fix: use env vars and secret on container, config file is now generated on container launch

Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>

contrib/helm/charts/probo/templates/configmap.yaml

@@ -1,119 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "probo.fullname" . }}
-  labels:
-    {{- include "probo.labels" . | nindent 4 }}
-data:
-  config.yml: |
-    unit:
-      metrics:
-        addr: "0.0.0.0:{{ .Values.probo.metrics.port }}"
-      {{- if .Values.probo.tracing.enabled }}
-      tracing:
-        addr: {{ .Values.probo.tracing.addr | quote }}
-        max-batch-size: {{ .Values.probo.tracing.maxBatchSize }}
-        batch-timeout: {{ .Values.probo.tracing.batchTimeout }}
-        export-timeout: {{ .Values.probo.tracing.exportTimeout }}
-        max-queue-size: {{ .Values.probo.tracing.maxQueueSize }}
-      {{- end }}
-
-    probod:
-      base-url: {{ .Values.probo.base-url | quote }}
-      encryption-key: {{ .Values.probo.encryptionKey | quote }}
-      chrome-dp-addr: {{ include "probo.chrome.addr" . | quote }}
-
-      api:
-        addr: "0.0.0.0:{{ .Values.service.port }}"
-        cors:
-          allowed-origins:
-            {{- toYaml .Values.probo.cors.allowedOrigins | nindent 12 }}
-        {{- if .Values.probo.extraHeaderFields }}
-        extra-header-fields:
-          {{- toYaml .Values.probo.extraHeaderFields | nindent 10 }}
-        {{- end }}
-
-      pg:
-        addr: "{{ include "probo.postgresql.host" . }}:{{ include "probo.postgresql.port" . }}"
-        username: {{ include "probo.postgresql.username" . | quote }}
-        password: {{ include "probo.postgresql.password" . | quote }}
-        database: {{ include "probo.postgresql.database" . | quote }}
-        pool-size: {{ .Values.postgresql.poolSize }}
-        {{- if .Values.postgresql.caCertBundle }}
-        ca-cert-bundle: |
-          {{- .Values.postgresql.caCertBundle | nindent 10 }}
-        {{- end }}
-
-      auth:
-        disable-signup: {{ .Values.probo.auth.disableSignup }}
-        invitation-confirmation-token-validity: {{ .Values.probo.auth.invitationTokenValidity }}
-        cookie:
-          name: {{ .Values.probo.auth.cookieName | quote }}
-          domain: {{ .Values.probo.auth.cookieDomain | quote }}
-          secret: {{ .Values.probo.auth.cookieSecret | quote }}
-          duration: {{ .Values.probo.auth.cookieDuration }}
-        password:
-          pepper: {{ .Values.probo.auth.passwordPepper | quote }}
-          iterations: {{ .Values.probo.auth.passwordIterations }}
-
-      trust-auth:
-        cookie-name: {{ .Values.probo.trustAuth.cookieName | quote }}
-        cookie-domain: {{ .Values.probo.trustAuth.cookieDomain | quote }}
-        cookie-duration: {{ .Values.probo.trustAuth.cookieDuration }}
-        token-duration: {{ .Values.probo.trustAuth.tokenDuration }}
-        report-url-duration: {{ .Values.probo.trustAuth.reportUrlDuration }}
-        {{- if .Values.probo.trustAuth.ports }}
-        ports:
-          http-challenge: {{ .Values.probo.trustAuth.ports.httpChallenge }}
-          tls-http-server: {{ .Values.probo.trustAuth.ports.tlsHttpServer }}
-        {{- end }}
-        token-secret: {{ .Values.probo.trustAuth.tokenSecret | quote }}
-        scope: {{ .Values.probo.trustAuth.scope | quote }}
-        token-type: {{ .Values.probo.trustAuth.tokenType | quote }}
-
-      aws:
-        region: {{ .Values.s3.region | quote }}
-        bucket: {{ .Values.s3.bucket | quote }}
-        access-key-id: {{ .Values.s3.accessKey | quote }}
-        secret-access-key: {{ .Values.s3.secretKey | quote }}
-        {{- $s3Endpoint := include "probo.s3.endpoint" . }}
-        {{- if $s3Endpoint }}
-        endpoint: {{ $s3Endpoint | quote }}
-        {{- end }}
-
-      mailer:
-        sender-name: {{ .Values.probo.mailer.senderName | quote }}
-        sender-email: {{ .Values.probo.mailer.senderEmail | quote }}
-        smtp:
-          addr: {{ .Values.probo.mailer.smtp.addr | quote }}
-          {{- if .Values.probo.mailer.smtp.user }}
-          user: {{ .Values.probo.mailer.smtp.user | quote }}
-          {{- end }}
-          {{- if .Values.probo.mailer.smtp.password }}
-          password: {{ .Values.probo.mailer.smtp.password | quote }}
-          {{- end }}
-          tls-required: {{ .Values.probo.mailer.smtp.tlsRequired }}
-
-      {{- if .Values.probo.openai.apiKey }}
-      openai:
-        api-key-from-env: "OPENAI_API_KEY"
-        temperature: {{ .Values.probo.openai.temperature }}
-        model-name: {{ .Values.probo.openai.modelName | quote }}
-      {{- end }}
-
-      {{- if .Values.probo.customDomains.enabled }}
-      custom-domains:
-        renewal-interval: {{ .Values.probo.customDomains.renewalInterval }}
-        provision-interval: {{ .Values.probo.customDomains.provisionInterval }}
-        cname-target: {{ .Values.probo.customDomains.cnameTarget | quote }}
-        acme:
-          directory: {{ .Values.probo.customDomains.acme.directory | quote }}
-          email: {{ .Values.probo.customDomains.acme.email | quote }}
-          key-type: {{ .Values.probo.customDomains.acme.keyType | quote }}
-          insecure-tls: {{ .Values.probo.customDomains.acme.insecureTls }}
-      {{- end }}
-
-      {{- if .Values.probo.connectors }}
-      connectors:
-        {{- toYaml .Values.probo.connectors | nindent 8 }}
-      {{- end }}

