Commit 8ab83a60 authored by Radu Carpa's avatar Radu Carpa
Browse files

daemons: deprecate implicit ca and proxy volume mounts 

The commit doesn't change the behavior now, but prepares
the path for a future removal of that code in a major relase.

I consider that it's a very bad practice to require secrets
with specific names to be created inside the cluster
before running the helm chart. These secrets will now have
to be explicitly mounted via the additionalSecrets logic.
parent 5c1c3de9

charts/rucio-daemons/templates/abacus-account.yaml

+4 −0
Original line number Diff line number Diff line
@@ -70,12 +70,14 @@ spec: 
      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

    {{- end }}

      {{- range $key, $val := .Values.additionalSecrets }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:
@@ -91,10 +93,12 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

charts/rucio-daemons/templates/abacus-collection-replica.yaml

+4 −0
Original line number Diff line number Diff line
@@ -70,12 +70,14 @@ spec: 
      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

    {{- end }}

      {{- range $key, $val := .Values.additionalSecrets }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:
@@ -91,10 +93,12 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

charts/rucio-daemons/templates/abacus-rse.yaml

+4 −0
Original line number Diff line number Diff line
@@ -70,12 +70,14 @@ spec: 
      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

    {{- end }}

      {{- range $key, $val := .Values.additionalSecrets }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:
@@ -91,10 +93,12 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

charts/rucio-daemons/templates/automatix.yaml

+4 −0
Original line number Diff line number Diff line
@@ -70,6 +70,7 @@ spec: 
      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up
@@ -79,6 +80,7 @@ spec: 
      - name: ca-volume-reaper

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle-reaper

    {{- end }}

      {{- range $key, $val := .Values.additionalSecrets }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:
@@ -94,12 +96,14 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

            - name: ca-volume-reaper

              mountPath: /etc/grid-security/certificates

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

charts/rucio-daemons/templates/conveyor-finisher.yaml

+4 −0
Original line number Diff line number Diff line
@@ -70,12 +70,14 @@ spec: 
      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

    {{- end }}

      {{- range $key, $val := .Values.additionalSecrets }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:
@@ -91,10 +93,12 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json