Skip to content

Commit 579a0de

Browse files
prabodhcsprabodhcs
authored
Merge pull request #13 from linuxfoundation/LFXV2-618
[LFXV2-618] fix: add ServiceAccount support for GroupsIO secrets
2 parents dccf34c + 21751d9 commit 579a0de

File tree

5 files changed

+171
-94
lines changed

5 files changed

+171
-94
lines changed

‎charts/lfx-v2-mailing-list-service/templates/deployment.yaml‎

Lines changed: 15 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -16,48 +16,26 @@ spec:
1616
labels:
1717
app: {{.Chart.Name}}
1818
spec:
19+
# Use the configured service account for pod identity
20+
serviceAccountName: {{ .Values.serviceAccount.name | default .Chart.Name }}
1921
containers:
2022
- name: app
21-
image: "{{.Values.image.repository}}:{{.Values.image.tag | default .Chart.AppVersion}}"
23+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
2224
securityContext:
2325
allowPrivilegeEscalation: false
24-
imagePullPolicy: {{.Values.image.pullPolicy}}
26+
imagePullPolicy: {{ .Values.image.pullPolicy }}
27+
# Environment variables from values.yaml app.environment
28+
# Supports both direct values and valueFrom for secret references
2529
env:
26-
- name: NATS_URL
27-
value: {{.Values.nats.url}}
28-
- name: LOG_LEVEL
29-
value: {{.Values.app.logLevel}}
30-
- name: LOG_ADD_SOURCE
31-
value: {{.Values.app.logAddSource | quote}}
32-
- name: JWKS_URL
33-
value: {{.Values.heimdall.jwksUrl}}
34-
- name: JWT_AUDIENCE
35-
value: {{.Values.app.audience}}
36-
- name: AUTH_SOURCE
37-
value: {{.Values.app.authSource}}
38-
- name: JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL
39-
value: {{.Values.app.jwtAuthDisabledMockLocalPrincipal}}
40-
# Repository configuration
41-
- name: REPOSITORY_SOURCE
42-
value: {{.Values.app.repositorySource | default "nats"}}
43-
# GroupsIO configuration
44-
- name: GROUPSIO_SOURCE
45-
value: {{.Values.app.groupsio.source}}
46-
- name: GROUPSIO_BASE_URL
47-
value: {{.Values.app.groupsio.baseUrl}}
48-
- name: GROUPSIO_EMAIL
49-
value: {{.Values.app.groupsio.email}}
50-
- name: GROUPSIO_PASSWORD
51-
value: {{.Values.app.groupsio.password}}
52-
- name: GROUPSIO_TIMEOUT
53-
value: {{.Values.app.groupsio.timeout}}
54-
- name: GROUPSIO_MAX_RETRIES
55-
value: {{.Values.app.groupsio.maxRetries}}
56-
- name: GROUPSIO_RETRY_DELAY
57-
value: {{.Values.app.groupsio.retryDelay}}
58-
# Webhook configuration
59-
- name: GROUPSIO_WEBHOOK_SECRET
60-
value: {{.Values.app.groupsioWebhookSecret | default "" | quote}}
30+
{{- range $name, $config := .Values.app.environment }}
31+
- name: {{ $name }}
32+
{{- if $config.value }}
33+
value: {{ $config.value | quote }}
34+
{{- else if $config.valueFrom }}
35+
valueFrom:
36+
{{- toYaml $config.valueFrom | nindent 16 }}
37+
{{- end }}
38+
{{- end }}
6139
ports:
6240
- containerPort: {{.Values.service.port}}
6341
name: web

‎charts/lfx-v2-mailing-list-service/templates/nats-kv-buckets.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright The Linux Foundation and each contributor to LFX.
22
# SPDX-License-Identifier: MIT
3-
---
43
{{- if .Values.nats.groupsio_services_kv_bucket.creation }}
4+
---
55
apiVersion: jetstream.nats.io/v1beta2
66
kind: KeyValue
77
metadata:
@@ -19,8 +19,8 @@ spec:
1919
maxBytes: {{ .Values.nats.groupsio_services_kv_bucket.maxBytes }}
2020
compression: {{ .Values.nats.groupsio_services_kv_bucket.compression }}
2121
{{- end }}
22+
{{- if .Values.nats.groupsio_mailing_lists_kv_bucket.creation }}
2223
---
23-
{{- if .Values.nats.groupsio_mailing_lists_kv_bucket.creation -}}
2424
apiVersion: jetstream.nats.io/v1beta2
2525
kind: KeyValue
2626
metadata:
@@ -38,8 +38,8 @@ spec:
3838
maxBytes: {{ .Values.nats.groupsio_mailing_lists_kv_bucket.maxBytes }}
3939
compression: {{ .Values.nats.groupsio_mailing_lists_kv_bucket.compression }}
4040
{{- end }}
41+
{{- if .Values.nats.groupsio_members_kv_bucket.creation }}
4142
---
42-
{{- if .Values.nats.groupsio_members_kv_bucket.creation -}}
4343
apiVersion: jetstream.nats.io/v1beta2
4444
kind: KeyValue
4545
metadata:

