apache / apache/pulsar-helm-chart

Kubernetes compliant token secret name as volume mounts

Open
#327 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
240
Forks
260
Avg merge
4h 12m
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
At the moment the charts render the token secret volume directly derived from .Values.auth.superUsers.x for the [broker](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/broker-statefulset.yaml#L280), the [proxy-](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/proxy-statefulset.yaml#L264) and the [toolset-](https://github.com/apache/pulsar-helm-chart/blob/816d88c942e5f1d13e1f11d67708dd16aa02c388/charts/pulsar/templates/toolset-statefulset.yaml#L109)stateful sets.

Because the superUsers configuration represents a token subscription that is issued by an IDP there is no control over the syntax of this value. e.g. "sub": "NR_CO_PROD_ADM_M2M-T"

For values not compliant to Kubernetes metadata.name syntax value will break the deployment.

**Describe the solution you'd like**
To add more robustness I propose to introduce a simple transformation to lowercase + kebabcase like:

```helm
secretName: "{{ .Release.Name }}-token-{{ .Values.auth.superUsers.broker | lower | kebabcase }}"
```

This will cover most of the edge cases.

**Describe alternatives you've considered**
A even more generic approach to make the configured string value metadata.name compliant. Not aware of any.

**Additional context**
Deployments fails by try to mount a volume secret named like

```yaml
- name: client-token
secret:
secretName: pulsar-token-NR_CO_PROD_ADM_M2M-T
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect broker-statefulset.yaml, proxy-statefulset.yaml, and toolset-statefulset.yaml at the volume mount sections linked in the issue. Render the charts with a superUsers value such as NR_CO_PROD_ADM_M2M-T and verify that the generated secret names are Kubernetes-compliant for all three StatefulSets.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.