contrib/helm/charts/probo/templates/deployment.yaml

@@ -14,7 +14,6 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
         checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
@@ -38,52 +37,122 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command: ["/bin/sh", "-c"] # replaces ENTRYPOINT
-          args: ["exec /usr/local/bin/probod -cfg-file /etc/probod/config.yml"]
-
-#          args:
-#            - "-cfg-file"
-#            - "/etc/probod/config.yml"
           env:
-            # Database credentials
+            # Observability - Metrics
-            - name: DB_PASSWORD
+            - name: METRICS_ADDR
-              valueFrom:
+              value: "0.0.0.0:{{ .Values.probo.metrics.port }}"
-                secretKeyRef:
+            {{- if .Values.probo.tracing.enabled }}
-                  name: {{ include "probo.fullname" . }}
+            # Observability - Tracing
-                  key: db-password
+            - name: TRACING_ADDR
-            # S3 credentials
+              value: {{ .Values.probo.tracing.addr | quote }}
-            - name: S3_ACCESS_KEY
+            - name: TRACING_MAX_BATCH_SIZE
-              valueFrom:
+              value: {{ .Values.probo.tracing.maxBatchSize | quote }}
-                secretKeyRef:
+            - name: TRACING_BATCH_TIMEOUT
-                  name: {{ include "probo.fullname" . }}
+              value: {{ .Values.probo.tracing.batchTimeout | quote }}
-                  key: s3-access-key
+            - name: TRACING_EXPORT_TIMEOUT
-            - name: S3_SECRET_KEY
+              value: {{ .Values.probo.tracing.exportTimeout | quote }}
-              valueFrom:
+            - name: TRACING_MAX_QUEUE_SIZE
-                secretKeyRef:
+              value: {{ .Values.probo.tracing.maxQueueSize | quote }}
-                  name: {{ include "probo.fullname" . }}
+            {{- end }}
-                  key: s3-secret-key
+            # Application Configuration
-            # Application secrets
+            - name: PROBOD_BASE_URL
-            - name: ENCRYPTION_KEY
+              value: {{ printf "https://%s" .Values.probo.hostname | quote }}
+            - name: PROBOD_ENCRYPTION_KEY
               valueFrom:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: encryption-key
-            - name: COOKIE_SECRET
+            - name: CHROME_DP_ADDR
+              value: {{ include "probo.chrome.addr" . | quote }}
+            # API Configuration
+            - name: API_ADDR
+              value: ":{{ .Values.service.port }}"
+            - name: API_CORS_ALLOWED_ORIGINS
+              value: {{ join "," .Values.probo.cors.allowedOrigins | quote }}
+            # PostgreSQL Database
+            - name: PG_ADDR
+              value: {{ printf "%s:%s" (include "probo.postgresql.host" .) (include "probo.postgresql.port" .) | quote }}
+            - name: PG_USERNAME
+              value: {{ include "probo.postgresql.username" . | quote }}
+            - name: PG_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: db-password
+            - name: PG_DATABASE
+              value: {{ include "probo.postgresql.database" . | quote }}
+            - name: PG_POOL_SIZE
+              value: {{ .Values.postgresql.poolSize | default "100" | quote }}
+            # Authentication
+            - name: AUTH_DISABLE_SIGNUP
+              value: {{ .Values.probo.auth.disableSignup | quote }}
+            - name: AUTH_INVITATION_TOKEN_VALIDITY