‎charts/lfx-v2-mailing-list-service/templates/serviceaccount.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Copyright The Linux Foundation and each contributor to LFX.
2+
# SPDX-License-Identifier: MIT
3+
{{- if .Values.serviceAccount.create -}}
4+
---
5+
apiVersion: v1
6+
kind: ServiceAccount
7+
metadata:
8+
name: {{ .Values.serviceAccount.name | default .Chart.Name }}
9+
namespace: {{ .Release.Namespace }}
10+
labels:
11+
app: {{ .Chart.Name }}
12+
{{- with .Values.serviceAccount.annotations }}
13+
annotations:
14+
{{- toYaml . | nindent 4 }}
15+
{{- end }}
16+
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
17+
{{- end }}

‎charts/lfx-v2-mailing-list-service/values.local.yaml‎

Lines changed: 48 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,57 @@
11
# Copyright The Linux Foundation and each contributor to LFX.
22
# SPDX-License-Identifier: MIT
33
---
4-
# Local development values override
4+
# Local development overrides for lfx-v2-mailing-list-service
5+
# Use with: helm install -f values.local.yaml or make helm-install-local
56
# This file configures the service for local testing with mock authentication
67
# DO NOT USE IN PRODUCTION
78

8-
# app is the configuration for the application
9+
# Local development domain
10+
lfx:
11+
domain: "k8s.orb.local"
12+
13+
# Use latest image with always pull policy for local development
14+
image:
15+
tag: "latest"
16+
pullPolicy: Always
17+
18+
# Application configuration for local development
919
app:
10-
# Use mock authentication for local testing
11-
authSource: mock
12-
# Mock principal for local development - bypasses JWT validation
13-
jwtAuthDisabledMockLocalPrincipal: "test-super-admin"
14-
# Enable debug logging for local development
15-
logLevel: debug
20+
# Disable OIDC contextualizer for local testing
21+
use_oidc_contextualizer: false
22+
23+
environment:
24+
# Enable debug logging for local development
25+
LOG_LEVEL:
26+
value: debug
27+
LOG_ADD_SOURCE:
28+
value: true
1629

17-
# Use mock repository for local testing
18-
repositorySource: mock
30+
# Use mock authentication for local testing
31+
AUTH_SOURCE:
32+
value: mock
1933

20-
# Use mock GroupsIO integration for local testing
21-
groupsio:
22-
source: mock
34+
# Mock principal for local development - bypasses JWT validation
35+
JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL:
36+
value: "test-super-admin"
2337

24-
# Webhook secret for local testing (NOT FOR PRODUCTION)
25-
groupsioWebhookSecret: "local-test-webhook-secret-not-for-production"
38+
# Use mock repository for local testing
39+
REPOSITORY_SOURCE:
40+
value: mock
2641

42+
# Use mock GroupsIO integration for local testing
43+
GROUPSIO_SOURCE:
44+
value: mock
45+
46+
# Empty credentials for mock mode (not used in mock mode)
47+
GROUPSIO_EMAIL:
48+
value: ""
49+
GROUPSIO_PASSWORD:
50+
value: ""
51+
52+
# Webhook secret for local testing (NOT FOR PRODUCTION)
53+
GROUPSIO_WEBHOOK_SECRET:
54+
value: ""
2755

2856
# Disable OpenFGA authorization for local testing
2957
openfga:
@@ -36,3 +64,8 @@ heimdall:
3664
# Disable Authelia authentication for local testing
3765
authelia:
3866
enabled: false
67+
68+
# Service account configuration for local development
69+
serviceAccount:
70+
create: true
71+
name: ""

‎charts/lfx-v2-mailing-list-service/values.yaml‎

Lines changed: 88 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,18 @@ service:
3131
# port is the service port
3232
port: 8080
3333

34+
# serviceAccount is the configuration for the Kubernetes service account
35+
serviceAccount:
36+
# create specifies whether a service account should be created
37+
create: true
38+
# name is the name of the service account to use.
39+
# If not set and create is true, a name is generated using the fullname template
40+
name: ""
41+
# annotations to add to the service account
42+
annotations: {}
43+
# automountServiceAccountToken is a boolean to determine if the service account token should be automatically mounted
44+
automountServiceAccountToken: true
45+
3446
# nats is the configuration for the NATS server
3547
nats:
3648
# url is the URL of the NATS server
@@ -121,45 +133,82 @@ authelia:
121133

122134
# app is the configuration for the application
123135
app:
124-
# logLevel is the log level (debug, info, warn, error)
125-
logLevel: debug
126-
# logAddSource is a boolean to determine if the log source should be added
127-
logAddSource: true
128-
# authSource is the authentication source (jwt or mock)
129-
authSource: jwt
130-
# jwtAuthDisabledMockLocalPrincipal is used for local development to bypass JWT validation
131-
jwtAuthDisabledMockLocalPrincipal: ""
136+
# audience is the JWT audience required for authentication with this app
137+
audience: lfx-v2-mailing-list-service
132138
# use_oidc_contextualizer is a boolean to determine if the OIDC contextualizer should be used
133139
use_oidc_contextualizer: true
134-
# jwt is the configuration for JWT authentication
135-
# audience is the intended audience for the JWT token
136-
audience: lfx-v2-mailing-list-service
137140

