8000 Unified secret is not storing non-secret database strings if database.secrets is defined · Issue #1999 · jfrog/charts · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Unified secret is not storing non-secret database strings if database.secrets is defined #1999

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
gangefors opened this issue May 22, 2025 · 0 comments
Open

Unified secret is not storing non-secret database strings if database.secrets is defined #1999

gangefors opened this issue May 22, 2025 · 0 comments

Comments

@gangefors
Copy link
gangefors commented May 22, 2025 •
edited
Loading

Current behavior

If any artifactory.database.secrets.<key> is defined nothing is written to the unified secret. This means that all keys (url, user, password) needs to be specified if you want to store any key in a custom secret.

charts/stable/artifactory/templates/artifactory-unified-secret.yaml

Lines 50 to 64 in ec8e134

{{- if and (not .Values.database.secrets) (not .Values.postgresql.enabled) }}
{{- if or .Values.database.url .Values.database.user .Values.database.password }}
{{- with .Values.database.url }}
db-url: {{ tpl . $ | b64enc | quote }}
{{- end }}
{{- with .Values.database.user }}
db-user: {{ tpl . $ | b64enc | quote }}
{{- end }}
{{- with .Values.database.password }}
db-password: {{ tpl . $ | b64enc | quote }}
{{- end }}
{{- end }}
{{- end }}

Expected behavior

Unified secret should store all values that are not specified within the database.secrets map. I.e. if only database.secrets.password is defined, db-url and db-user should be written to the unified secret.

Naive solution for creating the unified secret:

  {{- if not .Values.postgresql.enabled }}
  {{- if or .Values.database.url .Values.database.user .Values.database.password }}

  {{- if not .Values.database.secrets.url }}
  {{- with .Values.database.url }}
  db-url: {{ tpl . $ | b64enc | quote }}
  {{- end }}
  {{- end }}

  {{- if not .Values.database.secrets.user }}
  {{- with .Values.database.user }}
  db-user: {{ tpl . $ | b64enc | quote }}
  {{- end }}
  {{- end }}

  {{- if not .Values.database.secrets.password }}
  {{- with .Values.database.password }}
  db-password: {{ tpl . $ | b64enc | quote }}
  {{- end }}
  {{- end }}

  {{- end }}
  {{- end }}

Then all code places where these values are used should pick from either the unified secret or the custom secret specified in database.secrets..name. Most code already have this behavior.

charts/stable/insight/templates/insight-statefulset.yaml

Lines 428 to 478 in 59355c8

{{- if or .Values.database.secrets.user .Values.database.user }}
- name: JF_SHARED_DATABASE_USERNAME
valueFrom:
secretKeyRef:
{{- if .Values.database.secrets.user }}
name: {{ tpl .Values.database.secrets.user.name .}}
key: {{ tpl .Values.database.secrets.user.key .}}
{{- else if .Values.database.user }}
{{- if not .Values.insightServer.unifiedSecretInstallation }}
name: {{ template "insight.fullname" . }}-database-creds
{{- else }}
name: "{{ template "insight.name" . }}-unified-secret"
{{- end }}
key: db-user
{{- end }}
{{- end }}
{{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }}
- name: JF_SHARED_DATABASE_PASSWORD
valueFrom:
secretKeyRef:
{{- if .Values.database.secrets.password }}
name: {{ tpl .Values.database.secrets.password.name . }}
key: {{ tpl .Values.database.secrets.password.key . }}
{{- else if .Values.database.password }}
{{- if not .Values.insightServer.unifiedSecretInstallation }}
name: {{ template "insight.fullname" . }}-database-creds
{{- else }}
name: "{{ template "insight.name" . }}-unified-secret"
{{- end }}
key: db-password
{{- else if .Values.postgresql.enabled }}
name: {{ .Release.Name }}-postgresql
key: postgresql-password
{{- end }}
{{- end }}
{{- if or .Values.database.secrets.url .Values.database.url }}
- name: JF_SHARED_DATABASE_URL
valueFrom:
secretKeyRef:
{{- if .Values.database.secrets.url }}
name: {{ tpl .Values.database.secrets.url.name .}}
key: {{ tpl .Values.database.secrets.url.key .}}
{{- else if .Values.database.url }}
{{- if not .Values.insightServer.unifiedSecretInstallation }}
name: {{ template "insight.fullname" . }}-database-creds
{{- else }}
name: "{{ template "insight.name" . }}-unified-secret"
{{- end }}
key: db-url
{{- end }}
{{- end }}

@gangefors gangefors changed the title Bug: Unified secret is not storing non-secret database strings if database.secrets is defined Unified secret is not storing non-secret database strings if database.secrets is defined May 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@gangefors
0