add userlog_global_notifications_secret (#400)

* add userlog_global_notifications_secret * add secrets for userlog * add secrets for userlog * add secret options * fix notifications secrets * fix notifications secrets * fix notifications secrets * add docs
owncloud · Oct 17, 2023 · ebb8584 · DaDummy · Oct 29, 2023 · d7oc
1 parent 5c854bc
commit ebb8584
Show file tree

Hide file tree

Showing 5 changed files with 30 additions and 5 deletions.
diff --git a/charts/ocis/docs/values-desc-table.adoc b/charts/ocis/docs/values-desc-table.adoc
@@ -984,6 +984,12 @@ a| [subs=-attributes]
 a| [subs=-attributes]
 `""`
 | Reference to an existing keycloak client secret, used for the GDPR export. Only used if features.externalUserManagement.gdprExport.enabled equals true.
+| secretRefs.globalNotificationsSecretRef
+a| [subs=-attributes]
++string+
+a| [subs=-attributes]
+`""`
+| The secret to secure the global notifications endpoint. Only system admins and users knowing that secret can call the global notifications POST/DELETE endpoints.
 | secretRefs.idpSecretRef
 a| [subs=-attributes]
 +string+

diff --git a/charts/ocis/docs/values.adoc.yaml b/charts/ocis/docs/values.adoc.yaml
@@ -568,6 +568,8 @@ secretRefs:
   # -- Reference to an existing s3 secret (see xref:{secrets}[Secrets])
   # If not filled in, will attempt to use values in `.storageusers.storageBackend.s3.driverConfig.s3ng` instead.
   s3CredentialsSecretRef: ""
+  # -- The secret to secure the global notifications endpoint. Only system admins and users knowing that secret can call the global notifications POST/DELETE endpoints.
+  globalNotificationsSecretRef: ""
 
 # Security context options.
 securityContext:
@@ -670,13 +672,15 @@ jobNodeSelector:
   # kubernetes.io/arch: "amd64"
 
 # -- Default priorityClassName to apply to all services, except per-service jobPriorityClassName configuration in `services.<service-name>.jobPriorityClassName` is set.
-jobPriorityClassName: ""
+jobPriorityClassName:
+  ""
   # ocis-low-priority
   # ocis-medium-priority
   # ocis-high-priority
 
 # -- Default priorityClassName to apply to all services, except per-service priorityClassName configuration in `services.<service-name>.priorityClassName` is set.
-priorityClassName: ""
+priorityClassName:
+  ""
   # ocis-low-priority
   # ocis-medium-priority
   # ocis-high-priority

diff --git a/charts/ocis/templates/_common/_configvalues.tpl b/charts/ocis/templates/_common/_configvalues.tpl
@@ -36,6 +36,10 @@ All take the scope as the first and only parameter.
 {{ .Values.secretRefs.machineAuthApiKeySecretRef | default "machine-auth-api-key" | quote }}
 {{- end -}}
 
+{{- define "secrets.globalNotificationsSecret" -}}
+{{ required "messagingSystemCASecret can't be autogenerated" .Values.secretRefs.globalNotificationsSecretRef | quote }}
+{{- end -}}
+
 {{- define "secrets.messagingSystemCASecret" -}}
 {{ required "messagingSystemCASecret can't be autogenerated" .Values.secretRefs.messagingSystemCaRef | quote }}
 {{- end -}}

diff --git a/charts/ocis/templates/userlog/deployment.yaml b/charts/ocis/templates/userlog/deployment.yaml
@@ -26,7 +26,6 @@ spec:
           {{- include "ocis.containerSecurityContext" . | nindent 10 }}
           env:
             {{- include "ocis.serviceRegistry" . | nindent 12 }}
-
             - name: USERLOG_LOG_COLOR
               value: {{ .Values.logging.color | quote }}
             - name: USERLOG_LOG_LEVEL
@@ -83,6 +82,14 @@ spec:
                   name: {{ include "secrets.machineAuthAPIKeySecret" . }}
                   key: machine-auth-api-key
 
+            {{- if .Values.secretRefs.globalNotificationsSecretRef }}
+            - name: USERLOG_GLOBAL_NOTIFICATIONS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "secrets.globalNotificationsSecret" . }}
+                  key: notifications-secret
+            {{- end }}
+
             - name: USERLOG_JWT_SECRET
               valueFrom:
                 secretKeyRef:

diff --git a/charts/ocis/values.yaml b/charts/ocis/values.yaml
@@ -567,6 +567,8 @@ secretRefs:
   # -- Reference to an existing s3 secret (see ref:Secrets#secrets)
   # If not filled in, will attempt to use values in `.storageusers.storageBackend.s3.driverConfig.s3ng` instead.
   s3CredentialsSecretRef: ""
+  # -- The secret to secure the global notifications endpoint. Only system admins and users knowing that secret can call the global notifications POST/DELETE endpoints.
+  globalNotificationsSecretRef: ""
 
 # Security context options.
 securityContext:
@@ -669,13 +671,15 @@ jobNodeSelector:
   # kubernetes.io/arch: "amd64"
 
 # -- Default priorityClassName to apply to all services, except per-service jobPriorityClassName configuration in `services.<service-name>.jobPriorityClassName` is set.
-jobPriorityClassName: ""
+jobPriorityClassName:
+  ""
   # ocis-low-priority
   # ocis-medium-priority
   # ocis-high-priority
 
 # -- Default priorityClassName to apply to all services, except per-service priorityClassName configuration in `services.<service-name>.priorityClassName` is set.
-priorityClassName: ""
+priorityClassName:
+  ""
   # ocis-low-priority
   # ocis-medium-priority
   # ocis-high-priority