From 10dd7478991c0f8a26c9723918f7b8effb6b2a09 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:09:14 +0100 Subject: [PATCH 01/32] fix(chart): truncated secrets-operator resource name --- helm-charts/secrets-operator/templates/metrics-service.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml index ebf7ce549..99178b8c3 100644 --- a/helm-charts/secrets-operator/templates/metrics-service.yaml +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service + name: {{ include "secrets-operator.fullname" . | trunc 28 }}-controller-manager-metrics-service labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: k8-operator From 00feee6903b2911e32e3f58c5055427835884e5c Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:11:43 +0100 Subject: [PATCH 02/32] fix(chart): shorten names with variables + improved secrets support --- .../templates/backend-deployment.yaml | 39 ++++++++++-------- .../templates/frontend-deployment.yaml | 40 +++++++++++++------ .../templates/deployment.yaml | 11 ++--- 3 files changed, 56 insertions(+), 34 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index f93f3c87e..187f1240a 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -1,3 +1,4 @@ +{{- $backend := .Values.backend }} apiVersion: apps/v1 kind: Deployment metadata: @@ -9,7 +10,7 @@ metadata: labels: {{- include "infisical.backend.labels" . | nindent 4 }} spec: - replicas: {{ .Values.backend.replicaCount }} + replicas: {{ $backend.replicaCount }} selector: matchLabels: {{- include "infisical.backend.matchLabels" . | nindent 6 }} @@ -17,15 +18,15 @@ spec: metadata: labels: {{- include "infisical.backend.matchLabels" . | nindent 8 }} - {{- with .Values.backend.podAnnotations }} + {{- with $backend.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} spec: containers: - - name: {{ template "infisical.name" . }}-{{ .Values.backend.name }} - image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.backend.image.pullPolicy }} + - name: {{ template "infisical.name" . }}-{{ $backend.name }} + image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ $backend.image.pullPolicy }} readinessProbe: httpGet: path: /api/status @@ -34,32 +35,24 @@ spec: periodSeconds: 10 ports: - containerPort: 4000 - {{- if .Values.backend.kubeSecretRef }} + {{- if $backend.kubeSecretRef }} envFrom: - secretRef: - name: {{ .Values.backend.kubeSecretRef }} + name: {{ $backend.kubeSecretRef }} {{- end }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} - {{- if .Values.backendEnvironmentVariables }} - {{- range $key, $value := .Values.backendEnvironmentVariables }} - {{- if $value | quote | eq "MUST_REPLACE" }} - {{ fail "Environment variables are not set. Please set all environment variables to continue." }} - {{ end }} - - name: {{ $key }} - value: {{ quote $value }} - {{- end }} - {{- end }} --- + apiVersion: v1 kind: Service metadata: name: {{ include "infisical.backend.fullname" . }} labels: {{- include "infisical.backend.labels" . | nindent 4 }} - {{- with .Values.backend.service.annotations }} + {{- with $backend.service.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} @@ -74,3 +67,15 @@ spec: {{- if eq .Values.backend.service.type "NodePort" }} nodePort: {{ .Values.backend.service.nodePort }} {{- end }} + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: {{ $backend.kubeSecretRef | default "infisical-backend" }} +type: Opaque +data: + {{- range $key, $value := $backend.secrets }} + {{ $key }}: {{ $value | b64enc }} + {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index d396e5628..68f0a6315 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -1,3 +1,4 @@ +{{- $frontend := .Values.frontend }} apiVersion: apps/v1 kind: Deployment metadata: @@ -9,7 +10,7 @@ metadata: labels: {{- include "infisical.frontend.labels" . | nindent 4 }} spec: - replicas: {{ .Values.frontend.replicaCount }} + replicas: {{ $frontend.replicaCount }} selector: matchLabels: {{- include "infisical.frontend.matchLabels" . | nindent 6 }} @@ -17,26 +18,27 @@ spec: metadata: labels: {{- include "infisical.frontend.matchLabels" . | nindent 8 }} - {{- with .Values.frontend.podAnnotations }} + {{- with $frontend.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} spec: containers: - - name: {{ template "infisical.name" . }}-{{ .Values.frontend.name }} - image: "{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.frontend.image.pullPolicy }} + - name: {{ template "infisical.name" . }}-{{ $frontend.name }} + image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ $frontend.image.pullPolicy }} readinessProbe: httpGet: path: / port: 3000 initialDelaySeconds: 10 periodSeconds: 10 - {{- if .Values.frontend.kubeSecretRef }} + {{- if $frontend.kubeSecretRef }} envFrom: - secretRef: - name: {{ .Values.frontend.kubeSecretRef }} + name: {{ $frontend.kubeSecretRef }} {{- end }} + # Below variables should be defined available through the above secretRef secret {{- if .Values.frontendEnvironmentVariables }} env: {{- range $key, $value := .Values.frontendEnvironmentVariables }} @@ -49,25 +51,39 @@ spec: {{- end }} ports: - containerPort: 3000 + --- + apiVersion: v1 kind: Service metadata: name: {{ include "infisical.frontend.fullname" . }} labels: {{- include "infisical.frontend.labels" . | nindent 4 }} - {{- with .Values.frontend.service.annotations }} + {{- with $frontend.service.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - type: {{ .Values.frontend.service.type }} + type: {{ $frontend.service.type }} selector: {{- include "infisical.frontend.matchLabels" . | nindent 8 }} ports: - protocol: TCP port: 3000 # service targetPort: 3000 # container port - {{- if eq .Values.frontend.service.type "NodePort" }} - nodePort: {{ .Values.frontend.service.nodePort }} - {{- end }} \ No newline at end of file + {{- if eq $frontend.service.type "NodePort" }} + nodePort: {{ $frontend.service.nodePort }} + {{- end }} + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} +type: Opaque +data: + {{- range $key, $value := $frontend.secrets }} + {{ $key }}: {{ $value | b64enc }} + {{- end }} \ No newline at end of file diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml index 026728bfa..0b40cb05e 100644 --- a/helm-charts/secrets-operator/templates/deployment.yaml +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -1,3 +1,4 @@ +{{- $ctrlManager := .Values.controllerManager }} apiVersion: v1 kind: ServiceAccount metadata: @@ -19,7 +20,7 @@ metadata: control-plane: controller-manager {{- include "secrets-operator.labels" . | nindent 4 }} spec: - replicas: {{ .Values.controllerManager.replicas }} + replicas: {{ $ctrlManager.replicas }} selector: matchLabels: control-plane: controller-manager @@ -57,14 +58,14 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag + image: {{ $ctrlManager.kubeRbacProxy.image.repository }}:{{ $ctrlManager.kubeRbacProxy.image.tag | default .Chart.AppVersion }} name: kube-rbac-proxy ports: - containerPort: 8443 name: https protocol: TCP - resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent + resources: {{- toYaml $ctrlManager.kubeRbacProxy.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false @@ -80,7 +81,7 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag + image: {{ $ctrlManager.manager.image.repository }}:{{ $ctrlManager.manager.image.tag | default .Chart.AppVersion }} livenessProbe: httpGet: @@ -95,7 +96,7 @@ spec: port: 8081 initialDelaySeconds: 5 periodSeconds: 10 - resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 + resources: {{- toYaml $ctrlManager.manager.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false From 9db69430b57ad3c087a8abe9d5737a1d70047e84 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:12:51 +0100 Subject: [PATCH 03/32] fix(chart): ingress shorten names with variables + ingressClassName --- helm-charts/infisical/templates/ingress.yaml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index cf9952ea3..bde3d36d2 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -1,16 +1,18 @@ {{ if .Values.ingress.enabled }} +{{- $ingress := .Values.ingress }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: infisical-ingress - {{- with .Values.ingress.annotations }} + {{- with $ingress.