keyhan
22359be40e
Close billing, tenancy, migration, build, and CI/CD gaps identified in the audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with base schema, stateful service stability, safer Dockerfiles/git builds, and platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off). Co-authored-by: Cursor <cursoragent@cursor.com>
44 lines
2.1 KiB
YAML
44 lines
2.1 KiB
YAML
{{- if not .Values.secrets.existingSecret }}
|
|
{{/*
|
|
NOTE: lookup only works with `helm install/upgrade` (CLI). Argo CD renders with
|
|
`helm template` where lookup is always empty, so values would be regenerated on
|
|
every sync. For GitOps deployments set secrets.existingSecret and manage the
|
|
Secret out-of-band (e.g. SealedSecret in the gitops repo).
|
|
*/}}
|
|
{{- $existing := lookup "v1" "Secret" (include "cloudhost-platform.namespace" .) (include "cloudhost-platform.secretName" .) }}
|
|
{{- $pgPass := .Values.postgres.password }}
|
|
{{- if not $pgPass }}
|
|
{{- if $existing }}{{- $pgPass = index $existing.data "postgres-password" | b64dec }}{{- else }}{{- $pgPass = randAlphaNum 24 }}{{- end }}
|
|
{{- end }}
|
|
{{- $jwt := .Values.secrets.jwtSecret }}
|
|
{{- if not $jwt }}
|
|
{{- if $existing }}{{- $jwt = index $existing.data "jwt-secret" | b64dec }}{{- else }}{{- $jwt = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
{{- $jwtRefresh := .Values.secrets.jwtRefreshSecret }}
|
|
{{- if not $jwtRefresh }}
|
|
{{- if $existing }}{{- $jwtRefresh = index $existing.data "jwt-refresh-secret" | b64dec }}{{- else }}{{- $jwtRefresh = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
{{- $kubeconfigKey := .Values.secrets.clusterKubeconfigKey }}
|
|
{{- if not $kubeconfigKey }}
|
|
{{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
{{- $redisPass := .Values.redis.password }}
|
|
{{- if not $redisPass }}
|
|
{{- if and $existing (hasKey $existing.data "redis-password") }}{{- $redisPass = index $existing.data "redis-password" | b64dec }}{{- else }}{{- $redisPass = randAlphaNum 24 }}{{- end }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "cloudhost-platform.secretName" . }}
|
|
namespace: {{ include "cloudhost-platform.namespace" . }}
|
|
labels:
|
|
{{- include "cloudhost-platform.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
postgres-password: {{ $pgPass | quote }}
|
|
jwt-secret: {{ $jwt | quote }}
|
|
jwt-refresh-secret: {{ $jwtRefresh | quote }}
|
|
cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
|
|
redis-password: {{ $redisPass | quote }}
|
|
{{- end }}
|