Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not regenerate the WOPI Server Secrets on 'helm upgrade' #20

Closed
SamuAlfageme opened this issue Oct 30, 2020 · 2 comments
Closed

Do not regenerate the WOPI Server Secrets on 'helm upgrade' #20

SamuAlfageme opened this issue Oct 30, 2020 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@SamuAlfageme
Copy link
Contributor

When no config.{wopisecret,iopsecret} value is provided when installing the wopiserver chart, a pair of random secrets is generated for convenience.

However, this does also happen across upgrades:

staging, iop-wopiserver-secrets, Secret (v1) has changed:
  # Source: iop/charts/wopiserver/templates/secrets.yaml
  apiVersion: v1
  kind: Secret
  metadata:
    labels:
      app.kubernetes.io/instance: iop
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: wopiserver
      app.kubernetes.io/version: v5.4
      helm.sh/chart: wopiserver-0.2.0
    name: iop-wopiserver-secrets
  data:
-   iopsecret: '-------- # (24 bytes)'
-   wopisecret: '-------- # (24 bytes)'
+   iopsecret: '++++++++ # (24 bytes)'
+   wopisecret: '++++++++ # (24 bytes)'
  type: Opaque

This behavior is not intended, as might require updating the IOP ConfigMap or reloading the IOP Deployment when using REVA_APPPROVIDER_IOPSECRET.

@SamuAlfageme SamuAlfageme added the bug Something isn't working label Oct 30, 2020
@SamuAlfageme SamuAlfageme self-assigned this Oct 30, 2020
@SamuAlfageme
Copy link
Contributor Author

linking https://github.com/helm/charts/issues/5167 for later ref.

@wkloucek
Copy link
Contributor

wkloucek commented Dec 23, 2022

As of now, Helm has no proper way to generate secrets ONCE (see also owncloud/ocis-charts#50).

Therefore I would recommend to always use secretsRef for production deployments:

# secretRef allows one to use an already existing secret instead of configuring the secrets below
secretsRef:
# secrets are only used if "secretRef" is not set or empty
secrets:
wopiSecret:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants