fides-secrets.yaml

{{- if not .Values.fides.configuration.fidesSecuritySecretName }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "fides.fidesSecuritySecretName" . }}
data:
  # try to get the old secret
  # keep in mind, a dry-run only returns an empty map 
  {{- $existing_secret := lookup "v1" "Secret" .Release.Namespace  ( include "fides.fidesSecuritySecretName" . ) }}
  # check, if a secret is already set
  {{- if or (not $existing_secret) (not $existing_secret.data) }}
  # if not set, then generate a new encryption key and set of OAuth root credentials
  FIDES__SECURITY__APP_ENCRYPTION_KEY: {{ randAlphaNum 32 | b64enc }}
  FIDES__SECURITY__OAUTH_ROOT_CLIENT_ID: {{ uuidv4 | b64enc }}
  FIDES__SECURITY__OAUTH_ROOT_CLIENT_SECRET: {{ randAlphaNum 24 | b64enc }}
  FIDES__SECURITY__DRP_JWT_SECRET: {{ randAlphaNum 24 | b64enc }}
  {{- else }}
  # if set, then use the old values
  FIDES__SECURITY__APP_ENCRYPTION_KEY: {{ index $existing_secret.data "FIDES__SECURITY__APP_ENCRYPTION_KEY" }}
  FIDES__SECURITY__OAUTH_ROOT_CLIENT_ID: {{ index $existing_secret.data "FIDES__SECURITY__OAUTH_ROOT_CLIENT_ID" }}
  FIDES__SECURITY__OAUTH_ROOT_CLIENT_SECRET: {{ index $existing_secret.data "FIDES__SECURITY__OAUTH_ROOT_CLIENT_SECRET" }}
  FIDES__SECURITY__DRP_JWT_SECRET: {{ index $existing_secret.data "FIDES__SECURITY__DRP_JWT_SECRET" }}
  {{- end }}
{{- end }}