chore(charts): allow using existing secrets

charts/substra-backend/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 <!-- towncrier release notes start -->
 
+## [26.8.0] - 2024-07-05
+
+### Added
+
+- Allow using existing secrets for accountOperators, postgres, redis and objectstore
+
+### Changed
+
+- `database.auth.credentialsSecretName` is now `database.auth.existingSecretName`
+
 ## [26.7.5] - 2024-06-29
 
 ### Added

charts/substra-backend/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: substra-backend
 home: https://github.com/Substra
-version: 26.7.5
+version: "26.8.0"
 appVersion: 0.47.0
 kubeVersion: ">= 1.19.0-0"
 description: Main package for Substra

charts/substra-backend/README.md

@@ -325,11 +325,12 @@ See [UPGRADE.md](https://github.com/Substra/substra-backend/blob/main/charts/sub
 
 ### Account operator settings
 
-| Name                                       | Description                                                                                        | Value |
-| ------------------------------------------ | -------------------------------------------------------------------------------------------------- | ----- |
-| `addAccountOperator.outgoingOrganizations` | Outgoind organizations credentials for substra backend organization-to-organization communications | `[]`  |
-| `addAccountOperator.incomingOrganizations` | Incoming organizations credentials for substra backend organization-to-organization communications | `[]`  |
-| `addAccountOperator.users`                 | A list of administrators users who can log into the substra backend server with admin privileges   | `[]`  |
+| Name                                       | Description                                                                                                                                                                                  | Value |
+| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| `addAccountOperator.outgoingOrganizations` | Outgoing organizations credentials for substra backend organization-to-organization communications                                                                                           | `[]`  |
+| `addAccountOperator.incomingOrganizations` | Incoming organizations credentials for substra backend organization-to-organization communications                                                                                           | `[]`  |
+| `addAccountOperator.users`                 | A list of administrators users who can log into the substra backend server with admin privileges                                                                                             | `[]`  |
+| `addAccountOperator.existingSecretName`    | An alternative to providing credentials for organization-to-organization communications and users ; secret must have the `users`, `incoming_organizations` and `outgoing_organizations` keys | `""`  |
 
 ### Registry prepopulate
 
@@ -376,24 +377,25 @@ Else, you must strike a balance: longer durations are more convenient, but risk
 
 ### Database connection settings
 
-| Name                                  | Description                                                                                                 | Value      |
-| ------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------- |
-| `database.auth.database`              | what DB to connect to                                                                                       | `substra`  |
-| `database.auth.username`              | what user to connect as                                                                                     | `postgres` |
-| `database.auth.password`              | what password to use for connecting                                                                         | `postgres` |
-| `database.auth.credentialsSecretName` | An alternative to giving username and password; must have `DATABASE_USERNAME` and `DATABASE_PASSWORD` keys. | `nil`      |
-| `database.host`                       | Hostname of the database to connect to (defaults to local)                                                  | `nil`      |
-| `database.port`                       | Port of an external database to connect to                                                                  | `5432`     |
+| Name                               | Description                                                                                                 | Value      |
+| ---------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------- |
+| `database.auth.database`           | what DB to connect to                                                                                       | `substra`  |
+| `database.auth.username`           | what user to connect as                                                                                     | `postgres` |
+| `database.auth.password`           | what password to use for connecting                                                                         | `postgres` |
+| `database.auth.existingSecretName` | An alternative to giving username and password; must have `DATABASE_USERNAME` and `DATABASE_PASSWORD` keys. | `""`       |
+| `database.host`                    | Hostname of the database to connect to (defaults to local)                                                  | `nil`      |
+| `database.port`                    | Port of an external database to connect to                                                                  | `5432`     |
 
 ### PostgreSQL settings
 
 Database included as a subchart used by default.
 
 See Bitnami documentation: https://bitnami.com/stack/postgresql/helm
 
-| Name                 | Description                                                | Value  |
-| -------------------- | ---------------------------------------------------------- | ------ |
-| `postgresql.enabled` | Deploy a PostgreSQL instance along the backend for its use | `true` |
+| Name                               | Description                                                                                                         | Value  |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------ |
+| `postgresql.enabled`               | Deploy a PostgreSQL instance along the backend for its use                                                          | `true` |
+| `database.auth.existingSecretName` | An alternative to giving username and password; must have `OBJECTSTORE_ACCESSKEY` and `OBJECTSTORE_SECRETKEY` keys. | `""`   |
 
 ### Helm hooks
 

charts/substra-backend/templates/_helpers.tpl

@@ -216,14 +216,6 @@ example:
 {{- end -}}
 
 
-{{- define "substra-backend.database.secret-name" -}}
-    {{- if .Values.database.auth.credentialsSecretName -}}
-        {{- .Values.database.auth.credentialsSecretName }}
-    {{- else -}}
-        {{- template "substra.fullname" . }}-database
-    {{- end -}}
-{{- end -}}
-
 {{/*
 The hostname we should connect to (external is defined, otherwise integrated)
 */}}
@@ -331,7 +323,7 @@ The hostname we should connect to (external is defined, otherwise integrated)
   - configMapRef:
       name: {{ include "substra.fullname" . }}-settings
   - secretRef:
-      name: {{ include "substra-backend.database.secret-name" . }}
+      name: {{ include "substra-backend.database.secretName" . }}
   env:
   - name: DJANGO_SETTINGS_MODULE
     value: backend.settings.{{ .Values.settings }}
@@ -371,7 +363,6 @@ Define service port based on MinIO or LocalStack enablement
     {{- end -}}
 {{- end -}}
 
-
 {{/*
 Define objectstore access key based on MinIO or LocalStack enablement
 */}}
@@ -408,3 +399,47 @@ Retrieve AWS environment variable value
 {{- end -}}
 {{- $value -}}
 {{- end -}}
+
+{{/*
+Define database secret name
+*/}}
+{{- define "substra-backend.database.secretName" -}}
+    {{- if .Values.database.auth.existingSecretName -}}
+        {{- .Values.database.auth.existingSecretName }}
+    {{- else -}}
+        {{ include "substra.fullname" . }}-database
+    {{- end -}}
+{{- end -}}
+
+{{/*
+Define redis secret name
+*/}}
+{{- define "substra-backend.redis.secretName" -}}
+    {{- if .Values.redis.auth.existingSecretName -}}
+        {{- .Values.database.auth.existingSecretName }}
+    {{- else -}}
+        {{ include "substra.fullname" . }}-redis
+    {{- end -}}
+{{- end -}}
+
+{{/*
+Define account operators secret name
+*/}}
+{{- define "substra-backend.accountOperator.secretName" -}}
+    {{- if .Values.addAccountOperator.existingSecretName -}}
+        {{- .Values.database.auth.existingSecretName }}
+    {{- else -}}
+        {{ include "substra.fullname" . }}-add-account
+    {{- end -}}
+{{- end -}}
+
+{{/*
+Define object store secret name
+*/}}
+{{- define "substra-backend.objectStore.secretName" -}}
+    {{- if .Values.redis.auth.existingSecretName -}}
+        {{- .Values.database.auth.existingSecretName }}
+    {{- else -}}
+        {{ include "substra.fullname" . }}-objectstore
+    {{- end -}}
+{{- end -}}

charts/substra-backend/templates/deployment-api-events.yaml

@@ -72,9 +72,9 @@ spec:
             - configMapRef:
                 name: {{ include "substra.fullname" . }}-redis
             - secretRef:
-                name: {{ include "substra.fullname" . }}-redis
+                name: {{ include "substra-backend.redis.secretName" . }}
             - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+                name: {{ include "substra-backend.database.secretName" . }}
           readinessProbe:
             exec:
               command:

charts/substra-backend/templates/deployment-scheduler-worker.yaml

@@ -72,9 +72,9 @@ spec:
             - configMapRef:
                 name: {{ include "substra.fullname" . }}-registry
             - secretRef:
-                name: {{ include "substra.fullname" . }}-redis
+                name: {{ include "substra-backend.redis.secretName" . }}
             - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+                name: {{ include "substra-backend.database.secretName" . }}
           env:
             - name: NAMESPACE
               valueFrom:

charts/substra-backend/templates/deployment-scheduler.yaml

@@ -69,9 +69,9 @@ spec:
             - configMapRef:
                 name: {{ include "substra.fullname" . }}-registry
             - secretRef:
-                name: {{ include "substra.fullname" . }}-redis
+                name: {{ include "substra-backend.objectStore.secretName" . }}
             - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+                name: {{ include "substra-backend.database.secretName" . }}
           env:
             - name: NAMESPACE
               valueFrom:

charts/substra-backend/templates/deployment-server.yaml

@@ -70,13 +70,13 @@ spec:
           - configMapRef:
               name: {{ include "substra.fullname" . }}-orchestrator
           - secretRef:
-              name: {{ include "substra.fullname" . }}-objectstore
+              name: {{ include "substra-backend.objectStore.secretName" . }}
           - configMapRef:
               name: {{ include "substra.fullname" . }}-settings
           - configMapRef:
               name: {{ include "substra.fullname" . }}-database
           - secretRef:
-              name: {{ include "substra-backend.database.secret-name" . }}
+              name: {{ include "substra-backend.database.secretName" . }}
           - secretRef:
               name: {{ include "substra.fullname" . }}-server-key
           - configMapRef:
@@ -230,13 +230,13 @@ spec:
           - configMapRef:
               name: {{ include "substra.fullname" . }}-orchestrator
           - secretRef:
-              name: {{ include "substra.fullname" . }}-objectstore
+              name: {{ include "substra-backend.objectStore.secretName" . }}
           - configMapRef:
               name: {{ include "substra.fullname" . }}-database
           - configMapRef:
               name: {{ include "substra.fullname" . }}-settings
           - secretRef:
-              name: {{ include "substra-backend.database.secret-name" . }}
+              name: {{ include "substra-backend.database.secretName" . }}
         env:
         - name: DJANGO_SETTINGS_MODULE
           value: backend.settings.{{ .Values.settings }}

charts/substra-backend/templates/deployment-worker-events.yaml

@@ -74,9 +74,9 @@ spec:
             - configMapRef:
                 name: {{ include "substra.fullname" . }}-redis
             - secretRef:
-                name: {{ include "substra.fullname" . }}-redis
+                name: {{ include "substra-backend.redis.secretName" . }}
             - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+                name: {{ include "substra-backend.database.secretName" . }}
           readinessProbe:
             exec:
               command:

charts/substra-backend/templates/job-migrations.yaml

@@ -77,7 +77,7 @@ spec:
           - configMapRef:
               name: {{ include "substra.fullname" . }}-database
           - secretRef:
-              name: {{ include "substra-backend.database.secret-name" . }}
+              name: {{ include "substra-backend.database.secretName" . }}
         env:
           - name: DJANGO_SETTINGS_MODULE
             value: backend.settings.{{ .Values.settings }}
@@ -88,4 +88,4 @@ spec:
       volumes:
         - name: accounts
           secret:
-            secretName: {{ template "substra.fullname" . }}-add-account
+            secretName: {{ include "substra-backend.accountOperator.secretName" . }}