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: -{{- if .Values.ingress.tls }} + ingressClassName: {{ $ingress.ingressClassName | default "nginx"}} +{{- if $ingress.tls }} tls: - {{- range .Values.ingress.tls }} + {{- range $ingress.tls }} - hosts: {{- range .hosts }} - {{ . | quote }} @@ -19,18 +21,18 @@ spec: {{- end }} {{- end }} rules: - - host: {{ .Values.ingress.hostName}} + - host: {{ $ingress.hostName}} http: paths: - - path: {{ .Values.ingress.frontend.path }} - pathType: {{ .Values.ingress.frontend.pathType }} + - path: {{ $ingress.frontend.path }} + pathType: {{ $ingress.frontend.pathType }} backend: service: name: {{ include "infisical.frontend.fullname" . }} port: number: 3000 - - path: {{ .Values.ingress.backend.path }} - pathType: {{ .Values.ingress.backend.pathType }} + - path: {{ $ingress.backend.path }} + pathType: {{ $ingress.backend.pathType }} backend: service: name: {{ include "infisical.backend.fullname" . }} From e2df6e94a58e5324b9c1c7906dfae8d772f596bb Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 28 Jan 2023 17:18:39 +0100 Subject: [PATCH 04/32] chore(chart): breaking change version bump + docs --- helm-charts/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/README.md b/helm-charts/README.md index 1bb587a2a..858f458bb 100644 --- a/helm-charts/README.md +++ b/helm-charts/README.md @@ -36,4 +36,4 @@ Steps to update the documentation : 1. `npm install ./readme-generator-for-helm` 1. `npm exec readme-generator -- --readme README.md --values values.yaml` - It'll insert the table below the `## Parameters` title - - It'll output errors if some of the path aren't documented \ No newline at end of file + - It'll output errors if some of the path aren't documented From a031e84ab8ed76f41430b062793088f8aeb6d7ec Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sun, 29 Jan 2023 20:13:39 +0100 Subject: [PATCH 05/32] fix(chart): uses envFrom only to inject secrets and conf --- .../infisical/templates/frontend-deployment.yaml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 68f0a6315..3c2fd4a6e 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -38,17 +38,6 @@ spec: - secretRef: name: {{ $frontend.kubeSecretRef }} {{- end }} - # Below variables should be defined available through the above secretRef secret - {{- if .Values.frontendEnvironmentVariables }} - env: - {{- range $key, $value := .Values.frontendEnvironmentVariables }} - {{- if $value | quote | eq "MUST_REPLACE" }} - {{ fail "Environment variables are not set. Please set all environment variables to continue." }} - {{ end }} - - name: {{ $key }} - value: {{ quote $value }} - {{- end }} - {{- end }} ports: - containerPort: 3000 From 2cc8e59ca863614a21a8f20fe629d83cc0752e2b Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 02:02:59 +0100 Subject: [PATCH 06/32] fix(chart): kubeSecretRef disables and overwrites default secrets --- helm-charts/infisical/templates/backend-deployment.yaml | 6 +++--- helm-charts/infisical/templates/frontend-deployment.yaml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 187f1240a..582a84788 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -35,11 +35,9 @@ spec: periodSeconds: 10 ports: - containerPort: 4000 - {{- if $backend.kubeSecretRef }} envFrom: - secretRef: - name: {{ $backend.kubeSecretRef }} - {{- end }} + name: {{ $backend.kubeSecretRef | default "infisical-backend" }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} @@ -70,6 +68,7 @@ spec: --- +{{ if not $backend.kubeSecretRef }} apiVersion: v1 kind: Secret metadata: @@ -79,3 +78,4 @@ data: {{- range $key, $value := $backend.secrets }} {{ $key }}: {{ $value | b64enc }} {{- end }} +{{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 3c2fd4a6e..3a5985132 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -33,11 +33,9 @@ spec: port: 3000 initialDelaySeconds: 10 periodSeconds: 10 - {{- if $frontend.kubeSecretRef }} envFrom: - secretRef: - name: {{ $frontend.kubeSecretRef }} - {{- end }} + name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} ports: - containerPort: 3000 @@ -67,6 +65,7 @@ spec: --- +{{ if not $frontend.kubeSecretRef }} apiVersion: v1 kind: Secret metadata: @@ -75,4 +74,5 @@ type: Opaque data: {{- range $key, $value := $frontend.secrets }} {{ $key }}: {{ $value | b64enc }} - {{- end }} \ No newline at end of file + {{- end }} +{{- end }} \ No newline at end of file From aa5d76108178b466913084ed2cd41ebf2dcd1300 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 02:10:28 +0100 Subject: [PATCH 07/32] fix(chart): image tags default to latest --- helm-charts/infisical/templates/backend-deployment.yaml | 2 +- helm-charts/infisical/templates/frontend-deployment.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 582a84788..09047dd58 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: {{ template "infisical.name" . }}-{{ $backend.name }} - image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default .Chart.AppVersion }}" + image: "{{ $backend.image.repository }}:{{ $backend.image.tag | default "latest" }}" imagePullPolicy: {{ $backend.image.pullPolicy }} readinessProbe: httpGet: diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 3a5985132..762bd1852 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: {{ template "infisical.name" . }}-{{ $frontend.name }} - image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default .Chart.AppVersion }}" + image: "{{ $frontend.image.repository }}:{{ $frontend.image.tag | default "latest" }}" imagePullPolicy: {{ $frontend.image.pullPolicy }} readinessProbe: httpGet: From a6b9400a4a5618dec9d4226e73c8f1682a0ae227 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 31 Jan 2023 12:39:59 +0100 Subject: [PATCH 08/32] fix(chart): wrap secret values into quotes automatically --- helm-charts/infisical/templates/backend-deployment.yaml | 2 +- helm-charts/infisical/templates/frontend-deployment.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 09047dd58..362713904 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -76,6 +76,6 @@ metadata: type: Opaque data: {{- range $key, $value := $backend.secrets }} - {{ $key }}: {{ $value | b64enc }} + {{ $key }}: {{ $value | quote | b64enc }} {{- end }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 762bd1852..2086b340f 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -73,6 +73,6 @@ metadata: type: Opaque data: {{- range $key, $value := $frontend.secrets }} - {{ $key }}: {{ $value | b64enc }} + {{ $key }}: {{ $value | quote | b64enc }} {{- end }} {{- end }} \ No newline at end of file From c034b62b718591285be66cdb4f1bc96a28bb498a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Wed, 1 Feb 2023 01:37:08 +0100 Subject: [PATCH 09/32] fix(chart): default secret name to the service fullname --- helm-charts/infisical/templates/backend-deployment.yaml | 4 ++-- helm-charts/infisical/templates/frontend-deployment.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 362713904..3378d8f5b 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -37,7 +37,7 @@ spec: - containerPort: 4000 envFrom: - secretRef: - name: {{ $backend.kubeSecretRef | default "infisical-backend" }} + name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} env: - name: MONGO_URL value: {{ include "infisical.mongodb.connectionString" . | quote }} @@ -72,7 +72,7 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $backend.kubeSecretRef | default "infisical-backend" }} + name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} type: Opaque data: {{- range $key, $value := $backend.secrets }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 2086b340f..4d6401539 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -35,7 +35,7 @@ spec: periodSeconds: 10 envFrom: - secretRef: - name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} + name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} ports: - containerPort: 3000 @@ -69,7 +69,7 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $frontend.kubeSecretRef | default "infisical-frontend" }} + name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} type: Opaque data: {{- range $key, $value := $frontend.secrets }} From b7a1689aeb800d0d3b036c34d9051d4a0815f81a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 19:49:17 +0100 Subject: [PATCH 10/32] feat(chart): env variables auto-generation --- .../templates/backend-deployment.yaml | 35 ++++++++++------ .../templates/frontend-deployment.yaml | 16 ++++++-- helm-charts/infisical/values.yaml | 40 ++++++++++++------- 3 files changed, 60 insertions(+), 31 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 3378d8f5b..fca05b2a3 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -3,7 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "infisical.backend.fullname" . }} - {{- with .Values.backend.deploymentAnnotations }} + {{- with $backend.deploymentAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} @@ -15,7 +15,7 @@ spec: matchLabels: {{- include "infisical.backend.matchLabels" . | nindent 6 }} template: - metadata: + metadata: labels: {{- include "infisical.backend.matchLabels" . | nindent 8 }} {{- with $backend.podAnnotations }} @@ -38,9 +38,6 @@ spec: envFrom: - secretRef: name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} - env: - - name: MONGO_URL - value: {{ include "infisical.mongodb.connectionString" . | quote }} --- @@ -55,15 +52,15 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - type: {{ .Values.backend.service.type }} + type: {{ $backend.service.type }} selector: {{- include "infisical.backend.matchLabels" . | nindent 8 }} ports: - protocol: TCP port: 4000 targetPort: 4000 # container port - {{- if eq .Values.backend.service.type "NodePort" }} - nodePort: {{ .Values.backend.service.nodePort }} + {{- if eq $backend.service.type "NodePort" }} + nodePort: {{ $backend.service.nodePort }} {{- end }} --- @@ -72,10 +69,24 