[WORKBENCH] Reading license from secret not working properly

[TheisFerre]

I am trying to read the license from a secret object created in Kubernetes. However, i am not able to succesfully do so (my rstudio container does not start)

The following config for the license is being used:

license:
  # -- key is the license to use
  key: "" 
  # -- server is the <hostname>:<port> for a license server
  server: false
  # -- the file section is used for licensing with a license file
  file:
    # -- contents is an in-line license file
    contents: false
    # -- mountPath is the place the license file will be mounted into the container
    mountPath: "/etc/rstudio-licensing"
    # -- mountSubPath is whether to mount the subPath for the file secret.
    # -- It can be preferable _not_ to enable this, because then updates propagate automatically
    mountSubPath: false
    # -- secretKey is the key for the secret to use for the license file
    secretKey: "license"
    # -- secret is an existing secret with a license file in it
    secret: "rsw-license-key"

I have ensured that my secret exists and contains the license as i expect by running k get secret rsw-license-key --template {{.data.license}} | base64 -d.

I see the following when reading the logs:

+ /usr/lib/rstudio-server/bin/license-manager activate-file /etc/rstudio-licensing/license
{"result":40,"action":"reading license file","message":"The file specified does not appear to be an RStudio license file."}
+ deactivate
== Exiting ==
+ echo '== Exiting =='
+ rstudio-server stop
Deactivating license ...
+ echo 'Deactivating license ...'
+ is_deactivated=0

If i put in the license directly in my helm chart under the license.key value, i can succesfully deploy Workbench.

Can you please help me solve this - maybe by an example of how i read the license from a secret.

[colearendt]

Hey @TheisFerre ! Unfortunately, I think this is a shortcoming of the existing chart. If you are using a standard license key, then you do not want to use the license.file values.

Instead, you probably want to do something like the following to set the env var yourself:

pod:
  env:
    - name: RSW_LICENSE
      valueFrom:
        secretKeyRef:
          name: my-secret
          key: secret-key

We can keep this issue open until we add a feature to make this easier in the chart though 😄

[MariaSemple]

Thanks for filing this issue! We think it would make sense to support a secret under license: key in our helm charts.

[Azahorscak]

+1 We use the ESO in all our clusters and would love to see first class support for passing in a k8s secret object for all sensitive values in the workbench chart, not just the license key.

[Azahorscak]

It looks like my specific issue is handled here https://docs.posit.co/ide/server-pro/admin/access_and_security/cookies.html
But it's not simple to find, especially when initially deploying with helm.