charts/substra-backend/templates/secret-add-account.yaml

@@ -1,11 +1,13 @@
+{{- if not .Values.addAccountOperator.existingSecretName }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "substra.fullname" . }}-add-account
+  name: {{ template "substra-backend.accountOperator.secretName" . }}
   labels:
     {{ include "substra.labels" . | nindent 4 }}
     app.kubernetes.io/name: {{ include "substra.name" . }}-add-account
 data:
   users: {{ include "common.users" .Values.addAccountOperator.users | b64enc | quote }}
   incoming_organizations: {{ include "common.users" .Values.addAccountOperator.incomingOrganizations | b64enc | quote }}
   outgoing_organizations: {{ include "common.users" .Values.addAccountOperator.outgoingOrganizations | b64enc | quote }}
+{{- end }}

charts/substra-backend/templates/secret-database.yaml

@@ -1,12 +1,12 @@
-{{- if not .Values.database.auth.credentialsSecretName }}
+{{- if not .Values.database.auth.existingSecretName }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "substra.fullname" . }}-database
+  name: {{ template "substra-backend.database.secretName" . }}
   labels:
   {{- include "substra.labels" . | nindent 4 }}
 type: Opaque
-stringData:
-  DATABASE_PASSWORD: {{ .Values.database.auth.password | quote }}
-  DATABASE_USERNAME: {{ .Values.database.auth.username | quote }}
-{{- end }}
+data:
+  DATABASE_PASSWORD: {{ .Values.database.auth.password | b64enc | quote }}
+  DATABASE_USERNAME: {{ .Values.database.auth.username | b64enc | quote }}
+{{- end }}

charts/substra-backend/templates/secret-objectstore.yaml

@@ -1,11 +1,13 @@
+{{- if or (not .Values.minio.auth.existingSecretName) .Values.localstack.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "substra.fullname" . }}-objectstore
+  name: {{ template "substra-backend.objectStore.secretName" . }}
   labels:
     {{ include "substra.labels" . | nindent 4 }}
     app.kubernetes.io/name: {{ include "substra.name" . }}
 type: Opaque
 data:
   OBJECTSTORE_ACCESSKEY: {{ include "substra-backend.objectStore.accessKey" . | b64enc }}
   OBJECTSTORE_SECRETKEY: {{ include "substra-backend.objectStore.secretKey" . | b64enc }}
+{{- end }}

charts/substra-backend/templates/secret-redis.yaml

@@ -1,9 +1,11 @@
+{{- if not .Values.redis.auth.existingSecretName }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "substra.fullname" . }}-redis
+  name: {{ template "substra-backend.redis.secretName" . }}
   labels:
   {{- include "substra.labels" . | nindent 4 }}
 type: Opaque
 data:
   CELERY_BROKER_PASSWORD: {{ .Values.redis.auth.password | b64enc | quote }}
+{{- end }}

charts/substra-backend/templates/statefulset-builder.yaml

@@ -146,12 +146,12 @@ spec:
           - configMapRef:
                 name: {{ include "substra.fullname" . }}-database
           - secretRef:
-              name: {{ include "substra.fullname" . }}-objectstore
+              name: {{ include "substra-backend.objectStore.secretName" . }}
           - secretRef:
-              name: {{ include "substra.fullname" . }}-redis
+              name: {{ include "substra-backend.redis.secretName" . }}
           # TODO: Remove once moved ImageResitryEntrypoint logic
           - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+              name: {{ include "substra-backend.database.secretName" . }}
         env:
           - name: HOST_IP
             valueFrom:

charts/substra-backend/templates/statefulset-worker.yaml

@@ -102,11 +102,11 @@ spec:
             - configMapRef:
                 name: {{ include "substra.fullname" . }}-registry
             - secretRef:
-                name: {{ include "substra.fullname" . }}-objectstore
+                name: {{ include "substra-backend.objectStore.secretName" . }}
             - secretRef:
-                name: {{ include "substra.fullname" . }}-redis
+                name: {{ include "substra-backend.redis.secretName" . }}
             - secretRef:
-                name: {{ include "substra-backend.database.secret-name" . }}
+                name: {{ include "substra-backend.database.secretName" . }}
           env:
             - name: DJANGO_SETTINGS_MODULE
               value: backend.settings.celery.{{ .Values.settings }}