keyhan
1572b3ce66
Build and Deploy Platform / build-and-deploy (push) Failing after 50m25s
Backend now fails production validation without CLUSTER_KUBECONFIG_KEY. Add cluster-kubeconfig-key to the chart secret and env, plus secrets.existingSecret so GitOps deployments can use a pre-created (sealed) Secret instead of the lookup/randAlphaNum template that churns under Argo CD's helm template rendering. Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.8 KiB
YAML
39 lines
1.8 KiB
YAML
{{- if not .Values.secrets.existingSecret }}
|
|
{{/*
|
|
NOTE: lookup only works with `helm install/upgrade` (CLI). Argo CD renders with
|
|
`helm template` where lookup is always empty, so values would be regenerated on
|
|
every sync. For GitOps deployments set secrets.existingSecret and manage the
|
|
Secret out-of-band (e.g. SealedSecret in the gitops repo).
|
|
*/}}
|
|
{{- $existing := lookup "v1" "Secret" (include "cloudhost-platform.namespace" .) (include "cloudhost-platform.secretName" .) }}
|
|
{{- $pgPass := .Values.postgres.password }}
|
|
{{- if not $pgPass }}
|
|
{{- if $existing }}{{- $pgPass = index $existing.data "postgres-password" | b64dec }}{{- else }}{{- $pgPass = randAlphaNum 24 }}{{- end }}
|
|
{{- end }}
|
|
{{- $jwt := .Values.secrets.jwtSecret }}
|
|
{{- if not $jwt }}
|
|
{{- if $existing }}{{- $jwt = index $existing.data "jwt-secret" | b64dec }}{{- else }}{{- $jwt = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
{{- $jwtRefresh := .Values.secrets.jwtRefreshSecret }}
|
|
{{- if not $jwtRefresh }}
|
|
{{- if $existing }}{{- $jwtRefresh = index $existing.data "jwt-refresh-secret" | b64dec }}{{- else }}{{- $jwtRefresh = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
{{- $kubeconfigKey := .Values.secrets.clusterKubeconfigKey }}
|
|
{{- if not $kubeconfigKey }}
|
|
{{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "cloudhost-platform.secretName" . }}
|
|
namespace: {{ include "cloudhost-platform.namespace" . }}
|
|
labels:
|
|
{{- include "cloudhost-platform.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
postgres-password: {{ $pgPass | quote }}
|
|
jwt-secret: {{ $jwt | quote }}
|
|
jwt-refresh-secret: {{ $jwtRefresh | quote }}
|
|
cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
|
|
{{- end }}
|