fix(calendar): remove hardcoded api key and inject via env var by TineoC · Pull Request #623 · kubernetes/contributor-site

TineoC · 2026-01-16T20:04:44Z

This PR addresses the security issue of having a hardcoded Google Calendar API key in the source code.

Changes

Removed Hardcoded Key: The API key has been removed from static/js/calendar.js.
Environment Variable Injection: The key is now injected into the calendar script via the GOOGLE_CALENDAR_API_KEY environment variable in layouts/calendar/baseof.html.
Graceful Degradation: The renderCalendar function now checks if the key is valid. If it's missing or set to the default PLACEHOLDER_VALUE, it displays a user-friendly "Community Calendar is not available" message instead of crashing or showing a console error.
Default Configuration: Added google_calendar_api_key: 'PLACEHOLDER_VALUE' to hugo.yaml to serve as a default and documentation.

Production Setup Instructions (Netlify)

To ensure the calendar works in the production environment, follow these steps:

Log in to your Netlify dashboard.
Select the kubernetes-contributor-site (or equivalent) site.
Navigate to Site configuration > Environment variables.
Click Add a variable.
Key: GOOGLE_CALENDAR_API_KEY
Value: Enter the valid Google Calendar API key (restricted to your domain).
Click Create variable.
Trigger a new deploy (e.g., "Retry deploy" > "Deploy site") for the changes to take effect.

Local Development

For local development, the calendar will show a placeholder message by default. To test the calendar functionality locally:

Obtain a valid API key (or use a dev-specific key).
Run the server with the environment variable:
```
export GOOGLE_CALENDAR_API_KEY="your-api-key"
hugo server
```
OR add the key in hugo.yaml

params:
  google_calendar_api_key: 'PLACEHOLDER_VALUE'

Closes #45

k8s-ci-robot · 2026-01-16T20:04:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: TineoC
Once this PR has been reviewed and has the lgtm label, please assign stmcginnis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

TineoC · 2026-01-16T20:08:47Z

Before merging this changes. Please follow the steps mentioned in "Production Setup Instructions (Netlify)"

- Removes the hardcoded Google Calendar API key from JS. - Injects the key via 'GOOGLE_CALENDAR_API_KEY' environment variable. - Adds a fallback to 'site.Params.google_calendar_api_key' in hugo.yaml. - Sets a default 'PLACEHOLDER_VALUE' in hugo.yaml. - Implements graceful degradation: if the key is missing or is the placeholder, the calendar displays a 'not available' message instead of crashing.

lmktfy

Partial feedback

lmktfy · 2026-01-18T09:24:39Z

hugo.yaml


 # Everything below this are Site Params
 params:
+  google_calendar_api_key: 'PLACEHOLDER_VALUE'


Why this addition?

for allowing devs add their Google Calendar keys for local development. but is simpler to just use them in prod. I agree with you

lmktfy · 2026-01-18T09:25:28Z

layouts/calendar/baseof.html

    <script src='{{ .Site.BaseURL }}/js/calendar.js'></script>
    <script>
-      renderCalendar();
+      {{ $apiKey := getenv "HUGO_GOOGLE_CALENDAR_API_KEY" | default .Site.Params.google_calendar_api_key | default "" }}


Can we make the requirement conditional on whether it is a production build?

lmktfy · 2026-01-18T09:25:56Z

static/js/calendar.js

+
+    if (!apiKey || apiKey === 'PLACEHOLDER_VALUE') {
+      console.warn('Google Calendar API key is missing. Calendar will not render.');
+      calendarEl.innerHTML = '<div style="padding: 20px; border: 1px solid #ccc; background: #f9f9f9; text-align: center;">Community Calendar is not available in this environment (missing API Key).</div>';


Avoid embedding CSS here

- Removed the placeholder value for the Google Calendar API key from hugo.yaml. - Modified the JavaScript in baseof.html to conditionally render the calendar based on the production environment, ensuring that the API key is only used in production and defaults to an empty string otherwise.

- Removed the check for the placeholder value in the Google Calendar API key validation.

lmktfy · 2026-01-18T16:53:58Z

layouts/calendar/baseof.html

    <script>
-      renderCalendar();
+      {{ if hugo.IsProduction }}
+        {{ $apiKey := getenv "HUGO_GOOGLE_CALENDAR_API_KEY" | default "" }}


Here's how I'd do it

Always try to fetch the value

If not production, it doesn't matter

If it's missing *in production", call errorf to outright fail the build

lmktfy · 2026-01-18T16:59:58Z

static/js/calendar.js

  document.addEventListener('DOMContentLoaded', function() {
    var calendarEl = document.getElementById('calendar');
+
+    if (!calendarEl) {


A trick: we can set eg data-isproduction on the root <html> element. But we only do that for production builds, and then client side we know if a calendar / API key is expected.

like this?

<html {{ if hugo.IsProduction }}data-isproduction="true"{{ end }}>

- Added a check for the presence of the Google Calendar API key in production environments, ensuring that an error is logged if it is missing. - Updated the JavaScript to differentiate between production and non-production warnings for the missing API key.

TineoC · 2026-02-07T15:56:59Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

jberkus · 2026-02-12T16:58:00Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

@ameukam ?

ameukam · 2026-02-12T18:35:19Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

@ameukam ?

That will be @kubernetes/steering-committee which is the current admin group of the Google Workspace org we use: https://github.com/kubernetes/steering#google-workspace

BenTheElder · 2026-02-12T18:54:03Z

Specifically: https://github.com/kubernetes/steering#top-level-accounts

BenTheElder · 2026-02-12T18:54:35Z

Though steering doesn't have access to the Netlify side, just the Google Workspace.

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Jan 16, 2026

k8s-ci-robot requested review from SayakMukhopadhyay and reylejano January 16, 2026 20:04

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 16, 2026

TineoC force-pushed the fix/remove-hardcoded-api-key branch from 71e96f0 to eefacc4 Compare January 16, 2026 20:05

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Jan 16, 2026

TineoC force-pushed the fix/remove-hardcoded-api-key branch from b315ccc to 6b4e71d Compare January 16, 2026 20:13

lmktfy reviewed Jan 18, 2026

View reviewed changes

TineoC added 3 commits January 18, 2026 10:32

chore: remove css from missing calendar error component

ab9b31a

fix(calendar): simplify API key validation logic

bc9d9f8

- Removed the check for the placeholder value in the Google Calendar API key validation.

TineoC requested a review from lmktfy January 18, 2026 16:13

lmktfy reviewed Jan 18, 2026

View reviewed changes

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 19, 2026

TineoC requested a review from lmktfy January 29, 2026 02:05

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 12, 2026

Merge branch 'master' into fix/remove-hardcoded-api-key

8ec4e20

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 12, 2026

Conversation

TineoC commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Production Setup Instructions (Netlify)

Local Development

Uh oh!

k8s-ci-robot commented Jan 16, 2026

Uh oh!

TineoC commented Jan 16, 2026

Uh oh!

lmktfy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC commented Feb 7, 2026

Uh oh!

jberkus commented Feb 12, 2026

Uh oh!

ameukam commented Feb 12, 2026

Uh oh!

BenTheElder commented Feb 12, 2026

Uh oh!

BenTheElder commented Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

TineoC commented Jan 16, 2026 •

edited

Loading

lmktfy left a comment •

edited

Loading

TineoC Jan 18, 2026 •

edited

Loading