github/charts
4
0
Fork 0
mirror of https://github.com/truenas/charts.git synced 2024-04-21 15:21:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

make envs safer

Browse Source
This commit is contained in:
Stavros kois
2022-11-11 20:42:31 +02:00
parent 659da44e5e
commit f7ab86d361
8 changed files with 423 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/common-test/tests/pod/deployment_container_default_test.yaml
+2
View File
@@ -38,6 +38,7 @@ tests:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].terminationMessagePolicy
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].securityContext
value:
allowPrivilegeEscalation: false
@@ -48,6 +49,7 @@ tests:
readOnlyRootFilesystem: true
runAsNonRoot: true
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
library/common-test/tests/pod/deployment_container_env_test.yaml
+321
View File
@@ -242,3 +242,324 @@ tests:
value: "0"
- name: S6_READ_ONLY_ROOT
value: "1"
- it: should fail with envs defined as a list
set:
env:
- name: some_name
value: some_value
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Environment Variables as a list is not supported. Use key-value format.
- it: should fail with envs defined with an invalid keyRef
set:
env:
ENVVAR:
invalidKeyRef:
name: blabla
key: blbla
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Not a valid valueFrom reference. Valid options are (configMapKeyRef and secretKeyRef)
- it: should fail with envs defined without a name in configMapKeyRef
set:
env:
ENVVAR:
configMapKeyRef:
key: some_key
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: <name> for the keyRef is not defined in (ENVVAR)
- it: should fail with envs defined without a name in secretKeyRef
set:
env:
ENVVAR:
secretKeyRef:
key: some_key
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: <name> for the keyRef is not defined in (ENVVAR)
- it: should fail with envs defined without a key in configMapKeyRef
set:
env:
ENVVAR:
configMapKeyRef:
name: some_name
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: <key> for the keyRef is not defined in (ENVVAR)
- it: should fail with envs defined without a key in secretKeyRef
set:
env:
ENVVAR:
secretKeyRef:
name: some_name
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: <key> for the keyRef is not defined in (ENVVAR)
- it: should fail with envs defined with a non-bool <optional> in secretKeyRef
set:
env:
ENVVAR:
secretKeyRef:
name: some_name
key: some_key
optional: non-bool
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: <optional> in secretKeyRef must be a boolean on Environment Variable (ENVVAR)
- it: should pass with envs defined with int value
set:
env:
ENVVAR: 123
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
value: "123"
- it: should pass with envs defined with bool value
set:
env:
ENVVAR: true
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
value: "true"
- it: should pass with envs defined with string value
set:
env:
ENVVAR: "some_value"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
value: "some_value"
- it: should pass with envs defined with valueFrom configMapKeyRef
set:
env:
ENVVAR:
configMapKeyRef:
name: some_name
key: some_key
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
configMapKeyRef:
name: some_name
key: some_key
- it: should pass with envs defined with valueFrom secretKeyRef
set:
env:
ENVVAR:
secretKeyRef:
name: some_name
key: some_key
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
secretKeyRef:
name: some_name
key: some_key
- it: should pass with envs defined with valueFrom configMapKeyRef from tpl
set:
name: some_name
key: some_key
env:
ENVVAR:
configMapKeyRef:
name: "{{ .Values.name }}"
key: "{{ .Values.key }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
configMapKeyRef:
name: some_name
key: some_key
- it: should pass with envs defined with valueFrom secretKeyRef from tpl
set:
name: some_name
key: some_key
env:
ENVVAR:
secretKeyRef:
name: "{{ .Values.name }}"
key: "{{ .Values.key }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
secretKeyRef:
name: some_name
key: some_key
- it: should pass with envs defined with valueFrom secretKeyRef with <optional> true
set:
env:
ENVVAR:
secretKeyRef:
name: some_name
key: some_key
optional: true
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
secretKeyRef:
optional: true
name: some_name
key: some_key
- it: should pass with envs defined with valueFrom secretKeyRef with <optional> false
set:
env:
ENVVAR:
secretKeyRef:
name: some_name
key: some_key
optional: false
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.containers[0].env
value:
- name: TZ
value: "UTC"
- name: UMASK
value: "2"
- name: UMASK_SET
value: "2"
- name: NVIDIA_VISIBLE_DEVICES
value: "void"
- name: S6_READ_ONLY_ROOT
value: "1"
- name: ENVVAR
valueFrom:
secretKeyRef:
optional: false
name: some_name
key: some_key
library/common-test/tests/pod/deployment_container_securityContext_test.yaml
+8
View File
@@ -68,6 +68,7 @@ tests:
runAsUser: 0
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true
- it: should fail with securityContext changed, runAsNonRoot true and runAsGroup 0
@@ -78,6 +79,7 @@ tests:
runAsUser: 0
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true
- it: should fail with securityContext changed and runAsNonRoot set to a non-bool value
@@ -86,6 +88,7 @@ tests:
runAsNonRoot: non-bool
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: One or more of the following are not set as booleans (runAsNonRoot, privileged, readOnlyRootFilesystem, allowPrivilegeEscalation)
- it: should fail with securityContext changed and privileged set to a non-bool value
@@ -94,6 +97,7 @@ tests:
privileged: non-bool
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: One or more of the following are not set as booleans (runAsNonRoot, privileged, readOnlyRootFilesystem, allowPrivilegeEscalation)
- it: should fail with securityContext changed and readOnlyRootFilesystem set to a non-bool value
@@ -102,6 +106,7 @@ tests:
readOnlyRootFilesystem: non-bool
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: One or more of the following are not set as booleans (runAsNonRoot, privileged, readOnlyRootFilesystem, allowPrivilegeEscalation)
- it: should fail with securityContext changed and allowPrivilegeEscalation set to a non-bool value
@@ -110,6 +115,7 @@ tests:
allowPrivilegeEscalation: non-bool
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: One or more of the following are not set as booleans (runAsNonRoot, privileged, readOnlyRootFilesystem, allowPrivilegeEscalation)
- it: should fail with securityContext changed and capabilities.add is not a list
@@ -119,6 +125,7 @@ tests:
add: non-a-list
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Either <add> or <drop> capabilities is not a list.
- it: should fail with securityContext changed and capabilities.drop is not a list
@@ -128,4 +135,5 @@ tests:
drop: non-a-list
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Either <add> or <drop> capabilities is not a list.
library/common-test/tests/pod/deployment_controller_test.yaml
+10 -8
View File
@@ -27,6 +27,14 @@ tests:
documentIndex: *deploymentDoc
path: spec.strategy.rollingUpdate
- it: should pass with controller disabled
set:
controller:
enabled: false
asserts:
- hasDocuments:
count: 0
- it: should pass with controller strategy changed and rollingUpdate strategies set
set:
controller:
@@ -46,14 +54,6 @@ tests:
maxUnavailable: 2
maxSurge: 3
- it: should pass with controller disabled
set:
controller:
enabled: false
asserts:
- hasDocuments:
count: 0
- it: should pass with controller strategy changed
set:
controller:
@@ -73,6 +73,7 @@ tests:
type: not_valid_controller
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Not a valid controller.type (not_valid_controller)
- it: should fail with wrong strategy
@@ -81,4 +82,5 @@ tests:
strategy: not_valid_strategy
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Not a valid strategy type for Deployment (not_valid_strategy)
library/common-test/tests/pod/deployment_volume_test.yaml
+44
View File
@@ -8,6 +8,7 @@ tests:
isKind:
of: Deployment
- isNull:
documentIndex: *deploymentDoc
path: spec.template.spec.volume
- it: should pass with added emptyDir volume
@@ -19,6 +20,7 @@ tests:
sizeLimit: 1Gi
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -33,6 +35,7 @@ tests:
type: emptyDir
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -48,6 +51,7 @@ tests:
sizeLimit: 1Gi
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -67,6 +71,7 @@ tests:
sizeLimit: "{{ .Values.some_size }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -83,6 +88,7 @@ tests:
medium: Memory
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -98,6 +104,7 @@ tests:
medium: not_memory
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: You can only set medium as (Memory)
- it: should pass with added nfs
@@ -110,6 +117,7 @@ tests:
path: /nfs/path
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -126,6 +134,7 @@ tests:
