[SC-31363] - Let use an existing secret that store credentials#15
[SC-31363] - Let use an existing secret that store credentials#15psokolinski merged 2 commits intomainfrom
Conversation
WalkthroughAdds optional secret-based auth via Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User
participant Helm as Helm (install/upgrade)
participant Chart as jit-k8s-agent Chart
participant Val as validateValues tpl
participant K8s as Kubernetes API
User->>Helm: helm upgrade --install ...
Helm->>Chart: Render templates
Chart->>Val: include "jit-k8s-agent.validateValues"
alt Validation fails
Val-->>Helm: fail with aggregated errors
Helm-->>User: Render error (missing cluster.name / auth)
else Validation passes
Note over Chart: Determine secret name\n$jitCredentialsSecret
alt .Values.jit.existingSecret set
Chart-->>K8s: Skip creating Secret
else No existingSecret
Chart->>K8s: Create Secret with clientId/clientSecret
end
Chart->>K8s: Create Job/Pod spec\n- secretRef: $jitCredentialsSecret\n- optional nodeSelector\n- optional tolerations
K8s-->>User: Resources applied
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🧰 Additional context used🪛 YAMLlint (1.37.1)charts/jit-k8s-agent/templates/secret.yaml[error] 1-1: syntax error: expected the node content, but found '-' (syntax) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🔇 Additional comments (2)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
charts/jit-k8s-agent/README.md(1 hunks)charts/jit-k8s-agent/templates/_job_helper.tpl(2 hunks)charts/jit-k8s-agent/templates/_validation.tpl(1 hunks)charts/jit-k8s-agent/templates/secret.yaml(2 hunks)charts/jit-k8s-agent/values.schema.json(1 hunks)charts/jit-k8s-agent/values.yaml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
charts/jit-k8s-agent/templates/secret.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Iac Misconfig Detection Kubernetes
- GitHub Check: Jit Security
🔇 Additional comments (19)
charts/jit-k8s-agent/templates/secret.yaml (2)
1-1: LGTM!Including validation at the start of the template ensures configuration issues are caught early, preventing invalid deployments.
2-14: LGTM!The conditional rendering correctly prevents secret creation when
existingSecretis provided, avoiding conflicts with user-managed secrets.charts/jit-k8s-agent/README.md (3)
41-41: LGTM!The parameter documentation clearly describes the
existingSecretoption and properly cross-references the authentication note.
49-50: LGTM!The documentation for
nodeSelectorandtolerationsis clear and follows the existing table format consistently.
54-54: LGTM!The updated authentication note clearly explains both credential options (direct credentials or existing secret) and properly links to external documentation.
charts/jit-k8s-agent/templates/_job_helper.tpl (4)
2-2: LGTM!The computed secret name correctly prioritizes
existingSecretand falls back to the chart-generated secret name, ensuring consistency with the secret creation logic.
6-9: LGTM!The conditional
tolerationsblock is correctly structured with proper indentation for the pod spec level.
10-13: LGTM!The conditional
nodeSelectorblock follows the same pattern astolerationswith correct indentation and formatting.
31-31: LGTM!Using the computed
$jitCredentialsSecretvariable for both credential references ensures consistency and enables the existing-secret feature.Also applies to: 36-36
charts/jit-k8s-agent/values.yaml (2)
10-15: LGTM!The comments clearly distinguish the two authentication options and provide helpful inline guidance for users. The default values are appropriate.
31-35: LGTM!The
nodeSelectorandtolerationsfields are properly documented and have appropriate default values (empty map and array respectively).charts/jit-k8s-agent/templates/_validation.tpl (4)
1-5: LGTM!The template structure correctly initializes an error list for collecting validation failures.
7-9: LGTM!The
cluster.namevalidation correctly ensures this required field is provided.
25-38: LGTM!The error message construction provides clear, actionable guidance with examples for both authentication methods, improving user experience during misconfiguration.
40-40: LGTM!Template closure is correct.
charts/jit-k8s-agent/values.schema.json (4)
19-26: LGTM!The updated descriptions correctly reflect that
clientIdandclientSecretare conditionally required based on whetherexistingSecretis used.
27-34: LGTM!The new properties are properly typed and documented. The
existingSecretdescription correctly notes that it takes precedence over direct credentials.
36-36: LGTM!The
jitobject description clearly explains the two authentication options, matching the validation logic and documentation.
19-37: Approve JSON schema and template validation approach
Helm validates schemas before rendering; removingclientId/clientSecretfromrequiredlets the template-based checks enforce the either/or constraint correctly.
psokolinski
force-pushed
the
SC-31363-v2
branch
from
f8f700c to
43e6e4e
Compare
2 participants
This PR adds an option to use the existing secret instead of creating a new one to store the client ID and secret.
Tested and it is working.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation