chore: secret management and external secret reference support

charts/exivity/templates/_init_config.tpl

@@ -0,0 +1,88 @@
+{{- define "exivity.initConfigContainer" -}}
+{{- $appname := .appname -}}
+{{- $path := .path -}}
+{{- $queue := .queue -}}
+- name: generate-config
+  image: linuxserver/yq:latest
+  command: ["/bin/sh"]
+  args: ["/scripts/generate-config.sh"]
+  env:
+    {{- if $appname }}
+    - name: APPNAME
+      value: "{{ $appname }}"
+    - name: PATH_VAR
+      value: "{{ $path }}"
+    - name: QUEUE
+      value: "{{ $queue }}"
+    {{- end }}
+  volumeMounts:
+    - name: config-generated
+      mountPath: /exivity/home/system
+    - name: config-generator-script
+      mountPath: /scripts
+      readOnly: true
+    - name: postgres-config
+      mountPath: /config/postgres
+      readOnly: true
+    - name: postgres-secret
+      mountPath: /secrets/postgres
+      readOnly: true
+    - name: rabbitmq-config
+      mountPath: /config/rabbitmq
+      readOnly: true
+    - name: rabbitmq-secret
+      mountPath: /secrets/rabbitmq
+      readOnly: true
+{{- end }}
+
+{{- define "exivity.configGeneratedVolume" -}}
+- name: config-generated
+  emptyDir: {}
+- name: config-generator-script
+  configMap:
+    name: {{ printf "%s-config-generator" (include "exivity.fullname" .) }}
+    defaultMode: 0755
+- name: postgres-config
+  configMap:
+    name: {{ printf "%s-postgres-config" (include "exivity.fullname" .) }}
+- name: postgres-secret
+  secret:
+    secretName: {{ printf "%s-postgres-secret" (include "exivity.fullname" .) }}
+- name: rabbitmq-config
+  configMap:
+    name: {{ printf "%s-rabbitmq-config" (include "exivity.fullname" .) }}
+- name: rabbitmq-secret
+  secret:
+    secretName: {{ printf "%s-rabbitmq-secret" (include "exivity.fullname" .) }}
+{{- end }}
+
+{{- define "exivity.configGeneratedVolumeMount" -}}
+- name: config-generated
+  mountPath: /exivity/home/system/config.json
+  subPath: config.json
+{{- end }}
+
+{{- define "exivity.initPigeonConfigContainer" -}}
+- name: generate-config
+  image: linuxserver/yq:latest
+  command: ["/bin/sh"]
+  args: ["/scripts/generate-pigeon-config.sh"]
+  volumeMounts:
+    - name: config-generated
+      mountPath: /exivity/home/system
+    - name: config-generator-script
+      mountPath: /scripts
+      readOnly: true
+    - name: postgres-config
+      mountPath: /config/postgres
+      readOnly: true
+    - name: postgres-secret
+      mountPath: /secrets/postgres
+      readOnly: true
+    - name: rabbitmq-config
+      mountPath: /config/rabbitmq
+      readOnly: true
+    - name: rabbitmq-secret
+      mountPath: /secrets/rabbitmq
+      readOnly: true
+{{- end }}

charts/exivity/templates/_secret.tpl

@@ -0,0 +1,45 @@
+{{/* Check if a value is a secret reference. */}}
+
+{{- define "exivity.isSecretRef" -}}
+{{- if kindIs "map" . -}}
+  {{- if and .secretName .key -}}
+true
+  {{- end -}}
+{{- end -}}
+{{- end -}}
+
+------------------------------------------
+
+{{/* If the value is a secretRef, returns the referenced secret name. */}}
+
+{{- define "exivity.secretRefName" -}}
+{{- $value := .value -}}
+{{- $defaultName := .defaultName -}}
+{{- if kindIs "map" $value -}}
+  {{- if and $value.secretName $value.key -}}
+    {{- $value.secretName -}}
+  {{- else -}}
+    {{- $defaultName -}}
+  {{- end -}}
+{{- else -}}
+  {{- $defaultName -}}
+{{- end -}}
+{{- end -}}
+
+------------------------------------------
+
+{{/* If the value is a secretRef, returns the key. */}}
+
+{{- define "exivity.secretRefKey" -}}
+{{- $value := .value -}}
+{{- $defaultKey := .defaultKey -}}
+{{- if kindIs "map" $value -}}
+  {{- if and $value.secretName $value.key -}}
+    {{- $value.key -}}
+  {{- else -}}
+    {{- $defaultKey -}}
+  {{- end -}}
+{{- else -}}
+  {{- $defaultKey -}}
+{{- end -}}
+{{- end -}}

charts/exivity/templates/chronos/deployment.yaml

@@ -16,23 +16,21 @@ spec:
       labels:
         app.kubernetes.io/component: chronos
         {{- include "exivity.labels" $ | indent 8 }}
-      annotations:
-        checksum/{{- include "exivity.fullname" $ -}}-config-shared: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
       securityContext:
         {{- include "exivity.securityContext" (dict "root" . "component" "chronos") | indent 8 }}
       volumes:
-        - name: config-file
-          configMap:
-            name: {{ include "exivity.fullname" $ -}}-config-shared
+        {{- include "exivity.configGeneratedVolume" . | nindent 8 }}
         - name: config
           persistentVolumeClaim:
             claimName: {{ include "exivity.fullname" $ -}}-chronos-config
         - name: log
           persistentVolumeClaim:
             claimName: {{ include "exivity.fullname" $ -}}-chronos-log
         {{- include "exivity.permissionScriptVolume" . | nindent 8 }}
-      {{- include "exivity.initPermissions" (dict "root" . "component" "chronos" "volumes" (list "config" "log")) | nindent 6 }}
+      initContainers:
+        {{- include "exivity.initConfigContainer" (dict "root" . "appname" "" "path" "" "queue" "") | nindent 8 }}
+        {{- include "exivity.initPermissionsContainer" (dict "root" . "component" "chronos" "volumes" (list "config" "log")) | nindent 8 }}
       containers:
         - name:            chronos
           image: {{ include "exivity.image" (set $ "name" "chronos") }}
@@ -47,8 +45,7 @@ spec:
           volumeMounts:
             - name:      config
               mountPath: /exivity/home/system/config
-            - name:      config-file
-              mountPath: /exivity/home/system
+            {{- include "exivity.configGeneratedVolumeMount" . | nindent 12 }}
             - name:      log
               mountPath: /exivity/home/log/chronos
           {{- include "exivity.probes" $ | indent 10}}