apache / apache/pulsar-helm-chart
Kubernetes compliant token secret name as volume mounts
- Dominant language
- Shell
- Stars
- 240
- Forks
- 260
- Avg merge
- 4h 12m
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
At the moment the charts render the token secret volume directly derived from .Values.auth.superUsers.x for the [broker](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/broker-statefulset.yaml#L280), the [proxy-](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/proxy-statefulset.yaml#L264) and the [toolset-](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/toolset-statefulset.yaml#L109)stateful sets.
Because the superUsers configuration represents a token subscription that is issued by an IDP there is no control over the syntax of this value. e.g. "sub": "NR_CO_PROD_ADM_M2M-T"
For values not compliant to Kubernetes metadata.name syntax value will break the deployment.
**Describe the solution you'd like**
To add more robustness I propose to introduce a simple transformation to lowercase + kebabcase like:
```helm
secretName: "{{ .Release.Name }}-token-{{ .Values.auth.superUsers.broker | lower | kebabcase }}"
```
This will cover most of the edge cases.
**Describe alternatives you've considered**
A even more generic approach to make the configured string value metadata.name compliant. Not aware of any.
**Additional context**
Deployments fails by try to mount a volume secret named like
```yaml
- name: client-token
secret:
secretName: pulsar-token-NR_CO_PROD_ADM_M2M-T
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect broker-statefulset.yaml, proxy-statefulset.yaml, and toolset-statefulset.yaml at the volume mount sections linked in the issue. Render the charts with a superUsers value such as NR_CO_PROD_ADM_M2M-T and verify that the generated secret names are Kubernetes-compliant for all three StatefulSets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100