hostPath: /mnt/pool/test
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -143,6 +152,7 @@ tests:
hostPath: /mnt/pool/test
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: volume1
@@ -158,6 +168,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: Not a valid persistence.type (not_valid_persistence)
- it: should fail with not set objectName on configMaps
@@ -168,6 +179,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: objectName not set for persistence item some_volume
- it: should fail with not set objectName on secrets
@@ -178,6 +190,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: objectName not set for persistence item some_volume
- it: should fail with not set path on hostPath
@@ -188,6 +201,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: hostPath not set on item some_volume
- it: should fail with not set server on nfs
@@ -199,6 +213,7 @@ tests:
path: some_path
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: NFS Server not set on item some_volume
- it: should fail with not set path on nfs
@@ -210,6 +225,7 @@ tests:
server: some_server
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: NFS Path not set on item some_volume
- it: should fail with not set objectName on secret
@@ -220,6 +236,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: objectName not set for persistence item some_volume
- it: should fail with not set objectName on configmap
@@ -230,6 +247,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: objectName not set for persistence item some_volume
- it: should pass with added secret
@@ -241,6 +259,7 @@ tests:
objectName: some_object_name
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -257,6 +276,7 @@ tests:
defaultMode: 777
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -274,6 +294,7 @@ tests:
defaultMode: "777"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -292,6 +313,7 @@ tests:
defaultMode: "{{ .Values.mode }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -310,6 +332,7 @@ tests:
defaultMode: "{{ .Values.mode }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -328,6 +351,7 @@ tests:
- path: some_path
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: No key was given for persistence item some_volume
- it: should fail with added secret and no path on items
@@ -341,6 +365,7 @@ tests:
- key: some_key
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: No path was given for persistence item some_volume
- it: should pass with added secret and items
@@ -355,6 +380,7 @@ tests:
path: some_path
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -378,6 +404,7 @@ tests:
path: "{{ .Values.path }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -395,6 +422,7 @@ tests:
enabled: true
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: objectName not set for persistence item some_volume
- it: should pass with added configMap
@@ -406,6 +434,7 @@ tests:
objectName: some_object_name
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -422,6 +451,7 @@ tests:
defaultMode: 777
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -439,6 +469,7 @@ tests:
defaultMode: "777"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -457,6 +488,7 @@ tests:
defaultMode: "{{ .Values.mode }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -475,6 +507,7 @@ tests:
defaultMode: "{{ .Values.mode }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -494,6 +527,7 @@ tests:
path: some_path
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -514,6 +548,7 @@ tests:
- path: some_path
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: No key was given for persistence item some_volume
- it: should fail with added configMap and no path on items
@@ -527,6 +562,7 @@ tests:
- key: some_key
asserts:
- failedTemplate:
documentIndex: *deploymentDoc
errorMessage: No path was given for persistence item some_volume
- it: should pass with added configMap and items from tpl
@@ -543,6 +579,7 @@ tests:
path: "{{ .Values.path }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -560,6 +597,7 @@ tests:
enabled: true
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -575,6 +613,7 @@ tests:
existingClaim: some_existing_claim
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -591,6 +630,7 @@ tests:
existingClaim: "{{ .Values.claim }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -606,6 +646,7 @@ tests:
nameOverride: some_claim
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -622,6 +663,7 @@ tests:
