secret: <base64-encoded-secret>
157152
zeebe-secret: <base64-encoded-secret>
158153
admin-password: <base64-encoded-secret> # used for keycloak
@@ -188,7 +183,6 @@ data:
188183
tasklist-secret: <base64-encoded-secret>
189184
optimize-secret: <base64-encoded-secret>
190185
connectors-secret: <base64-encoded-secret>
191-
console-secret: <base64-encoded-secret>
192186
keycloak-secret: <base64-encoded-secret>
193187
zeebe-secret: <base64-encoded-secret>
194188
admin-password: <base64-encoded-secret> # used for keycloak

‎charts/camunda-platform-8.5/templates/camunda/secret-camunda.yaml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,12 @@ data:
2020
{{- $identityAuth := dict
2121
"admin" (((.Values.global.identity.auth).admin).existingSecret).name
2222
"connectors" (.Values.global.identity.auth.connectors.existingSecret).name
23-
"console" (.Values.global.identity.auth.console.existingSecret).name
2423
"operate" (.Values.global.identity.auth.operate.existingSecret).name
2524
"optimize" (.Values.global.identity.auth.optimize.existingSecret).name
2625
"tasklist" (.Values.global.identity.auth.tasklist.existingSecret).name
2726
"zeebe" (.Values.global.identity.auth.zeebe.existingSecret).name
2827
}}
29-
{{- if or ($identityAuth.connectors) ($identityAuth.console) ($identityAuth.operate)
28+
{{- if or ($identityAuth.connectors) ($identityAuth.operate)
3029
($identityAuth.optimize) ($identityAuth.tasklist) ($identityAuth.zeebe)
3130
}}
3231
# Identity apps auth.
@@ -36,9 +35,6 @@ data:
3635
{{- if $identityAuth.connectors }}
3736
{{ .Values.global.identity.auth.connectors.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
3837
{{- end }}
39-
{{- if $identityAuth.console }}
40-
{{ .Values.global.identity.auth.console.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
41-
{{- end }}
4238
{{- if $identityAuth.operate }}
4339
{{ .Values.global.identity.auth.operate.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
4440
{{- end }}

‎charts/camunda-platform-8.5/templates/camunda/secret-console.yaml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎charts/camunda-platform-8.5/templates/identity/deployment.yaml‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -55,23 +55,6 @@ spec:
5555
name: {{ include "camundaPlatform.identitySecretName" (dict "context" . "component" "operate") }}
5656
key: {{ .Values.global.identity.auth.operate.existingSecretKey }}
5757
{{- end }}
58-
- name: KEYCLOAK_INIT_CONSOLE_SECRET
59-
{{- if and .Values.global.identity.auth.console.existingSecret (not (typeIs "string" .Values.global.identity.auth.console.existingSecret)) }}
60-
valueFrom:
61-
secretKeyRef:
62-
{{- /*
63-
Helper: https://github.com/bitnami/charts/blob/master/bitnami/common/templates/_secrets.tpl
64-
Usage in keycloak secrets https://github.com/bitnami/charts/blob/master/bitnami/keycloak/templates/secrets.yaml
65-
and in statefulset https://github.com/bitnami/charts/blob/master/bitnami/keycloak/templates/statefulset.yaml
66-
*/}}
67-
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.global.identity.auth.console.existingSecret "context" $) }}
68-
key: {{ .Values.global.identity.auth.console.existingSecretKey }}
69-
{{- else }}
70-
valueFrom:
71-
secretKeyRef:
72-
name: {{ include "camundaPlatform.identitySecretName" (dict "context" . "component" "console") }}
73-
key: {{ .Values.global.identity.auth.console.existingSecretKey }}
74-
{{- end }}
7558
- name: KEYCLOAK_INIT_TASKLIST_SECRET
7659
{{- if and .Values.global.identity.auth.tasklist.existingSecret (not (typeIs "string" .Values.global.identity.auth.tasklist.existingSecret)) }}
7760
valueFrom:

