added secret generation for THAND_SECRET

Author: hughneale

.gitignore

@@ -0,0 +1,28 @@
+# Helm dependencies
+charts/*/charts/
+charts/*/Chart.lock
+
+# Helm packages
+*.tgz
+
+# Chart releaser packages
+.cr-release-packages/
+.cr-index/
+
+# Temporary files
+*.tmp
+*.bak
+
+# IDE/Editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log

charts/agent/templates/deployment.yaml

@@ -52,6 +52,27 @@ spec:
           - name: {{ .name }}
             value: {{ .value | quote }}
           {{- end }}
+          {{- if .Values.secrets.enabled }}
+          {{- $secretData := .Values.secrets.data | default dict }}
+          {{- if .Values.secrets.generate.enabled }}
+            {{- range $key := .Values.secrets.generate.keys }}
+              {{- if not (hasKey $secretData $key) }}
+          - name: {{ $key }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ $.Values.secrets.existingSecret | default (printf "%s-secrets" (include "agent.fullname" $)) }}
+                key: {{ $key }}
+              {{- end }}
+            {{- end }}
+          {{- end }}
+          {{- range $key, $value := $secretData }}
+          - name: {{ $key }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ $.Values.secrets.existingSecret | default (printf "%s-secrets" (include "agent.fullname" $)) }}
+                key: {{ $key }}
+          {{- end }}
+          {{- end }}
           {{- with .Values.envFrom }}
           envFrom:
             {{- toYaml . | nindent 12 }}

charts/agent/templates/secret.yaml

@@ -0,0 +1,33 @@
+{{- if and .Values.secrets.enabled (not .Values.secrets.existingSecret) }}
+{{- $secretData := .Values.secrets.data | default dict }}
+{{- if .Values.secrets.generate.enabled }}
+  {{- range $key := .Values.secrets.generate.keys }}
+    {{- if not (hasKey $secretData $key) }}
+      {{- $_ := set $secretData $key (randAlphaNum (.Values.secrets.generate.length | default 32)) }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "agent.fullname" . }}-secrets
+  namespace: {{ include "agent.namespace" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+  annotations:
+    # Force secret regeneration on upgrade if auto-generation is enabled
+    {{- if .Values.secrets.generate.enabled }}
+    "helm.sh/hook": "pre-install,pre-upgrade"
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+    {{- end }}
+type: Opaque
+{{- if $secretData }}
+data:
+  {{- range $key, $value := $secretData }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+  {{- end }}
+{{- else }}
+data: {}
+{{- end }}
+{{- end }}

charts/agent/values.yaml

@@ -5,6 +5,9 @@
 # Namespace where the agent will be deployed
 namespaceOverride: ""
 
+# Hostname for external access
+hostname: "thand-agent.local"
+
 # Number of replicas for the deployment
 replicaCount: 1
 
@@ -87,14 +90,14 @@ ingress:
     # kubernetes.io/ingress.class: nginx
     # cert-manager.io/cluster-issuer: letsencrypt-prod
   hosts:
-    - host: thand-agent.local
+    - host: "{{ .Values.hostname }}"
       paths:
         - path: /
           pathType: Prefix
   tls: []
   #  - secretName: thand-agent-tls
   #    hosts:
-  #      - thand-agent.local
+  #      - "{{ .Values.hostname }}"
 
 # HTTPRoute configuration (Gateway API)
 httpRoute:
@@ -104,7 +107,7 @@ httpRoute:
     - name: gateway
       sectionName: http
   hostnames:
-    - thand-agent.local
+    - "{{ .Values.hostname }}"
   rules:
     - matches:
       - path:
@@ -162,6 +165,8 @@ affinity: {}
 # Environment variables
 env:
   # Log level: debug, info, warn, error
+  - name: THAND_LOGIN_ENDPOINT
+    value: "{{ .Values.hostname }}"
   - name: THAND_LOG_LEVEL
     value: "info"
   # Server port
@@ -182,10 +187,37 @@ envFrom: []
 # - configMapRef:
 #     name: thand-config
 
+# Application secrets configuration
+# Used for storing sensitive data like API keys, tokens, etc.
+secrets:
+  # If true, creates a secret with the specified data
+  enabled: true
+  # Mount existing secret instead of creating one
+  existingSecret: ""
+  # Auto-generate secrets on deployment
+  generate:
+    # Enable automatic secret generation
+    enabled: true
+    # Length of generated secrets
+    length: 32
+    # List of secret keys to auto-generate if not provided in data
+    keys:
+      - "THAND_SECRET"
+  # Secret data - will be base64 encoded automatically
+  # If a key is listed in generate.keys and not provided here, it will be auto-generated
+  data: {}
+    # THAND_SECRET: "your-secret-value-here"  # If provided, this overrides auto-generation
+    # THAND_API_KEY: "your-api-key-here"  # For Thand Cloud access
+
 # Thand Agent Configuration
 config:
   # Main configuration for the agent
   # This will be mounted as config.yaml
+
+  login:
+    endpoint: "{{ .Values.hostname }}"
+    base: "/"
+
   server:
     port: 8080
     host: "0.0.0.0"
@@ -195,6 +227,9 @@ config:
     ready:
       enabled: true
       path: "/ready"
+    metrics:
+      enabled: true
+      path: "/metrics"
 
   logging:
     level: "info"