nameOverride: "{{ .Values.claim }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -637,6 +679,7 @@ tests:
forceName: forced_name
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
@@ -653,6 +696,7 @@ tests:
forceName: "{{ .Values.claim }}"
asserts:
- equal:
documentIndex: *deploymentDoc
path: spec.template.spec.volumes[0]
value:
name: some_volume
library/common/1.0.0/templates/lib/controller/_securityContext.tpl → library/common/1.0.0/templates/lib/container/_securityContext.tpl
+1 -1
View File
@@ -1,5 +1,5 @@
{{/* Security Context included by the container */}}
{{- define "ix.v1.common.controller.securityContext" -}}
{{- define "ix.v1.common.container.securityContext" -}}
{{- $secContext := .Values.securityContext -}}
{{- $podSecContext := .Values.podSecurityContext -}}
{{/* Check that they are set as booleans to prevent typos */}}
library/common/1.0.0/templates/lib/controller/_container.tpl
+31 -21
View File
@@ -39,7 +39,7 @@
stdin: false
{{- end }}
securityContext:
{{- include "ix.v1.common.controller.securityContext" . | nindent 4 }}
{{- include "ix.v1.common.container.securityContext" . | nindent 4 }}
{{- with .Values.lifecycle }}
lifecycle:
{{- tpl (toYaml .) $ | nindent 4 }}
@@ -82,31 +82,41 @@
- name: S6_READ_ONLY_ROOT
value: "1"
{{- end }}
{{- with .Values.env }}
{{/*TODO: Remove some ways to set envs, not need to have a ton of them, only those that are needed*/}}
{{- range $k, $v := . }}
{{- $name := $k }}
{{- $value := $v }}
{{- if kindIs "int" $name }}
{{/*TODO: write tests*/}}
{{- $name = required (printf "Environment Variables as a list of dicts, require a name field (%s)" $name) $value.name }}
{{- with .Values.env -}}
{{- range $k, $v := . -}}
{{- $name := $k -}}
{{- $value := $v -}}
{{- if kindIs "int" $name -}}
{{- fail "Environment Variables as a list is not supported. Use key-value format." -}}
{{- end }}
- name: {{ $name | quote }}
{{- if kindIs "map" $value }}
{{- if hasKey $value "value" }}
{{- $value = $value.value }}
{{- else if hasKey $value "valueFrom" }}
{{/*TODO: write tests*/}}
valueFrom: {{- tpl (toYaml $value.valueFrom) $ | nindent 8 }}
{{- else }}
valueFrom: {{- tpl (toYaml $value) $ | nindent 8 }}
{{- end }}
{{- end }}
{{- if not (kindIs "map" $value) }}
{{- if kindIs "string" $value }}
{{- $value = tpl $value $ }}
{{- if or (kindIs "string" $value) }} {{/* Single values are parsed as string (eg. int, bool) */}}
{{- $value = tpl $value $ }} {{/* Expand Value */}}
{{- end }}
value: {{ quote $value }}
{{- else if kindIs "map" $value }} {{/* If value is a dict... */}}
valueFrom:
{{- if hasKey $value "configMapKeyRef" }} {{/* And contains configMapRef... */}}
configMapKeyRef:
{{- $_ := set $value "name" $value.configMapKeyRef.name -}} {{/* Extract name and key */}}
{{- $_ := set $value "key" $value.configMapKeyRef.key -}}
{{- else if hasKey $value "secretKeyRef" }} {{/* And contains secretpRef... */}}
secretKeyRef:
{{- $_ := set $value "name" $value.secretKeyRef.name -}} {{/* Extract name and key */}}
{{- $_ := set $value "key" $value.secretKeyRef.key -}}
{{- if (hasKey $value.secretKeyRef "optional") }}
{{- if (kindIs "bool" $value.secretKeyRef.optional) }}
optional: {{ $value.secretKeyRef.optional }}
{{- else }}
{{- fail (printf "<optional> in secretKeyRef must be a boolean on Environment Variable (%s)" $name) -}}
{{- end }}
{{- end }}
{{- else }}
{{ fail "Not a valid valueFrom reference. Valid options are (configMapKeyRef and secretKeyRef)"}}
{{- end }}
name: {{ tpl (required (printf "<name> for the keyRef is not defined in (%s)" $name) $value.name) $ }} {{/* Expand name and key */}}
key: {{ tpl (required (printf "<key> for the keyRef is not defined in (%s)" $name) $value.key) $ }}
{{- end }}
{{- end }}
{{- end }}
library/common/1.0.0/values.yaml
+6 -16
View File
@@ -87,24 +87,14 @@ security:
PUID: 568
UMASK: 002
# -- Main environment variables. Template enabled.
# -- Main environment variables. Helm Template enabled.
# Syntax options:
# A) TZ: UTC
# B) PASSWD: '{{ .Release.Name }}'
# C) PASSWD:
# configMapKeyRef:
# name: config-map-name
# key: key-name
# D) PASSWD:
# valueFrom:
# secretKeyRef:
# name: secret-name
# key: key-name
# ...
# E) - name: TZ
# value: UTC
# F) - name: TZ
# value: '{{ .Release.Name }}'
# B) ENV_VAR: "{{ .Release.Name }}"
# C) ENV_VAR:
# configMapKeyRef | secretKeyRef:
# name: object-name | "{{ .Values.objectName }}"
# key: key-name | "{{ .Values.some_key }}"
env: {}
controller: