feat(config): add 'tpl' usage for alphaConfig.existingSecret, alphaConfig.existingConfig, config.existingConfig, podAnnotations and podLabels

helm/oauth2-proxy/Chart.yaml

@@ -1,5 +1,5 @@
 name: oauth2-proxy
-version: 10.7.0
+version: 10.9.0
 apiVersion: v2
 appVersion: 7.15.3
 home: https://oauth2-proxy.github.io/oauth2-proxy/
@@ -40,3 +40,8 @@ annotations:
       links:
         - name: GitHub PR
           url: https://github.com/oauth2-proxy/manifests/pull/405
+    - kind: added
+      description: Add 'tpl' usage for alphaConfig.existingSecret, alphaConfig.existingConfig, config.existingConfig, podAnnotations and podLabels
+      links:
+        - name: GitHub PR
+          url: https://github.com/oauth2-proxy/manifests/pull/418

helm/oauth2-proxy/ci/alphaconfig-tpl-existing-secret-values.yaml

@@ -0,0 +1,25 @@
+# Test Case: alphaConfig enabled + existingSecret TPL
+# Expected: Chart mounts the external alpha Secret instead of generating one.
+
+tplValue: prefix
+
+alphaConfig:
+  enabled: true
+  existingSecret: '{{ .Values.tplValue }}-alpha-secret'
+
+extraObjects:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: '{{ .Values.tplValue }}-alpha-secret'
+    type: Opaque
+    stringData:
+      oauth2_proxy.yml: |
+        ---
+        server:
+          BindAddress: 0.0.0.0:4180
+        providers:
+          - id: google
+            provider: google
+            clientID: fake-client-id
+            clientSecret: fake-client-secret

helm/oauth2-proxy/ci/config-tpl-existing-configmap-values.yaml

@@ -0,0 +1,17 @@
+# Test Case: config + existingConfig TPL
+# Expected: Chart mounts the external config ConfigMap instead of generating one.
+
+tplValue: prefix
+
+config:
+  existingConfig: '{{ .Values.tplValue }}-config'
+
+extraObjects:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: '{{ .Values.tplValue }}-config'
+    data:
+      oauth2_proxy.cfg: |
+        email_domains = [ "*" ]
+        upstreams = [ "file:///dev/null" ]

helm/oauth2-proxy/ci/config-tpl-existing-secret-values.yaml

@@ -0,0 +1,18 @@
+# Test Case: config + existingSecret TPL
+# Expected: Chart mounts the external Secret instead of generating one.
+
+tplValue: prefix
+
+config:
+  existingSecret: '{{ .Values.tplValue }}-secret'
+
+extraObjects:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: '{{ .Values.tplValue }}-secret'
+    type: Opaque
+    stringData:
+      client-id: fake-client-id
+      client-secret: fake-client-secret
+      cookie-secret: fake-cookie-secret-of-24

helm/oauth2-proxy/ci/tpl-values.yaml

@@ -63,6 +63,12 @@ deploymentLabels:
 deploymentAnnotations:
   test-annotations/test: "{{ $.Release.Name }}"
 
+podAnnotations:
+  test-annotations/test: "{{ $.Release.Name }}"
+
+podLabels:
+  test-pod-label/test: "{{ $.Release.Name }}"
+
 autoscaling:
   annotations:
     test-annotations/test: "{{ $.Release.Name }}"

helm/oauth2-proxy/templates/_helpers.tpl

@@ -185,9 +185,9 @@ generated
 {{- define "oauth2-proxy.alpha-config.name" -}}
 {{- $source := include "oauth2-proxy.alpha-config.source" . -}}
 {{- if eq $source "existing-configmap" -}}
-{{- .Values.alphaConfig.existingConfig -}}
+{{- printf "%s" (tpl .Values.alphaConfig.existingConfig $) -}}
 {{- else if eq $source "existing-secret" -}}
-{{- .Values.alphaConfig.existingSecret -}}
+{{- printf "%s" (tpl .Values.alphaConfig.existingSecret $) -}}
 {{- else if eq $source "generated" -}}
 {{- printf "%s-alpha" (include "oauth2-proxy.fullname" .) | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
@@ -226,7 +226,7 @@ generated-legacy
 
 {{- define "oauth2-proxy.legacy-config.name" -}}
 {{- if eq (include "oauth2-proxy.legacy-config.mode" .) "existing-configmap" -}}
-{{- .Values.config.existingConfig -}}
+{{- printf "%s" (tpl .Values.config.existingConfig $) -}}
 {{- else -}}
 {{- template "oauth2-proxy.fullname" . -}}
 {{- end -}}

helm/oauth2-proxy/templates/deployment.yaml

@@ -47,14 +47,14 @@ spec:
 {{- if .Values.htpasswdFile.enabled }}
         checksum/htpasswd: {{ toYaml .Values.htpasswdFile.entries | sha256sum }}
 {{- end }}
-    {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
+    {{- with .Values.podAnnotations }}
+{{ tpl ( toYaml . ) $ | indent 8 }}
     {{- end }}
       labels:
         app: {{ template "oauth2-proxy.name" . }}
         {{- include "oauth2-proxy.labels" . | indent 8 }}
-      {{- if .Values.podLabels }}
-{{ toYaml .Values.podLabels | indent 8 }}
+      {{- with .Values.podLabels }}
+{{ tpl ( toYaml . ) $ | indent 8 }}
       {{- end }}
     spec:
     {{- if .Values.priorityClassName }}

helm/oauth2-proxy/values.yaml

@@ -23,6 +23,11 @@ config:
   clientID: "XXXXXXX"
   # OAuth client secret
   clientSecret: "XXXXXXXX"
+  # Custom secret name instead of generating one with 'clientID', 'clientSecret' and 'cookieSecret'.
+  # Secret keys must be the one provided with 'requiredSecretKeys' below.
+  # Mutually exclusive with 'clientID', 'clientSecret' and 'cookieSecret'.
+  # Supports Helm templating, e.g. '{{ .Release.Name }}-secret' or '{{ include "myapp.oauth2-proxy.secretName" . }}'
+  existingSecret: ~
   # List of secret keys to include in the secret and expose as environment variables.
   # By default, all three secrets are required. To exclude certain secrets
   # (e.g., when using federated token authentication), remove them from this list.
@@ -135,8 +140,10 @@ config:
   # Use an existing config map (see configmap.yaml for required fields)
   # This is ignored when alphaConfig.enabled=true and
   # forceLegacyConfig=false.
+  # Supports Helm templating, e.g. '{{ .Release.Name }}-config' or '{{ include "myapp.oauth2-proxy.configName" . }}'
   # Example:
   # existingConfig: config
+  # existingConfig: '{{ .Release.Name }}-config'
   existingConfig: ~
 
 alphaConfig:
@@ -182,10 +189,12 @@ alphaConfig:
   # Use an existing config map (see secret-alpha.yaml for required fields).
   # Mutually exclusive with existingSecret and all generated alpha config
   # content options (serverConfigData, metricsConfigData, configData, configFile).
+  # Supports Helm templating, e.g. '{{ .Release.Name }}-config' or '{{ include "myapp.oauth2-proxy.configName" . }}'
   existingConfig: ~
   # Use an existing secret.
   # Mutually exclusive with existingConfig and all generated alpha config
   # content options (serverConfigData, metricsConfigData, configData, configFile).
+  # Supports Helm templating, e.g. '{{ .Release.Name }}-secret' or '{{ include "myapp.oauth2-proxy.secretName" . }}'
   existingSecret: ~
   #
   # NOTE: When using alphaConfig with external secrets (e.g., Azure