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $backend.kubeSecretRef | default (include "infisical.backend.fullname" .) }} + name: {{ include "infisical.backend.fullname" . }} + annotations: + "helm.sh/resource-policy": "keep" type: Opaque data: - {{- range $key, $value := $backend.secrets }} - {{ $key }}: {{ $value | quote | b64enc }} - {{- end }} + {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower) + "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) + "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) + "JWT_AUTH_SECRET" (randAlphaNum 32 | lower) + "JWT_SERVICE_SECRET" (randAlphaNum 32 | lower) + "JWT_MFA_SECRET" (randAlphaNum 32 | lower) }} + {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.backend.fullname" .)) | default dict }} + {{- $secretData := (get $secretObj "data") | default dict }} + {{ range $key, $value := .Values.backendEnvironmentVariables }} + {{- $default := get $requiredVars $key -}} + {{- $current := get $secretData $key | b64dec -}} + {{- $v := $value | default ($current | default $default) -}} + {{ $key }}: {{ $v | quote | b64enc }} + {{ end -}} + MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote | b64enc }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 4d6401539..e6f0a70b6 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -69,10 +69,18 @@ spec: apiVersion: v1 kind: Secret metadata: - name: {{ $frontend.kubeSecretRef | default (include "infisical.frontend.fullname" .) }} + name: {{ include "infisical.frontend.fullname" . }} + annotations: + "helm.sh/resource-policy": "keep" type: Opaque data: - {{- range $key, $value := $frontend.secrets }} - {{ $key }}: {{ $value | quote | b64enc }} - {{- end }} + {{- $requiredVars := dict }} + {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.frontend.fullname" .)) | default dict }} + {{- $secretData := (get $secretObj "data") | default dict }} + {{ range $key, $value := .Values.frontendEnvironmentVariables }} + {{- $default := get $requiredVars $key -}} + {{- $current := get $secretData $key | b64dec -}} + {{- $v := $value | default ($current | default $default) -}} + {{ $key }}: {{ $v | quote | b64enc }} + {{ end -}} {{- end }} \ No newline at end of file diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index d569e7c31..8253aba21 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -46,6 +46,8 @@ frontend: ## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## kubeSecretRef: "" + ## Frontend service + ## service: ## @param frontend.service.annotations Backend service annotations ## @@ -103,6 +105,8 @@ backend: ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) ## kubeSecretRef: "" + ## Backend service + ## service: ## @param backend.service.annotations Backend service annotations ## @@ -118,20 +122,22 @@ backend: ## Documentation : https://infisical.com/docs/self-hosting/configuration/envars ## backendEnvironmentVariables: - ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## - ENCRYPTION_KEY: MUST_REPLACE - ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) - ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ENCRYPTION_KEY: "" + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## - JWT_SIGNUP_SECRET: MUST_REPLACE - JWT_REFRESH_SECRET: MUST_REPLACE - JWT_AUTH_SECRET: MUST_REPLACE - JWT_SERVICE_SECRET: MUST_REPLACE + JWT_SIGNUP_SECRET: "" + JWT_REFRESH_SECRET: "" + JWT_AUTH_SECRET: "" + JWT_SERVICE_SECRET: "" + JWT_MFA_SECRET: "" ## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections ## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported @@ -140,13 +146,13 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. team@infisical.com) ## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host ## - SMTP_HOST: MUST_REPLACE + SMTP_HOST: "" SMTP_PORT: 587 SMTP_SECURE: false SMTP_FROM_NAME: Infisical - SMTP_FROM_ADDRESS: MUST_REPLACE - SMTP_USERNAME: MUST_REPLACE - SMTP_PASSWORD: MUST_REPLACE + SMTP_FROM_ADDRESS: "" + SMTP_USERNAME: "" + SMTP_PASSWORD: "" ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## SITE_URL: infisical.local @@ -209,8 +215,12 @@ mongodb: ## databases: - "infisical" - rootPassword: root + ## @param mongodb.auth.rootPassword Database root user name + ## rootUser: root + ## @param mongodb.auth.rootPassword Database root user password + ## + rootPassword: root ## MongoDB persistence configuration ## persistence: From 28369411f7d80ea2d6b734f8d031ccd54e56ad09 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 20:16:37 +0100 Subject: [PATCH 11/32] fix(chart): update chart dependencies --- helm-charts/infisical/Chart.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/helm-charts/infisical/Chart.lock b/helm-charts/infisical/Chart.lock index 3b5f48ca4..6bfcb167c 100644 --- a/helm-charts/infisical/Chart.lock +++ b/helm-charts/infisical/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami - version: 13.6.7 + version: 13.6.8 - name: mailhog repository: https://codecentric.github.io/helm-charts version: 5.2.3 -digest: sha256:a54ae9ee60775f6f1aa916b59aee55b3ed5234b6bd88185fcb118b7f69539d70 -generated: "2023-02-13T14:13:27.525541038+01:00" +digest: sha256:e2cf9cf448786af6d9b98725f4714c2bdd056446cb50533e499b9ccfe7da1d31 +generated: "2023-03-13T20:05:05.754788071+01:00" From da888e27add48384dbc30cc7d05d29ff131f5079 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 13 Mar 2023 20:18:21 +0100 Subject: [PATCH 12/32] fix(chart): ingressClassName cross-version compatibility --- helm-charts/infisical/templates/ingress.yaml | 9 ++++++++- helm-charts/infisical/values.yaml | 14 ++++++++------ 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index bde3d36d2..9b181fe64 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -1,5 +1,10 @@ {{ if .Values.ingress.enabled }} {{- $ingress := .Values.ingress }} +{{- if and $ingress.ingressClassName (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey $ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set $ingress.annotations "kubernetes.io/ingress.class" $ingress.ingressClassName}} + {{- end }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -9,7 +14,9 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - ingressClassName: {{ $ingress.ingressClassName | default "nginx"}} + {{- if and $ingress.ingressClassName (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ $ingress.ingressClassName | default "nginx" }} + {{- end }} {{- if $ingress.tls }} tls: {{- range $ingress.tls }} diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 8253aba21..9ee624e7b 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -256,10 +256,13 @@ ingress: ## @param ingress.enabled Enable ingress ## enabled: true - annotations: - ## @skip ingress.annotations.kubernetes.io/ingress.class - ## - kubernetes.io/ingress.class: "nginx" + ## @param mailhog.ingress.ingressClassName Ingress class name + ## + ingressClassName: nginx + ## @param mailhog.ingress.annotations Ingress annotations + ## + annotations: {} + # kubernetes.io/ingress.class: "nginx" # cert-manager.io/issuer: letsencrypt-nginx ## @param ingress.hostName Ingress hostname (your custom domain name) ## Replace with your own domain @@ -351,8 +354,7 @@ mailhog: ingressClassName: nginx ## @param mailhog.ingress.annotations Ingress annotations ## - annotations: - {} + annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" ## @param mailhog.ingress.labels Ingress labels From 744caf8c79586d4604336c47564a25902681a662 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Tue, 14 Mar 2023 01:43:43 +0100 Subject: [PATCH 13/32] chore(script): remove auto-generated variables from setup script --- helm-charts/infisical/examples/kind.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/examples/kind.sh b/helm-charts/infisical/examples/kind.sh index 62280cbb3..c81e1b5e2 100755 --- a/helm-charts/infisical/examples/kind.sh +++ b/helm-charts/infisical/examples/kind.sh @@ -58,18 +58,17 @@ cat < Date: Tue, 14 Mar 2023 01:45:00 +0100 Subject: [PATCH 14/32] fix(chart): secret data to stringData for cross-type compatibility --- helm-charts/infisical/templates/backend-deployment.yaml | 6 +++--- helm-charts/infisical/templates/frontend-deployment.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index fca05b2a3..9f3ae2d91 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -73,7 +73,7 @@ metadata: annotations: "helm.sh/resource-policy": "keep" type: Opaque -data: +stringData: {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower) "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) @@ -86,7 +86,7 @@ data: {{- $default := get $requiredVars $key -}} {{- $current := get $secretData $key | b64dec -}} {{- $v := $value | default ($current | default $default) -}} - {{ $key }}: {{ $v | quote | b64enc }} + {{ $key }}: {{ $v | quote }} {{ end -}} - MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote | b64enc }} + MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote }} {{- end }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index e6f0a70b6..114cfc112 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -73,7 +73,7 @@ metadata: annotations: "helm.sh/resource-policy": "keep" type: Opaque -data: +stringData: {{- $requiredVars := dict }} {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.frontend.fullname" .)) | default dict }} {{- $secretData := (get $secretObj "data") | default dict }} @@ -81,6 +81,6 @@ data: {{- $default := get $requiredVars $key -}} {{- $current := get $secretData $key | b64dec -}} {{- $v := $value | default ($current | default $default) -}} - {{ $key }}: {{ $v | quote | b64enc }} + {{ $key }}: {{ $v | quote }} {{ end -}} {{- end }} \ No newline at end of file From b2663fb3e040df91173c6837c09524457e2a9667 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:29:58 +0100 Subject: [PATCH 15/32] chore(pr): pull request template comments --- .github/pull_request_template.