Skip to content

Commit f0f043a

Browse files
ecdobryecdobry
authored
feat: improve helm chart postgresql secret handling (#404)
2 parents e9b3c15 + a657830 commit f0f043a

File tree

7 files changed

+96
-8
lines changed

7 files changed

+96
-8
lines changed

‎charts/diode/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: diode
33
description: A Helm chart for Diode
44
type: application
5-
version: 1.8.0
5+
version: 1.9.0
66
appVersion: "1.5.0"
77
home: https://github.com/netboxlabs/diode
88
sources:

‎charts/diode/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
A Helm chart for Diode
44

5-
![Version: 1.8.0](https://img.shields.io/badge/Version-1.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
5+
![Version: 1.9.0](https://img.shields.io/badge/Version-1.9.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
66

77
## Prerequisites
88

@@ -304,8 +304,13 @@ helm show values diode/diode
304304
| diodeReconciler.replicaCount | int | `1` | replica count |
305305
| diodeReconciler.resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` | resources |
306306
| diodeReconciler.serviceAccount.create | bool | `true` | create service account |
307+
| externalPostgresql.database | string | `"diode"` | database name |
308+
| externalPostgresql.existingSecretKey | string | `"postgresql-password"` | key of password in existing postgresql secret |
309+
| externalPostgresql.existingSecretName | string | `""` | existing postgresql secret |
307310
| externalPostgresql.hostname | string | `"localhost"` | hostname |
311+
| externalPostgresql.password | string | `""` | password |
308312
| externalPostgresql.port | int | `5432` | port |
313+
| externalPostgresql.username | string | `"diode"` | username |
309314
| externalRedis.hostname | string | `"localhost"` | hostname |
310315
| externalRedis.port | int | `6379` | port |
311316
| global.commonAnnotations | object | `{}` | common annotations for all resources |

‎charts/diode/templates/_helpers.tpl‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,58 @@ Create the port of the Redis database
291291
{{- end }}
292292
{{- end }}
293293

294+
{{/*
295+
Create the database name for PostgreSQL
296+
*/}}
297+
{{- define "diode.postgresql.database" -}}
298+
{{- if .Values.postgresql.enabled -}}
299+
{{- printf "diode" }}
300+
{{- else if and .Values.externalPostgresql (hasKey .Values.externalPostgresql "database") -}}
301+
{{- .Values.externalPostgresql.database }}
302+
{{- else -}}
303+
{{- fail "externalPostgresql.database must be defined when postgresql.enabled is false" }}
304+
{{- end }}
305+
{{- end }}
306+
307+
{{/*
308+
Create the username for PostgreSQL
309+
*/}}
310+
{{- define "diode.postgresql.username" -}}
311+
{{- if .Values.postgresql.enabled -}}
312+
{{- printf "diode" }}
313+
{{- else if and .Values.externalPostgresql (hasKey .Values.externalPostgresql "username") -}}
314+
{{- .Values.externalPostgresql.username }}
315+
{{- else -}}
316+
{{- fail "externalPostgresql.username must be defined when postgresql.enabled is false" }}
317+
{{- end }}
318+
{{- end }}
319+
320+
{{/*
321+
Create the secret name for PostgreSQL credentials
322+
*/}}
323+
{{- define "diode.postgresql.secretname" -}}
324+
{{- if .Values.postgresql.enabled -}}
325+
{{- printf "diode-postgresql-secret" }}
326+
{{- else if and .Values.externalPostgresql (hasKey .Values.externalPostgresql "existingSecretName") (not (empty .Values.externalPostgresql.existingSecretName)) -}}
327+
{{- .Values.externalPostgresql.existingSecretName }}
328+
{{- else -}}
329+
{{- printf "diode-external-postgresql-secret" }}
330+
{{- end }}
331+
{{- end }}
332+
333+
{{/*
334+
Create the secret key for PostgreSQL password
335+
*/}}
336+
{{- define "diode.postgresql.secretkey" -}}
337+
{{- if .Values.postgresql.enabled -}}
338+
{{- printf "postgres-password" }}
339+
{{- else if and .Values.externalPostgresql (hasKey .Values.externalPostgresql "existingSecretKey") (not (empty .Values.externalPostgresql.existingSecretKey)) -}}
340+
{{- .Values.externalPostgresql.existingSecretKey }}
341+
{{- else -}}
342+
{{- printf "postgresql-password" }}
343+
{{- end }}
344+
{{- end }}
345+
294346
{{/*
295347
Create the hostname of the public Hydra service
296348
*/}}