‎charts/camunda-platform-8.5/test/unit/camunda/goldenfiles_test.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ func TestGoldenDefaultsTemplateSecrets(t *testing.T) {
3232
require.NoError(t, err)
3333
templateNames := []string{
3434
"secret-connectors",
35-
"secret-console",
3635
"secret-operate",
3736
"secret-optimize",
3837
"secret-tasklist",

‎charts/camunda-platform-8.5/test/unit/camunda/secret_test.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,13 @@ func (s *SecretTest) TestDifferentValuesInputs() {
5555
// Define components that need secret tests
5656
components := []string{
5757
"Connectors",
58-
"Console",
5958
"Operate",
6059
"Optimize",
6160
"TaskList",
6261
"Zeebe",
6362
}
6463

65-
require.Equal(s.T(), len(components), 6, "Expected 6 components to be tested")
64+
require.Equal(s.T(), len(components), 5, "Expected 5 components to be tested")
6665

6766
// Create test cases for each component
6867
testCases := make([]testhelpers.TestCase, 0, len(components)+1)

‎charts/camunda-platform-8.5/test/unit/identity/golden/deployment.golden.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,6 @@ spec:
6060
secretKeyRef:
6161
name: camunda-platform-test-operate-identity-secret
6262
key: operate-secret
63-
- name: KEYCLOAK_INIT_CONSOLE_SECRET
64-
valueFrom:
65-
secretKeyRef:
66-
name: camunda-platform-test-console-identity-secret
67-
key: console-secret
6863
- name: KEYCLOAK_INIT_TASKLIST_SECRET
6964
valueFrom:
7065
secretKeyRef:

‎charts/camunda-platform-8.5/values.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -352,11 +352,6 @@ global:
352352
audience: console-api
353353
## @param global.identity.auth.console.wellKnown defines the uri for the well known config which is used by Console (optional).
354354
wellKnown: https://well-known-uri
355-
## @param global.identity.auth.console.existingSecret [string,object] A string literal secret can be provided. If not set, a random secret is generated. Recommended: reference an existing Kubernetes Secret using global.identity.auth.console.existingSecret.name.
356-
# The existing secret should contain an `console-secret` field, which will be used as secret for the identity-console communication.
357-
existingSecret:
358-
## @param global.identity.auth.console.existingSecretKey defines the key within the existing secret object.
359-
existingSecretKey: console-secret
360355
## @param global.identity.auth.console.redirectUrl defines the root URL which is used by Keycloak to access WebModeler.
361356
# Should be publicly accessible, the default value works if a port-forward to WebModeler is created to 8080.
362357
# Can be overwritten if ingress is in use and an external IP is available.

‎charts/camunda-platform-8.6/templates/camunda/constraints.tpl‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,6 @@ Fail with a message if zeebeGateway.contextPath and zeebeGateway.ingress.rest.pa
112112
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.optimize.existingSecret.name" }}
113113
{{- end }}
114114

115-
{{ if and (.Values.global.identity.auth.enabled) (.Values.console.enabled) (not .Values.global.identity.auth.console.existingSecret) }}
116-
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.console.existingSecret.name" }}
117-
{{- end }}
118-
119115
{{ if and (.Values.global.identity.auth.enabled) (.Values.zeebe.enabled) (not .Values.global.identity.auth.zeebe.existingSecret) }}
120116
{{- $existingSecretsNotConfigured = append $existingSecretsNotConfigured "global.identity.auth.zeebe.existingSecret.name" }}
121117
{{- end }}
@@ -159,7 +155,6 @@ type: Opaque
159155
data:
160156
# Identity apps auth.
161157
connectors-secret: <base64-encoded-secret>
162-
console-secret: <base64-encoded-secret>
163158
operate-secret: <base64-encoded-secret>
164159
optimize-secret: <base64-encoded-secret>
165160
tasklist-secret: <base64-encoded-secret>
@@ -198,7 +193,6 @@ type: Opaque
198193
data:
199194
# Identity apps auth.
200195
connectors-secret: <base64-encoded-secret>
201-
console-secret: <base64-encoded-secret>
202196
operate-secret: <base64-encoded-secret>
203197
optimize-secret: <base64-encoded-secret>
204198
tasklist-secret: <base64-encoded-secret>

0 commit comments

Comments
 (0)