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 45816f5cd..fd27d42c1 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,6 +1,6 @@ # Description đŸ“Ŗ -*Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.* + ## Type ✨ @@ -11,7 +11,7 @@ # Tests 🛠ī¸ -*Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. You may want to add screenshots when relevant and possible* + ```sh # Here's some code block to paste some code snippets From e37f584d75f2adda1a32a8ae6a0101be3c36e63e Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:30:55 +0100 Subject: [PATCH 16/32] fix(chart): upgrade deps and bump the verison --- helm-charts/infisical/Chart.lock | 6 +++--- helm-charts/infisical/Chart.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical/Chart.lock b/helm-charts/infisical/Chart.lock index 6bfcb167c..5170df21b 100644 --- a/helm-charts/infisical/Chart.lock +++ b/helm-charts/infisical/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami - version: 13.6.8 + version: 13.9.1 - name: mailhog repository: https://codecentric.github.io/helm-charts version: 5.2.3 -digest: sha256:e2cf9cf448786af6d9b98725f4714c2bdd056446cb50533e499b9ccfe7da1d31 -generated: "2023-03-13T20:05:05.754788071+01:00" +digest: sha256:1ddb3ffef899859222b72547657f57ea303e768d67886a4a57edcb0f773ea83f +generated: "2023-03-14T12:58:34.387144895+01:00" diff --git a/helm-charts/infisical/Chart.yaml b/helm-charts/infisical/Chart.yaml index 80fe48fcc..55cc51b9b 100644 --- a/helm-charts/infisical/Chart.yaml +++ b/helm-charts/infisical/Chart.yaml @@ -7,7 +7,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.15 +version: 0.1.16 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -17,7 +17,7 @@ appVersion: "1.17.0" dependencies: - name: mongodb - version: "~13.6.7" + version: "~13.9.1" repository: "https://charts.bitnami.com/bitnami" condition: mongodb.enabled - name: mailhog From 767943368ea35494c1d9c4675ac50c104661921a Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:32:54 +0100 Subject: [PATCH 17/32] fix(conf): mongodb probes + docs --- helm-charts/infisical/values.yaml | 50 +++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 9ee624e7b..db91aa26b 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -122,15 +122,15 @@ backend: ## Documentation : https://infisical.com/docs/self-hosting/configuration/envars ## backendEnvironmentVariables: - ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## ENCRYPTION_KEY: "" - ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) - ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)). auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) + ## @param backendEnvironmentVariables.JWT_MFA_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' ## JWT_SIGNUP_SECRET: "" @@ -193,6 +193,38 @@ mongodb: repository: bitnami/mongodb pullPolicy: IfNotPresent tag: "6.0.4-debian-11-r0" + ## Bitnami MongoDB(®) pods' liveness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param mongodb.livenessProbe.enabled Enable livenessProbe + ## @param mongodb.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param mongodb.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param mongodb.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param mongodb.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param mongodb.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 20 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 + ## Bitnami MongoDB(®) pods' readiness probe. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param mongodb.readinessProbe.enabled Enable readinessProbe + ## @param mongodb.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param mongodb.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param mongodb.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param mongodb.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param mongodb.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 ## @param mongodb.service.annotations Service annotations ## service: @@ -215,7 +247,7 @@ mongodb: ## databases: - "infisical" - ## @param mongodb.auth.rootPassword Database root user name + ## @param mongodb.auth.rootUser Database root user name ## rootUser: root ## @param mongodb.auth.rootPassword Database root user password @@ -256,10 +288,10 @@ ingress: ## @param ingress.enabled Enable ingress ## enabled: true - ## @param mailhog.ingress.ingressClassName Ingress class name + ## @param ingress.ingressClassName Ingress class name ## ingressClassName: nginx - ## @param mailhog.ingress.annotations Ingress annotations + ## @param ingress.annotations Ingress annotations ## annotations: {} # kubernetes.io/ingress.class: "nginx" From 164da9d8e009f21667b4d5b57c9e537ecceec240 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:34:40 +0100 Subject: [PATCH 18/32] chore(doc): updated helm parameters doc + 0.1.16 upgrade instructions --- helm-charts/infisical/README.md | 190 ++++++++++++++++------ helm-charts/infisical/templates/NOTES.txt | 8 +- 2 files changed, 146 insertions(+), 52 deletions(-) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 4e20bbc86..d45b89f22 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -6,7 +6,7 @@ This is the Infisical application Helm chart. This chart includes the following | ---------- | ----------------------------------- | | `frontend` | Infisical's Web UI | | `backend` | Infisical's API | -| `mongodb` | Infisical's local database | +| `mongodb` | Infisical's database | | `mailhog` | Infisical's development SMTP server | ## Installation @@ -36,6 +36,17 @@ helm upgrade --install --atomic \ infisical infisical/infisical ``` +### Backup + +If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# export secrets to a given file (requires jq) +kubectl get secrets -n \ + -o json | jq '.data | map_values(@base64d)' > \ + .bak +``` + ## Parameters ### Common parameters @@ -68,34 +79,35 @@ helm upgrade --install --atomic \ ### Infisical backend parameters -| Name | Description | Value | -| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | -| `backend.enabled` | Enable backend | `true` | -| `backend.name` | Backend name | `backend` | -| `backend.fullnameOverride` | Backend fullnameOverride | `""` | -| `backend.podAnnotations` | Backend pod annotations | `{}` | -| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | -| `backend.replicaCount` | Backend replica count | `2` | -| `backend.image.repository` | Backend image repository | `infisical/backend` | -| `backend.image.tag` | Backend image tag | `latest` | -| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | -| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | -| `backend.service.annotations` | Backend service annotations | `{}` | -| `backend.service.type` | Backend service type | `ClusterIP` | -| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | -| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | -| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | -| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | -| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` | -| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | +| Name | Description | Value | +| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | +| `backend.enabled` | Enable backend | `true` | +| `backend.name` | Backend name | `backend` | +| `backend.fullnameOverride` | Backend fullnameOverride | `""` | +| `backend.podAnnotations` | Backend pod annotations | `{}` | +| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | +| `backend.replicaCount` | Backend replica count | `2` | +| `backend.image.repository` | Backend image repository | `infisical/backend` | +| `backend.image.tag` | Backend image tag | `latest` | +| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | +| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | +| `backend.service.annotations` | Backend service annotations | `{}` | +| `backend.service.type` | Backend service type | `ClusterIP` | +| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | +| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_MFA_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `""` | +| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | +| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | +| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | +| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | +| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | ### MongoDB(®) parameters @@ -112,11 +124,25 @@ helm upgrade --install --atomic \ | `mongodb.image.repository` | MongoDB(®) image registry | `bitnami/mongodb` | | `mongodb.image.tag` | MongoDB(®) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` | | `mongodb.image.pullPolicy` | MongoDB(®) image pull policy | `IfNotPresent` | +| `mongodb.