From fbbf028c97fc23974a99b47cef9e80bcf396328f Mon Sep 17 00:00:00 2001 From: kilianpaquier Date: Tue, 23 Jun 2026 17:14:13 +0200 Subject: [PATCH] feat(config): add 'tpl' usage for alphaConfig.existingSecret, alphaConfig.existingConfig, config.existingConfig, podAnnotations and podLabels Signed-off-by: kilianpaquier --- helm/oauth2-proxy/Chart.yaml | 7 +++++- ...lphaconfig-tpl-existing-secret-values.yaml | 25 +++++++++++++++++++ .../config-tpl-existing-configmap-values.yaml | 17 +++++++++++++ .../ci/config-tpl-existing-secret-values.yaml | 18 +++++++++++++ helm/oauth2-proxy/ci/tpl-values.yaml | 6 +++++ helm/oauth2-proxy/templates/_helpers.tpl | 6 ++--- helm/oauth2-proxy/templates/deployment.yaml | 8 +++--- helm/oauth2-proxy/values.yaml | 9 +++++++ 8 files changed, 88 insertions(+), 8 deletions(-) create mode 100644 helm/oauth2-proxy/ci/alphaconfig-tpl-existing-secret-values.yaml create mode 100644 helm/oauth2-proxy/ci/config-tpl-existing-configmap-values.yaml create mode 100644 helm/oauth2-proxy/ci/config-tpl-existing-secret-values.yaml diff --git a/helm/oauth2-proxy/Chart.yaml b/helm/oauth2-proxy/Chart.yaml index ea2286b5..0cebfa66 100644 --- a/helm/oauth2-proxy/Chart.yaml +++ b/helm/oauth2-proxy/Chart.yaml @@ -1,5 +1,5 @@ name: oauth2-proxy -version: 10.7.0 +version: 10.9.0 apiVersion: v2 appVersion: 7.15.3 home: https://oauth2-proxy.github.io/oauth2-proxy/ @@ -40,3 +40,8 @@ annotations: links: - name: GitHub PR url: https://github.com/oauth2-proxy/manifests/pull/405 + - kind: added + description: Add 'tpl' usage for alphaConfig.existingSecret, alphaConfig.existingConfig, config.existingConfig, podAnnotations and podLabels + links: + - name: GitHub PR + url: https://github.com/oauth2-proxy/manifests/pull/418 diff --git a/helm/oauth2-proxy/ci/alphaconfig-tpl-existing-secret-values.yaml b/helm/oauth2-proxy/ci/alphaconfig-tpl-existing-secret-values.yaml new file mode 100644 index 00000000..f9c2336e --- /dev/null +++ b/helm/oauth2-proxy/ci/alphaconfig-tpl-existing-secret-values.yaml @@ -0,0 +1,25 @@ +# Test Case: alphaConfig enabled + existingSecret TPL +# Expected: Chart mounts the external alpha Secret instead of generating one. + +tplValue: prefix + +alphaConfig: + enabled: true + existingSecret: '{{ .Values.tplValue }}-alpha-secret' + +extraObjects: + - apiVersion: v1 + kind: Secret + metadata: + name: '{{ .Values.tplValue }}-alpha-secret' + type: Opaque + stringData: + oauth2_proxy.yml: | + --- + server: + BindAddress: 0.0.0.0:4180 + providers: + - id: google + provider: google + clientID: fake-client-id + clientSecret: fake-client-secret diff --git a/helm/oauth2-proxy/ci/config-tpl-existing-configmap-values.yaml b/helm/oauth2-proxy/ci/config-tpl-existing-configmap-values.yaml new file mode 100644 index 00000000..af0deedd --- /dev/null +++ b/helm/oauth2-proxy/ci/config-tpl-existing-configmap-values.yaml @@ -0,0 +1,17 @@ +# Test Case: config + existingConfig TPL +# Expected: Chart mounts the external config ConfigMap instead of generating one. + +tplValue: prefix + +config: + existingConfig: '{{ .Values.tplValue }}-config' + +extraObjects: + - apiVersion: v1 + kind: ConfigMap + metadata: + name: '{{ .Values.tplValue }}-config' + data: + oauth2_proxy.cfg: | + email_domains = [ "*" ] + upstreams = [ "file:///dev/null" ] diff --git a/helm/oauth2-proxy/ci/config-tpl-existing-secret-values.yaml b/helm/oauth2-proxy/ci/config-tpl-existing-secret-values.yaml new file mode 100644 index 00000000..55cffc09 --- /dev/null +++ b/helm/oauth2-proxy/ci/config-tpl-existing-secret-values.yaml @@ -0,0 +1,18 @@ +# Test Case: config + existingSecret TPL +# Expected: Chart mounts the external Secret instead of generating one. + +tplValue: prefix + +config: + existingSecret: '{{ .Values.tplValue }}-secret' + +extraObjects: + - apiVersion: v1 + kind: Secret + metadata: + name: '{{ .Values.tplValue }}-secret' + type: Opaque + stringData: + client-id: fake-client-id + client-secret: fake-client-secret + cookie-secret: fake-cookie-secret-of-24 diff --git a/helm/oauth2-proxy/ci/tpl-values.yaml b/helm/oauth2-proxy/ci/tpl-values.yaml index 18e654a8..0bab1ee1 100644 --- a/helm/oauth2-proxy/ci/tpl-values.yaml +++ b/helm/oauth2-proxy/ci/tpl-values.yaml @@ -63,6 +63,12 @@ deploymentLabels: deploymentAnnotations: test-annotations/test: "{{ $.Release.Name }}" +podAnnotations: + test-annotations/test: "{{ $.Release.Name }}" + +podLabels: + test-pod-label/test: "{{ $.Release.Name }}" + autoscaling: annotations: test-annotations/test: "{{ $.Release.Name }}" diff --git a/helm/oauth2-proxy/templates/_helpers.tpl b/helm/oauth2-proxy/templates/_helpers.tpl index d1a99007..0286c028 100644 --- a/helm/oauth2-proxy/templates/_helpers.tpl +++ b/helm/oauth2-proxy/templates/_helpers.tpl @@ -185,9 +185,9 @@ generated {{- define "oauth2-proxy.alpha-config.name" -}} {{- $source := include "oauth2-proxy.alpha-config.source" . -}} {{- if eq $source "existing-configmap" -}} -{{- .Values.alphaConfig.existingConfig -}} +{{- printf "%s" (tpl .Values.alphaConfig.existingConfig $) -}} {{- else if eq $source "existing-secret" -}} -{{- .Values.alphaConfig.existingSecret -}} +{{- printf "%s" (tpl .Values.alphaConfig.existingSecret $) -}} {{- else if eq $source "generated" -}} {{- printf "%s-alpha" (include "oauth2-proxy.fullname" .) | trunc 63 | trimSuffix "-" -}} {{- end -}} @@ -226,7 +226,7 @@ generated-legacy {{- define "oauth2-proxy.legacy-config.name" -}} {{- if eq (include "oauth2-proxy.legacy-config.mode" .) "existing-configmap" -}} -{{- .Values.config.existingConfig -}} +{{- printf "%s" (tpl .Values.config.existingConfig $) -}} {{- else -}} {{- template "oauth2-proxy.fullname" . -}} {{- end -}} diff --git a/helm/oauth2-proxy/templates/deployment.yaml b/helm/oauth2-proxy/templates/deployment.yaml index 96366a56..b115d233 100644 --- a/helm/oauth2-proxy/templates/deployment.yaml +++ b/helm/oauth2-proxy/templates/deployment.yaml @@ -47,14 +47,14 @@ spec: {{- if .Values.htpasswdFile.enabled }} checksum/htpasswd: {{ toYaml .Values.htpasswdFile.entries | sha256sum }} {{- end }} - {{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | indent 8 }} + {{- with .Values.podAnnotations }} +{{ tpl ( toYaml . ) $ | indent 8 }} {{- end }} labels: app: {{ template "oauth2-proxy.name" . }} {{- include "oauth2-proxy.labels" . | indent 8 }} - {{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} + {{- with .Values.podLabels }} +{{ tpl ( toYaml . ) $ | indent 8 }} {{- end }} spec: {{- if .Values.priorityClassName }} diff --git a/helm/oauth2-proxy/values.yaml b/helm/oauth2-proxy/values.yaml index 5521eb02..7bff22ac 100644 --- a/helm/oauth2-proxy/values.yaml +++ b/helm/oauth2-proxy/values.yaml @@ -23,6 +23,11 @@ config: clientID: "XXXXXXX" # OAuth client secret clientSecret: "XXXXXXXX" + # Custom secret name instead of generating one with 'clientID', 'clientSecret' and 'cookieSecret'. + # Secret keys must be the one provided with 'requiredSecretKeys' below. + # Mutually exclusive with 'clientID', 'clientSecret' and 'cookieSecret'. + # Supports Helm templating, e.g. '{{ .Release.Name }}-secret' or '{{ include "myapp.oauth2-proxy.secretName" . }}' + existingSecret: ~ # List of secret keys to include in the secret and expose as environment variables. # By default, all three secrets are required. To exclude certain secrets # (e.g., when using federated token authentication), remove them from this list. @@ -135,8 +140,10 @@ config: # Use an existing config map (see configmap.yaml for required fields) # This is ignored when alphaConfig.enabled=true and # forceLegacyConfig=false. + # Supports Helm templating, e.g. '{{ .Release.Name }}-config' or '{{ include "myapp.oauth2-proxy.configName" . }}' # Example: # existingConfig: config + # existingConfig: '{{ .Release.Name }}-config' existingConfig: ~ alphaConfig: @@ -182,10 +189,12 @@ alphaConfig: # Use an existing config map (see secret-alpha.yaml for required fields). # Mutually exclusive with existingSecret and all generated alpha config # content options (serverConfigData, metricsConfigData, configData, configFile). + # Supports Helm templating, e.g. '{{ .Release.Name }}-config' or '{{ include "myapp.oauth2-proxy.configName" . }}' existingConfig: ~ # Use an existing secret. # Mutually exclusive with existingConfig and all generated alpha config # content options (serverConfigData, metricsConfigData, configData, configFile). + # Supports Helm templating, e.g. '{{ .Release.Name }}-secret' or '{{ include "myapp.oauth2-proxy.secretName" . }}' existingSecret: ~ # # NOTE: When using alphaConfig with external secrets (e.g., Azure