‎charts/diode/templates/diode-reconciler-configmap.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ data:
2727
DIODE_TO_NETBOX_RATE_LIMITER_BURST: {{ $config.diodeToNetboxRateLimiterBurst | default "1" | quote }}
2828
POSTGRES_HOST: {{ include "diode.postgresql.hostname" . | quote }}
2929
POSTGRES_PORT: {{ include "diode.postgresql.port" . | quote }}
30-
POSTGRES_DB_NAME: {{ $config.postgresDbName | default "diode" | quote }}
31-
POSTGRES_USER: {{ $config.postgresUser | default "diode" | quote }}
30+
POSTGRES_DB_NAME: {{ include "diode.postgresql.database" . | quote }}
31+
POSTGRES_USER: {{ include "diode.postgresql.username" . | quote }}
3232
NETBOX_DIODE_PLUGIN_API_BASE_URL: {{ $config.netboxDiodePluginApiBaseUrl | quote }}
3333
NETBOX_DIODE_PLUGIN_SKIP_TLS_VERIFY: {{ $config.netboxDiodePluginSkipTlsVerify | quote }}
3434
DIODE_AUTH_TOKEN_URL: {{ printf "%s/token" (include "diode.auth.url" .) | quote }}

‎charts/diode/templates/diode-reconciler-deployment.yaml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,15 @@ spec:
8484
resources:
8585
{{- toYaml .| nindent 12 }}
8686
{{- end }}
87-
{{- if .Values.diodeReconciler.extraEnvs }}
88-
env: {{- include "common.tplvalues.render" (dict "value" .Values.diodeReconciler.extraEnvs "context" $) | nindent 12 }}
89-
{{- end }}
87+
env:
88+
- name: POSTGRES_PASSWORD
89+
valueFrom:
90+
secretKeyRef:
91+
name: {{ include "diode.postgresql.secretname" . }}
92+
key: {{ include "diode.postgresql.secretkey" . }}
93+
{{- if .Values.diodeReconciler.extraEnvs }}
94+
{{- include "common.tplvalues.render" (dict "value" .Values.diodeReconciler.extraEnvs "context" $) | nindent 12 }}
95+
{{- end }}
9096
envFrom:
9197
- configMapRef:
9298
name: {{ include "diode.reconciler.configmap" . }}

‎charts/diode/templates/diode-secrets.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if and (not .Values.postgresql.enabled) (not .Values.externalPostgresql.existingSecretName) (not (empty .Values.externalPostgresql.password)) }}
2+
---
3+
apiVersion: v1
4+
kind: Secret
5+
metadata:
6+
name: {{ include "diode.postgresql.secretname" . }}
7+
namespace: {{ include "diode.namespace" . }}
8+
labels:
9+
{{- include "diode.labels" . | nindent 4 }}
10+
{{- if .Values.global.commonAnnotations }}
11+
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.global.commonAnnotations "context" $ ) | nindent 4 }}
12+
{{- end }}
13+
type: Opaque
14+
data:
15+
{{ include "diode.postgresql.secretkey" . }}: {{ .Values.externalPostgresql.password | b64enc | quote }}
16+
{{- end }}

‎charts/diode/values.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ global:
2424
# -- common labels for all resources
2525
commonLabels: {}
2626

27-
2827
diode:
2928
# -- environment name
3029
environment: development
@@ -35,6 +34,16 @@ externalPostgresql:
3534
hostname: localhost
3635
# -- port
3736
port: 5432
37+
# -- database name
38+
database: diode
39+
# -- username
40+
username: diode
41+
# -- password
42+
password: ""
43+
# -- existing postgresql secret
44+
existingSecretName: ""
45+
# -- key of password in existing postgresql secret
46+
existingSecretKey: postgresql-password
3847

3948
# External Redis configuration (optional)
4049
externalRedis:

0 commit comments

Comments
 (0)