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `mongodb.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `mongodb.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | +| `mongodb.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `10` | +| `mongodb.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `mongodb.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `mongodb.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `mongodb.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `mongodb.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `mongodb.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | | `mongodb.service.annotations` | Service annotations | `{}` | | `mongodb.auth.enabled` | Enable custom authentication | `true` | | `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.auth.rootUser` | Database root user name | `root` | +| `mongodb.auth.rootPassword` | Database root user password | `root` | | `mongodb.persistence.enabled` | Enable database persistence | `true` | | `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` | | `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` | @@ -127,11 +153,13 @@ helm upgrade --install --atomic \ ### Ingress parameters -| Name | Description | Value | -| ------------------ | ------------------------------------------- | ----------------- | -| `ingress.enabled` | Enable ingress | `true` | -| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | -| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | +| Name | Description | Value | +| -------------------------- | ------------------------------------------- | ----------------- | +| `ingress.enabled` | Enable ingress | `true` | +| `ingress.ingressClassName` | Ingress class name | `nginx` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | +| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | ### Mailhog parameters @@ -152,7 +180,7 @@ helm upgrade --install --atomic \ | `mailhog.ingress.labels` | Ingress labels | `{}` | | `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` | -Learn more in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes) + ## Persistence @@ -185,32 +213,37 @@ Below example will deploy the following : - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) - [**mailhog.infisical.local**](https://mailhog.infisical.local) - - Local SMTP server used to receive the signup verification code + - Local SMTP server used to receive the emails (e.g. signup verification code) - You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) Use below values to setup a local development environment, adapt those variables as you need +#### TL;DR + +If you're running a k8s cluster with `ingress-nginx`, you can run one of the below scripts : + +```sh +# With 'kind' + 'helm', to create a local cluster and deploy the chart +./examples.local-kind.sh + +# With 'helm' only, if you already have a cluster to deploy the chart +./examples.local-helm.sh +``` + +#### Instructions + +Here's the step-by-step instructions to setup your local development environment. First create the below file : + ```yaml # values.dev.yaml -# Enable all services for local development -frontend: - enabled: true -backend: - enabled: true -mongodb: - enabled: true +# Enable mailhog for local development mailhog: enabled: true # Configure backend development variables (required) backendEnvironmentVariables: - ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218 - JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f - JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff - JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200 - JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a SITE_URL: https://infisical.local SMTP_FROM_ADDRESS: dev@infisical.local SMTP_FROM_NAME: Local Infisical @@ -240,6 +273,63 @@ helm upgrade --install --atomic \ ## Upgrading -### 1.15.0 +Find the chart upgrade instructions below. When upgrading from your version to one of the listed below, please follow every instructions in between. -Refactoring in progress, instructions are coming soon \ No newline at end of file +Here's a snippet to upgrade your installation manually : + +```sh +# replace below '' with your own values +helm upgrade --install --atomic \ + -n "" --create-namespace \ + -f "" \ + . +``` + +### 0.1.16 + +- Auto-generation for the following variables, to ease your future upgrades or setups : + - `ENCRYPTION_KEY` + - `JWT_SIGNUP_SECRET` + - `JWT_REFRESH_SECRET` + - `JWT_AUTH_SECRET` + - `JWT_SERVICE_SECRET` + - `JWT_MFA_SECRET` + +We've migrated the applications' environment variables into `secrets` resources, shared within the deployments through `envFrom`. If you upgrade your installation make sure to backup your deployments' environment variables (e.g. encryption key and jwt secrets). + +The preference order is : +- **user-defined** (values file or inline) + - **existing-secret** (for existing installations, you don't have to specify the secrets when upgrading if they already exist) + - **auto-generated** (if none of the values above have been found, we'll auto-generate a value for the user, only for the above mentioned variables) + +#### Instructions + +1. Make sure **you have all the required environment variables** defined in the value file (or inline `--set`) you'll provide to `helm` + 1. e.g. All the above mentioned variables +1. **Backup your existing secrets** (safety precaution) + 1. with below [snippets](#snippets) +1. **Upgrade the chart**, with the [instructions](#upgrading) + 1. It'll create a secret per service, and store the secrets/conf within (auto-generate if you don't provide the required ones) + 1. It'll link the secret to the deployment through `envFrom` + 1. It'll automatically remove the hard-coded `env.*` variables from your infisical deployments +1. Make sure that the **created secrets match the ones in your backups** + 1. e.g. `kubectl get secret -n -backend --template={{.data.ENCRYPTION_KEY}} | base64 -d` +1. You're all set! + +#### Snippets + +Here's some snippets to backup your current secrets **before the upgrade** (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# replace the below variables with yours (namespace + app) +namespace=infisical; app=infisical; components="frontend backend" + +for component in $components; do + dpl=$(kubectl get deployment -n $namespace -l app=$app -l component=$component \ + -o jsonpath="{.items[0].metadata.name}") + + kubectl get deployments -n $namespace $dpl \ + -o jsonpath='{.spec.template.spec.containers[0].env[*]}' | \ + jq -r '.name + ":" + .value' > infisical-$component-conf.bak +done +``` \ No newline at end of file diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 027ecde67..142fa202d 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -68,13 +68,17 @@ │ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} │ │ → Get MongoDB root password -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d │ │ → Get MongoDB users passwords -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d │ +│ → Export your backend secrets (requires jq) +│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \ +│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak +│ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ ## \ No newline at end of file From fc41be9db894f882383311e14a9c11279eb027b4 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Thu, 16 Mar 2023 01:35:43 +0100 Subject: [PATCH 19/32] chore(script): add local installation example scripts --- helm-charts/infisical/.gitignore | 3 +- helm-charts/infisical/examples/local-helm.sh | 35 +++++++++++++++++++ .../examples/{kind.sh => local-kind.sh} | 10 ------ 3 files changed, 37 insertions(+), 11 deletions(-) create mode 100755 helm-charts/infisical/examples/local-helm.sh rename helm-charts/infisical/examples/{kind.sh => local-kind.sh} (92%) diff --git a/helm-charts/infisical/.gitignore b/helm-charts/infisical/.gitignore index a2968aad7..c9fe0caa7 100644 --- a/helm-charts/infisical/.gitignore +++ b/helm-charts/infisical/.gitignore @@ -1,3 +1,4 @@ charts/ node_modules/ -package*.json \ No newline at end of file +package*.json +*.bak \ No newline at end of file diff --git a/helm-charts/infisical/examples/local-helm.sh b/helm-charts/infisical/examples/local-helm.sh new file mode 100755 index 000000000..047535da1 --- /dev/null +++ b/helm-charts/infisical/examples/local-helm.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash + +## Infisical local k8s development environment setup script +## using 'helm' and assume you already have a cluster and an ingress (nginx) +## + +## +## DEVELOPMENT USE ONLY +## DO NOT USE IN PRODUCTION +## + +# define variables +cluster_name=infisical +host=infisical.local + +# install infisical (local development) +helm dep update +cat < Date: Thu, 16 Mar 2023 01:49:53 +0100 Subject: [PATCH 20/32] fix(chart): NOTES.txt typos --- helm-charts/infisical/templates/NOTES.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 142fa202d..737a878d6 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -76,8 +76,8 @@ │ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d │ │ → Export your backend secrets (requires jq) -│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \ -│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak +│ $ kubectl get secrets/ -n {{ .Release.Namespace }} \ +│ -o json | jq '.data | map_values(@base64d)' > .bak │ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ From 95bb9e2586b10a516c136f312f70ca53be9c4cf1 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Fri, 17 Mar 2023 09:39:57 +0100 Subject: [PATCH 21/32] fix(chart): add INVITE_ONLY_SIGNUP variable --- helm-charts/infisical/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index db91aa26b..80638dd67 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -156,6 +156,9 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## SITE_URL: infisical.local + ## @param backendEnvironmentVariables.INVITE_ONLY_SIGNUP To disable account creation from the login page + ## + INVITE_ONLY_SIGNUP: false ## @section MongoDB(®) parameters ## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml From ba240f9e29a965b612b70583addd0353d91ee6c2 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Fri, 17 Mar 2023 09:41:49 +0100 Subject: [PATCH 22/32] chore(doc): add INVITE_ONLY_SIGNUP description --- helm-charts/infisical/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index d45b89f22..21bf34c42 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -108,6 +108,7 @@ kubectl get secrets -n \ | `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | | `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | | `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | +| `backendEnvironmentVariables.INVITE_ONLY_SIGNUP` | To disable account creation from the login page | `false` | ### MongoDB(®) parameters From 93d07c34aba3753d9e964088df02b3972c3df502 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sun, 19 Mar 2023 12:07:39 +0100 Subject: [PATCH 23/32] chore(doc): restore link to the web doc --- helm-charts/infisical/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 21bf34c42..06496bc7d 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -36,6 +36,8 @@ helm upgrade --install --atomic \ infisical infisical/infisical ``` +Details and parameters available in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes) and below + ### Backup If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : From fef1adb34f49acc925cddf46a22ba12c7cb4ce7e Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sun, 19 Mar 2023 10:29:26 -0700 Subject: [PATCH 24/32] expand backup explanation --- helm-charts/infisical/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 06496bc7d..9079e3e36 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -36,11 +36,11 @@ helm upgrade --install --atomic \ infisical infisical/infisical ``` -Details and parameters available in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes) and below +### Backup up encryption keys -### Backup - -If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : +If you did not explicitly set required environment variables, this helm chart will auto-generated them by default. It's recommended to save these credentials somewhere safe. Run the following command in your cluster where Infisical chart is installed. + +This command requires [`jq`](https://stedolan.github.io/jq/download/) ```sh # export secrets to a given file (requires jq) From 9cf921bb1c2da023efdb6677f8e0c6f03c6d8674 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 20 Mar 2023 20:38:36 +0100 Subject: [PATCH 25/32] fix(conf): add MONGO_URL to backend variables --- .../infisical/templates/backend-deployment.yaml | 11 ++++++----- helm-charts/infisical/values.yaml | 11 +++++++++-- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 9f3ae2d91..b6d63372f 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -75,11 +75,12 @@ metadata: type: Opaque stringData: {{- $requiredVars := dict "ENCRYPTION_KEY" (randAlphaNum 32 | lower) - "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) - "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) - "JWT_AUTH_SECRET" (randAlphaNum 32 | lower) - "JWT_SERVICE_SECRET" (randAlphaNum 32 | lower) - "JWT_MFA_SECRET" (randAlphaNum 32 | lower) }} + "JWT_SIGNUP_SECRET" (randAlphaNum 32 | lower) + "JWT_REFRESH_SECRET" (randAlphaNum 32 | lower) + "JWT_AUTH_SECRET" (randAlphaNum 32 | lower) + "JWT_SERVICE_SECRET" (randAlphaNum 32 | lower) + "JWT_MFA_SECRET" (randAlphaNum 32 | lower) + "MONGO_URL" (include "infisical.mongodb.connectionString" .) }} {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (include "infisical.backend.fullname" .)) | default dict }} {{- $secretData := (get $secretObj "data") | default dict }} {{ range $key, $value := .Values.backendEnvironmentVariables }} diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 80638dd67..4f540ff6d 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -156,9 +156,16 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) ## SITE_URL: infisical.local - ## @param backendEnvironmentVariables.INVITE_ONLY_SIGNUP To disable account creation from the login page + ## @param backendEnvironmentVariables.INVITE_ONLY_SIGNUP To disable account creation from the login page (invites only) ## INVITE_ONLY_SIGNUP: false + ## @param backendEnvironmentVariables.MONGO_URL MongoDB connection string + ## By default the backend will automatically be connected to a Mongo instance within the cluster + ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) + ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ + ## e.g. "mongodb://:@:/" + ## + MONGO_URL: "" ## @section MongoDB(®) parameters ## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml @@ -275,7 +282,7 @@ mongodb: ## size: 8Gi -## @param mongodbConnection.externalMongoDBConnectionString External MongoDB connection string +## @param mongodbConnection.externalMongoDBConnectionString Deprecated :warning: External MongoDB connection string
Use backendEnvironmentVariables.MONGO_URL instead ## By default the backend will be connected to a Mongo instance within the cluster ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ From a90375ea3d1d9026710c517b07b837ae809faad0 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Wed, 22 Mar 2023 00:15:43 +0100 Subject: [PATCH 26/32] revert: secret-operator changes --- helm-charts/secrets-operator/templates/deployment.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml index 0b40cb05e..2cc7ff7b7 100644 --- a/helm-charts/secrets-operator/templates/deployment.yaml +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -20,7 +20,7 @@ metadata: control-plane: controller-manager {{- include "secrets-operator.labels" . | nindent 4 }} spec: - replicas: {{ $ctrlManager.replicas }} + replicas: {{ .Values.controllerManager.replicas }} selector: matchLabels: control-plane: controller-manager @@ -58,14 +58,14 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ $ctrlManager.kubeRbacProxy.image.repository }}:{{ $ctrlManager.kubeRbacProxy.image.tag + image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag | default .Chart.AppVersion }} name: kube-rbac-proxy ports: - containerPort: 8443 name: https protocol: TCP - resources: {{- toYaml $ctrlManager.kubeRbacProxy.resources | nindent + resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false @@ -81,7 +81,7 @@ spec: env: - name: KUBERNETES_CLUSTER_DOMAIN value: {{ .Values.kubernetesClusterDomain }} - image: {{ $ctrlManager.manager.image.repository }}:{{ $ctrlManager.manager.image.tag + image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }} livenessProbe: httpGet: @@ -96,7 +96,7 @@ spec: port: 8081 initialDelaySeconds: 5 periodSeconds: 10 - resources: {{- toYaml $ctrlManager.manager.resources | nindent 10 + resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 }} securityContext: allowPrivilegeEscalation: false From 0008ff9a98a1157c03fd6b8f4978dbc96da81951 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Wed, 22 Mar 2023 00:27:27 +0100 Subject: [PATCH 27/32] chore(chart): improved NOTES.txt commands format/layout --- helm-charts/infisical/templates/NOTES.txt | 54 +++++++++++------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 737a878d6..45eac8ad5 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -53,32 +53,32 @@ │ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ -╭―― Here's a list of helpfull commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤ -│ -│ → Get all the Infisical resources (excluding secrets/pvcs) -│ $ kubectl get all -n {{ .Release.Namespace }} -│ -│ → Get your release status -│ $ helm status {{ .Release.Namespace }} {{ .Release.Name }} -│ -│ → Get your release resources -│ $ helm get all {{ .Release.Namespace }} {{ .Release.Name }} -│ -│ → Uninstall your release -│ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} -│ -│ → Get MongoDB root password -│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb -│ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d -│ -│ → Get MongoDB users passwords -│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb -│ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d -│ -│ → Export your backend secrets (requires jq) -│ $ kubectl get secrets/ -n {{ .Release.Namespace }} \ -│ -o json | jq '.data | map_values(@base64d)' > .bak -│ -╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ +――― Here's a list of helpfull commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤ + +→ Get all the Infisical resources (excluding secrets/pvcs) +$ kubectl get all -n {{ .Release.Namespace }} + +→ Get your release status +$ helm status {{ .Release.Namespace }} {{ .Release.Name }} + +→ Get your release resources +$ helm get all {{ .Release.Namespace }} {{ .Release.Name }} + +→ Uninstall your release +$ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} + +→ Get MongoDB root password +$ kubectl get secret -n {{ .Release.Namespace }} mongodb + -o jsonpath="{.data['mongodb-root-password']}" | base64 -d + +→ Get MongoDB users passwords +$ kubectl get secret -n {{ .Release.Namespace }} mongodb + -o jsonpath="{.data['mongodb-passwords']}" | base64 -d + +→ Export your backend secrets (requires jq) +$ kubectl get secrets/ -n {{ .Release.Namespace }} \ + -o json | jq '.data | map_values(@base64d)' > .bak + +――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ ## \ No newline at end of file From 68deea28b7f6770a562ac912bdbfcfb75d5e33b9 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Mon, 27 Mar 2023 14:19:05 -0700 Subject: [PATCH 28/32] Make host name optional --- helm-charts/infisical/templates/_helpers.tpl | 43 +++++++++++++++++++ .../templates/backend-deployment.yaml | 1 - helm-charts/infisical/templates/ingress.yaml | 19 +------- helm-charts/infisical/values.yaml | 8 ++-- 4 files changed, 49 insertions(+), 22 deletions(-) diff --git a/helm-charts/infisical/templates/_helpers.tpl b/helm-charts/infisical/templates/_helpers.tpl index bf3f8e301..d1a0b7922 100644 --- a/helm-charts/infisical/templates/_helpers.tpl +++ b/helm-charts/infisical/templates/_helpers.tpl @@ -127,3 +127,46 @@ Create the mongodb connection string. {{- end -}} {{- printf "%s" $connectionString -}} {{- end -}} + + +{{- define "infisical.ingress-rules" -}} +{{- $ingress := .Values.ingress }} +{{- if $ingress.hostName }} +rules: + - host: {{ $ingress.hostName }} + http: + paths: + - path: {{ $ingress.frontend.path }} + pathType: {{ $ingress.frontend.pathType }} + backend: + service: + name: {{ include "infisical.frontend.fullname" . }} + port: + number: 3000 + - path: {{ $ingress.backend.path }} + pathType: {{ $ingress.backend.pathType }} + backend: + service: + name: {{ include "infisical.backend.fullname" . }} + port: + number: 4000 +{{- else }} +rules: + - http: + paths: + - path: {{ $ingress.frontend.path }} + pathType: {{ $ingress.frontend.pathType }} + backend: + service: + name: {{ include "infisical.frontend.fullname" . }} + port: + number: 3000 + - path: {{ $ingress.backend.path }} + pathType: {{ $ingress.backend.pathType }} + backend: + service: + name: {{ include "infisical.backend.fullname" . }} + port: + number: 4000 +{{- end }} +{{- end }} diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index b6d63372f..f0b134d5b 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -89,5 +89,4 @@ stringData: {{- $v := $value | default ($current | default $default) -}} {{ $key }}: {{ $v | quote }} {{ end -}} - MONGO_URL: {{ include "infisical.mongodb.connectionString" . | quote }} {{- end }} diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index 9b181fe64..57d1e4434 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -27,22 +27,5 @@ spec: secretName: {{ .secretName }} {{- end }} {{- end }} - rules: - - host: {{ $ingress.hostName}} - http: - paths: - - path: {{ $ingress.frontend.path }} - pathType: {{ $ingress.frontend.pathType }} - backend: - service: - name: {{ include "infisical.frontend.fullname" . }} - port: - number: 3000 - - path: {{ $ingress.backend.path }} - pathType: {{ $ingress.backend.pathType }} - backend: - service: - name: {{ include "infisical.backend.fullname" . }} - port: - number: 4000 +{{- include "infisical.ingress-rules" . | nindent 2 }} {{ end }} \ No newline at end of file diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 4f540ff6d..8d6b78325 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -303,13 +303,14 @@ ingress: ingressClassName: nginx ## @param ingress.annotations Ingress annotations ## - annotations: {} + annotations: + {} # kubernetes.io/ingress.class: "nginx" # cert-manager.io/issuer: letsencrypt-nginx ## @param ingress.hostName Ingress hostname (your custom domain name) ## Replace with your own domain ## - hostName: infisical.local + hostName: "" ## @skip ingress.frontend ## frontend: @@ -396,7 +397,8 @@ mailhog: ingressClassName: nginx ## @param mailhog.ingress.annotations Ingress annotations ## - annotations: {} + annotations: + {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" ## @param mailhog.ingress.labels Ingress labels From 510d5f0ffd77f94f26ec06920e7dc88b5806b2c9 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Fri, 31 Mar 2023 23:29:03 +0200 Subject: [PATCH 29/32] chore(chart): discard secret-operator changes --- helm-charts/secrets-operator/templates/deployment.yaml | 1 - helm-charts/secrets-operator/templates/metrics-service.yaml | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/helm-charts/secrets-operator/templates/deployment.yaml b/helm-charts/secrets-operator/templates/deployment.yaml index 2cc7ff7b7..026728bfa 100644 --- a/helm-charts/secrets-operator/templates/deployment.yaml +++ b/helm-charts/secrets-operator/templates/deployment.yaml @@ -1,4 +1,3 @@ -{{- $ctrlManager := .Values.controllerManager }} apiVersion: v1 kind: ServiceAccount metadata: diff --git a/helm-charts/secrets-operator/templates/metrics-service.yaml b/helm-charts/secrets-operator/templates/metrics-service.yaml index 99178b8c3..ebf7ce549 100644 --- a/helm-charts/secrets-operator/templates/metrics-service.yaml +++ b/helm-charts/secrets-operator/templates/metrics-service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "secrets-operator.fullname" . | trunc 28 }}-controller-manager-metrics-service + name: {{ include "secrets-operator.fullname" . }}-controller-manager-metrics-service labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: k8-operator From dd10bf17020de38e0f4f87bfb17604fe065686fa Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 1 Apr 2023 00:17:06 +0200 Subject: [PATCH 30/32] fix(chart): simplified ingress rules configuration --- helm-charts/infisical/templates/_helpers.tpl | 46 +------------------- helm-charts/infisical/templates/ingress.yaml | 21 ++++++++- 2 files changed, 22 insertions(+), 45 deletions(-) diff --git a/helm-charts/infisical/templates/_helpers.tpl b/helm-charts/infisical/templates/_helpers.tpl index d1a0b7922..500edea33 100644 --- a/helm-charts/infisical/templates/_helpers.tpl +++ b/helm-charts/infisical/templates/_helpers.tpl @@ -122,51 +122,9 @@ Create the mongodb connection string. {{- $pass := first .Values.mongodb.auth.passwords | default "root" -}} {{- $database := first .Values.mongodb.auth.databases | default "test" -}} {{- $connectionString := printf "mongodb://%s:%s@%s:%d/%s" $user $pass $host $port $database -}} +{{/* Backward compatibility (< 0.1.16, deprecated) */}} {{- if .Values.mongodbConnection.externalMongoDBConnectionString -}} {{- $connectionString = .Values.mongodbConnection.externalMongoDBConnectionString -}} {{- end -}} {{- printf "%s" $connectionString -}} -{{- end -}} - - -{{- define "infisical.ingress-rules" -}} -{{- $ingress := .Values.ingress }} -{{- if $ingress.hostName }} -rules: - - host: {{ $ingress.hostName }} - http: - paths: - - path: {{ $ingress.frontend.path }} - pathType: {{ $ingress.frontend.pathType }} - backend: - service: - name: {{ include "infisical.frontend.fullname" . }} - port: - number: 3000 - - path: {{ $ingress.backend.path }} - pathType: {{ $ingress.backend.pathType }} - backend: - service: - name: {{ include "infisical.backend.fullname" . }} - port: - number: 4000 -{{- else }} -rules: - - http: - paths: - - path: {{ $ingress.frontend.path }} - pathType: {{ $ingress.frontend.pathType }} - backend: - service: - name: {{ include "infisical.frontend.fullname" . }} - port: - number: 3000 - - path: {{ $ingress.backend.path }} - pathType: {{ $ingress.backend.pathType }} - backend: - service: - name: {{ include "infisical.backend.fullname" . }} - port: - number: 4000 -{{- end }} -{{- end }} +{{- end -}} \ No newline at end of file diff --git a/helm-charts/infisical/templates/ingress.yaml b/helm-charts/infisical/templates/ingress.yaml index 57d1e4434..a675fa2ff 100644 --- a/helm-charts/infisical/templates/ingress.yaml +++ b/helm-charts/infisical/templates/ingress.yaml @@ -27,5 +27,24 @@ spec: secretName: {{ .secretName }} {{- end }} {{- end }} -{{- include "infisical.ingress-rules" . | nindent 2 }} + rules: + - http: + paths: + - path: {{ $ingress.frontend.path }} + pathType: {{ $ingress.frontend.pathType }} + backend: + service: + name: {{ include "infisical.frontend.fullname" . }} + port: + number: 3000 + - path: {{ $ingress.backend.path }} + pathType: {{ $ingress.backend.pathType }} + backend: + service: + name: {{ include "infisical.backend.fullname" . }} + port: + number: 4000 + {{- if $ingress.hostName }} + host: {{ $ingress.hostName }} + {{- end }} {{ end }} \ No newline at end of file From 278f1caa193b592be73f613cd71e497f36e9764c Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Sat, 1 Apr 2023 00:18:00 +0200 Subject: [PATCH 31/32] chore(doc): updated scripts and docs --- helm-charts/infisical/README.md | 19 ++++++++++--------- helm-charts/infisical/examples/local-helm.sh | 2 ++ helm-charts/infisical/examples/local-kind.sh | 2 ++ helm-charts/infisical/templates/NOTES.txt | 2 +- helm-charts/infisical/values.yaml | 4 ++-- 5 files changed, 17 insertions(+), 12 deletions(-) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 9079e3e36..54ece9119 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -110,7 +110,8 @@ kubectl get secrets -n \ | `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | | `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | | `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | -| `backendEnvironmentVariables.INVITE_ONLY_SIGNUP` | To disable account creation from the login page | `false` | +| `backendEnvironmentVariables.INVITE_ONLY_SIGNUP` | To disable account creation from the login page (invites only) | `false` | +| `backendEnvironmentVariables.MONGO_URL` | MongoDB connection string (external or internal)
Leave it empty for auto-generated connection string | `""` | ### MongoDB(®) parameters @@ -151,18 +152,18 @@ kubectl get secrets -n \ | `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` | | `mongodb.persistence.accessModes` | Persistent volume access modes | `["ReadWriteOnce"]` | | `mongodb.persistence.size` | Persistent storage request size | `8Gi` | -| `mongodbConnection.externalMongoDBConnectionString` | External MongoDB connection string | `""` | +| `mongodbConnection.externalMongoDBConnectionString` | Deprecated :warning: External MongoDB connection string
Use backendEnvironmentVariables.MONGO_URL instead | `""` | ### Ingress parameters -| Name | Description | Value | -| -------------------------- | ------------------------------------------- | ----------------- | -| `ingress.enabled` | Enable ingress | `true` | -| `ingress.ingressClassName` | Ingress class name | `nginx` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | -| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | +| Name | Description | Value | +| -------------------------- | ------------------------------------------------------------------------ | ------- | +| `ingress.enabled` | Enable ingress | `true` | +| `ingress.ingressClassName` | Ingress class name | `nginx` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.hostName` | Ingress hostname (your custom domain name, e.g. `infisical.example.org`) | `""` | +| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | ### Mailhog parameters diff --git a/helm-charts/infisical/examples/local-helm.sh b/helm-charts/infisical/examples/local-helm.sh index 047535da1..ac7466821 100755 --- a/helm-charts/infisical/examples/local-helm.sh +++ b/helm-charts/infisical/examples/local-helm.sh @@ -32,4 +32,6 @@ backendEnvironmentVariables: SMTP_USERNAME: dev@$host frontendEnvironmentVariables: SITE_URL: https://$host +ingress: + hostName: $host EOF \ No newline at end of file diff --git a/helm-charts/infisical/examples/local-kind.sh b/helm-charts/infisical/examples/local-kind.sh index 552db2b92..ab507ffd6 100755 --- a/helm-charts/infisical/examples/local-kind.sh +++ b/helm-charts/infisical/examples/local-kind.sh @@ -69,4 +69,6 @@ backendEnvironmentVariables: SMTP_USERNAME: dev@$host frontendEnvironmentVariables: SITE_URL: https://$host +ingress: + hostName: $host EOF diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 45eac8ad5..56879e6a2 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -53,7 +53,7 @@ │ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ -――― Here's a list of helpfull commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤ +――― Here's a list of helpful commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤ → Get all the Infisical resources (excluding secrets/pvcs) $ kubectl get all -n {{ .Release.Namespace }} diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 8d6b78325..67c222278 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -159,7 +159,7 @@ backendEnvironmentVariables: ## @param backendEnvironmentVariables.INVITE_ONLY_SIGNUP To disable account creation from the login page (invites only) ## INVITE_ONLY_SIGNUP: false - ## @param backendEnvironmentVariables.MONGO_URL MongoDB connection string + ## @param backendEnvironmentVariables.MONGO_URL MongoDB connection string (external or internal)
Leave it empty for auto-generated connection string ## By default the backend will automatically be connected to a Mongo instance within the cluster ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ @@ -307,7 +307,7 @@ ingress: {} # kubernetes.io/ingress.class: "nginx" # cert-manager.io/issuer: letsencrypt-nginx - ## @param ingress.hostName Ingress hostname (your custom domain name) + ## @param ingress.hostName Ingress hostname (your custom domain name, e.g. `infisical.example.org`) ## Replace with your own domain ## hostName: "" From bdb71d10518ac95f0603820517b12d68f7e960f5 Mon Sep 17 00:00:00 2001 From: Grraahaam <72856427+Grraahaam@users.noreply.github.com> Date: Mon, 3 Apr 2023 09:10:54 +0200 Subject: [PATCH 32/32] feat(chart): added updatedAt annotation to apps dpl and pod --- helm-charts/infisical/README.md | 2 ++ .../infisical/templates/backend-deployment.yaml | 12 +++++++----- .../infisical/templates/frontend-deployment.yaml | 10 ++++++---- 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 54ece9119..e614d9600 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -289,6 +289,8 @@ helm upgrade --install --atomic \ . ``` +ℹī¸ Since we provide references to the k8s secret resources within the pods, their manifest file doesnt change and though doesnt reload (no changes detected). When upgrading your secrets, you'll have to do it through Helm (a timestamp field will be updated and your pods restarted) + ### 0.1.16 - Auto-generation for the following variables, to ease your future upgrades or setups : diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index f0b134d5b..797439019 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -3,10 +3,11 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "infisical.backend.fullname" . }} - {{- with $backend.deploymentAnnotations }} annotations: - {{- toYaml . | nindent 8 }} - {{- end }} + updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} + {{- with $backend.deploymentAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "infisical.backend.labels" . | nindent 4 }} spec: @@ -18,10 +19,11 @@ spec: metadata: labels: {{- include "infisical.backend.matchLabels" . | nindent 8 }} - {{- with $backend.podAnnotations }} annotations: + updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} + {{- with $backend.podAnnotations }} {{- toYaml . | nindent 8 }} - {{- end }} + {{- end }} spec: containers: - name: {{ template "infisical.name" . }}-{{ $backend.name }} diff --git a/helm-charts/infisical/templates/frontend-deployment.yaml b/helm-charts/infisical/templates/frontend-deployment.yaml index 114cfc112..9c5cd1560 100644 --- a/helm-charts/infisical/templates/frontend-deployment.yaml +++ b/helm-charts/infisical/templates/frontend-deployment.yaml @@ -3,9 +3,10 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "infisical.frontend.fullname" . }} - {{- with .Values.frontend.deploymentAnnotations }} annotations: - {{- toYaml . | nindent 8 }} + updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} + {{- with .Values.frontend.deploymentAnnotations }} + {{- toYaml . | nindent 4 }} {{- end }} labels: {{- include "infisical.frontend.labels" . | nindent 4 }} @@ -18,10 +19,11 @@ spec: metadata: labels: {{- include "infisical.frontend.matchLabels" . | nindent 8 }} - {{- with $frontend.podAnnotations }} annotations: + updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} + {{- with $frontend.podAnnotations }} {{- toYaml . | nindent 8 }} - {{- end }} + {{- end }} spec: containers: - name: {{ template "infisical.name" . }}-{{ $frontend.name }}