+              value: {{ .Values.probo.auth.invitationTokenValidity | quote }}
+            - name: AUTH_COOKIE_NAME
+              value: {{ .Values.probo.auth.cookieName | quote }}
+            - name: AUTH_COOKIE_DOMAIN
+              value: {{ .Values.probo.auth.cookieDomain | quote }}
+            - name: AUTH_COOKIE_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: cookie-secret
-            - name: PASSWORD_PEPPER
+            - name: AUTH_COOKIE_DURATION
+              value: {{ .Values.probo.auth.cookieDuration | quote }}
+            - name: AUTH_PASSWORD_PEPPER
               valueFrom:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: password-pepper
-            - name: TRUST_TOKEN_SECRET
+            - name: AUTH_PASSWORD_ITERATIONS
+              value: {{ .Values.probo.auth.passwordIterations | quote }}
+            # Trust Center Authentication
+            - name: TRUST_AUTH_COOKIE_NAME
+              value: {{ .Values.probo.trustAuth.cookieName | quote }}
+            - name: TRUST_AUTH_COOKIE_DOMAIN
+              value: {{ .Values.probo.trustAuth.cookieDomain | quote }}
+            - name: TRUST_AUTH_COOKIE_DURATION
+              value: {{ .Values.probo.trustAuth.cookieDuration | quote }}
+            - name: TRUST_AUTH_TOKEN_DURATION
+              value: {{ .Values.probo.trustAuth.tokenDuration | quote }}
+            - name: TRUST_AUTH_REPORT_URL_DURATION
+              value: {{ .Values.probo.trustAuth.reportUrlDuration | quote }}
+            - name: TRUST_AUTH_TOKEN_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: trust-token-secret
-            # Optional SMTP credentials
+            - name: TRUST_AUTH_SCOPE
+              value: {{ .Values.probo.trustAuth.scope | quote }}
+            - name: TRUST_AUTH_TOKEN_TYPE
+              value: {{ .Values.probo.trustAuth.tokenType | quote }}
+            # AWS / S3 Storage
+            - name: AWS_REGION
+              value: {{ .Values.s3.region | quote }}
+            - name: AWS_BUCKET
+              value: {{ .Values.s3.bucket | quote }}
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: s3-access-key
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: s3-secret-key
+            {{- $s3Endpoint := include "probo.s3.endpoint" . }}
+            {{- if $s3Endpoint }}
+            - name: AWS_ENDPOINT
+              value: {{ $s3Endpoint | quote }}
+            {{- end }}
+            # Email (SMTP)
+            - name: MAILER_SENDER_NAME
+              value: {{ .Values.probo.mailer.senderName | quote }}
+            - name: MAILER_SENDER_EMAIL
+              value: {{ .Values.probo.mailer.senderEmail | quote }}
+            - name: SMTP_ADDR
+              value: {{ .Values.probo.mailer.smtp.addr | quote }}
             {{- if .Values.probo.mailer.smtp.user }}
             - name: SMTP_USER
               valueFrom:
@@ -98,13 +167,68 @@ spec:
                   name: {{ include "probo.fullname" . }}
                   key: smtp-password
             {{- end }}
-            # Optional OpenAI API key
+            - name: SMTP_TLS_REQUIRED
+              value: {{ .Values.probo.mailer.smtp.tlsRequired | quote }}
+            # OpenAI Integration
             {{- if .Values.probo.openai.apiKey }}
             - name: OPENAI_API_KEY
               valueFrom:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: openai-api-key
+            - name: OPENAI_TEMPERATURE