138-
# Repository implementation source (nats or mock)
139-
# Production should use 'nats', local development should use 'mock'
140-
repositorySource: nats
141-
142-
# GroupsIO integration configuration
143-
groupsio:
144-
# source determines the GroupsIO implementation (groupsio or mock)
145-
# Use 'groupsio' for production, 'mock' for testing/local development
146-
# Empty string defaults to production in code
147-
source: groupsio
148-
# baseUrl is the Groups.io API base URL
149-
baseUrl: "https://groups.io/api"
150-
# email is the Groups.io account email for authentication
151-
# Do not commit actual credentials to this file will be set by Kubernetes secrets
152-
email: ""
153-
# password is the Groups.io account password for authentication
154-
# Do not commit actual credentials to this file will be set by Kubernetes secrets
155-
password: ""
156-
# timeout is the HTTP client timeout for Groups.io requests
157-
timeout: "30s"
158-
# maxRetries is the maximum number of retry attempts for failed requests
159-
maxRetries: "3"
160-
# retryDelay is the delay between retry attempts
161-
retryDelay: "1s"
162-
163-
# Webhook secret for GroupsIO webhook validation
164-
# Do not commit actual credentials to this file will be set by Kubernetes secrets
165-
groupsioWebhookSecret: ""
141+
# environment contains all application environment variables
142+
# Each variable can have either a 'value' (for direct values) or 'valueFrom' (for secret references)
143+
environment:
144+
# NATS_URL is the URL of the NATS server (required)
145+
NATS_URL:
146+
value: nats://lfx-platform-nats.lfx.svc.cluster.local:4222
147+
148+
# LOG_LEVEL is the log level (debug, info, warn, error) - optional, defaults to info
149+
LOG_LEVEL:
150+
value: info
151+
152+
# LOG_ADD_SOURCE determines if log source should be added - optional, defaults to true
153+
LOG_ADD_SOURCE:
154+
value: true
155+
156+
# JWKS_URL is the URL to the JSON Web Key Set endpoint for JWT validation
157+
# Required unless JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL is set
158+
JWKS_URL:
159+
value: http://lfx-platform-heimdall.lfx.svc.cluster.local:4457/.well-known/jwks
160+
161+
# JWT_AUDIENCE is the intended audience for the JWT token (required)
162+
JWT_AUDIENCE:
163+
value: lfx-v2-mailing-list-service
164+
165+
# JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL is used for local development to bypass JWT validation
166+
# Optional, local dev only. Set to a principal name to enable mock authentication
167+
JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL:
168+
value: ''
169+
170+
# AUTH_SOURCE is the authentication source: 'jwt' for production, 'mock' for local dev (optional, defaults to jwt)
171+
AUTH_SOURCE:
172+
value: jwt
173+
174+
# REPOSITORY_SOURCE is the repository implementation: 'nats' for production, 'mock' for local dev
175+
# Optional, defaults to nats. Production should use 'nats', local development should use 'mock'
176+
REPOSITORY_SOURCE:
177+
value: nats
178+
179+
# GroupsIO Integration Configuration
180+
# GROUPSIO_SOURCE determines the GroupsIO implementation: 'groupsio' for production, 'mock' for testing
181+
# Use 'groupsio' for production, 'mock' for testing. Empty string defaults to production in code.
182+
GROUPSIO_SOURCE:
183+
value: groupsio
184+
185+
# GROUPSIO_BASE_URL is the Groups.io API base URL
186+
GROUPSIO_BASE_URL:
187+
value: "https://groups.io/api"
188+
189+
# GROUPSIO_EMAIL is the Groups.io account email for authentication
190+
# WARNING: Do not commit actual credentials to this file - should be set via Kubernetes secrets using valueFrom
191+
GROUPSIO_EMAIL:
192+
value: null
193+
194+
# GROUPSIO_PASSWORD is the Groups.io account password for authentication
195+
# WARNING: Do not commit actual credentials to this file - should be set via Kubernetes secrets using valueFrom
196+
GROUPSIO_PASSWORD:
197+
value: null
198+
199+
# GROUPSIO_TIMEOUT is the HTTP client timeout for Groups.io requests (e.g., "30s", "1m")
200+
GROUPSIO_TIMEOUT:
201+
value: "30s"
202+
203+
# GROUPSIO_MAX_RETRIES is the maximum number of retry attempts for failed requests
204+
GROUPSIO_MAX_RETRIES:
205+
value: "3"
206+
207+
# GROUPSIO_RETRY_DELAY is the delay between retry attempts (e.g., "1s", "500ms")
208+
GROUPSIO_RETRY_DELAY:
209+
value: "1s"
210+
211+
# GROUPSIO_WEBHOOK_SECRET is the secret for GroupsIO webhook validation
212+
# WARNING: Do not commit actual credentials to this file - should be set via Kubernetes secrets using valueFrom
213+
GROUPSIO_WEBHOOK_SECRET:
214+
value: null

0 commit comments

Comments
 (0)