+              value: {{ .Values.probo.openai.temperature | quote }}
+            - name: OPENAI_MODEL_NAME
+              value: {{ .Values.probo.openai.modelName | quote }}
+            {{- end }}
+            # Custom Domains
+            {{- if .Values.probo.customDomains.enabled }}
+            - name: CUSTOM_DOMAINS_RENEWAL_INTERVAL
+              value: {{ .Values.probo.customDomains.renewalInterval | quote }}
+            - name: CUSTOM_DOMAINS_PROVISION_INTERVAL
+              value: {{ .Values.probo.customDomains.provisionInterval | quote }}
+            - name: CUSTOM_DOMAINS_CNAME_TARGET
+              value: {{ .Values.probo.customDomains.cnameTarget | quote }}
+            - name: ACME_DIRECTORY
+              value: {{ .Values.probo.customDomains.acme.directory | quote }}
+            - name: ACME_EMAIL
+              value: {{ .Values.probo.customDomains.acme.email | quote }}
+            - name: ACME_KEY_TYPE
+              value: {{ .Values.probo.customDomains.acme.keyType | quote }}
+            {{- end }}
+            # Connectors (Slack OAuth2)
+            {{- range .Values.probo.connectors }}
+            {{- if eq .name "slack" }}
+            - name: CONNECTOR_SLACK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" $ }}
+                  key: connector-slack-client-id
+            - name: CONNECTOR_SLACK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" $ }}
+                  key: connector-slack-client-secret
+            {{- if .config.redirectUri }}
+            - name: CONNECTOR_SLACK_REDIRECT_URI
+              value: {{ .config.redirectUri | quote }}
+            {{- end }}
+            {{- if .config.authUrl }}
+            - name: CONNECTOR_SLACK_AUTH_URL
+              value: {{ .config.authUrl | quote }}
+            {{- end }}
+            {{- if .config.tokenUrl }}
+            - name: CONNECTOR_SLACK_TOKEN_URL
+              value: {{ .config.tokenUrl | quote }}
+            {{- end }}
+            {{- if .config.signingSecret }}
+            - name: CONNECTOR_SLACK_SIGNING_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" $ }}
+                  key: connector-slack-signing-secret
+            {{- end }}
+            {{- end }}
             {{- end }}
           ports:
             - name: http
@@ -126,18 +250,12 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
-            - name: config
-              mountPath: /etc/probod
-              readOnly: false
             - name: data
               mountPath: /data
           {{- with .Values.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
       volumes:
-        - name: config
-          configMap:
-            name: {{ include "probo.fullname" . }}
         - name: data
         {{- if .Values.persistence.enabled }}
           persistentVolumeClaim:

contrib/helm/charts/probo/templates/secret.yaml

@@ -31,3 +31,18 @@ stringData:
   {{- if .Values.probo.openai.apiKey }}
   openai-api-key: {{ .Values.probo.openai.apiKey | quote }}
   {{- end }}
+
+  # Optional Connector secrets
+  {{- range .Values.probo.connectors }}
+  {{- if eq .name "slack" }}
+  {{- if .config.clientId }}
+  connector-slack-client-id: {{ .config.clientId | quote }}
+  {{- end }}
+  {{- if .config.clientSecret }}
+  connector-slack-client-secret: {{ .config.clientSecret | quote }}
+  {{- end }}
+  {{- if .config.signingSecret }}
+  connector-slack-signing-secret: {{ .config.signingSecret | quote }}
+  {{- end }}
+  {{- end }}
+  {{- end }}