From 62b76769d0128faf8924cb05dfb2f8525f41b09d Mon Sep 17 00:00:00 2001 From: Noste <83548733+Noooste@users.noreply.github.com> Date: Sun, 21 Dec 2025 23:53:19 +0100 Subject: [PATCH] feat: bump version to 0.1.4 and appVersion to 0.0.10; update authentication secrets in deployment and values Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com> --- README.md | 2 +- helm/garage-ui/Chart.yaml | 4 +- helm/garage-ui/README.md | 4 +- helm/garage-ui/templates/configmap.yaml | 2 + helm/garage-ui/templates/deployment.yaml | 24 ++++++++ helm/garage-ui/templates/secret.yaml | 28 +++++++++ helm/garage-ui/values.yaml | 73 +++++++++++++++++++----- 7 files changed, 117 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 32c1005..64da512 100644 --- a/README.md +++ b/README.md @@ -502,7 +502,7 @@ replicaCount: 2 image: repository: noooste/garage-ui - tag: v0.0.4 + tag: latest garage: endpoint: "http://garage.storage.svc.cluster.local:3900" diff --git a/helm/garage-ui/Chart.yaml b/helm/garage-ui/Chart.yaml index 72d57a5..4867dca 100644 --- a/helm/garage-ui/Chart.yaml +++ b/helm/garage-ui/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: garage-ui description: A Helm chart for Garage UI - Web interface for Garage S3 object storage type: application -version: 0.1.3 -appVersion: "v0.0.7" +version: 0.1.4 +appVersion: "v0.0.10" keywords: - garage - s3 diff --git a/helm/garage-ui/README.md b/helm/garage-ui/README.md index cc7213e..41e0b35 100644 --- a/helm/garage-ui/README.md +++ b/helm/garage-ui/README.md @@ -2,8 +2,8 @@ A Helm chart for deploying [Garage UI](https://github.com/Noooste/garage-ui), a modern web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems. -[![Version](https://img.shields.io/badge/version-0.1.1-blue.svg)](Chart.yaml) -[![App Version](https://img.shields.io/badge/app%20version-v0.0.6-green.svg)](Chart.yaml) +[![Version](https://img.shields.io/badge/version-0.1.4-blue.svg)](Chart.yaml) +[![App Version](https://img.shields.io/badge/app%20version-v0.0.10-green.svg)](Chart.yaml) ## Table of Contents diff --git a/helm/garage-ui/templates/configmap.yaml b/helm/garage-ui/templates/configmap.yaml index cf655c7..4dbfead 100644 --- a/helm/garage-ui/templates/configmap.yaml +++ b/helm/garage-ui/templates/configmap.yaml @@ -8,4 +8,6 @@ data: config.yaml: | {{- $config := deepCopy .Values.config }} {{- $_ := unset $config.garage "admin_token" }} +{{- $_2 := unset $config.auth.admin "password" }} +{{- $_3 := unset $config.auth.oidc "client_secret" }} {{- $config | toYaml | nindent 4 }} diff --git a/helm/garage-ui/templates/deployment.yaml b/helm/garage-ui/templates/deployment.yaml index 65edec0..61f92e0 100644 --- a/helm/garage-ui/templates/deployment.yaml +++ b/helm/garage-ui/templates/deployment.yaml @@ -46,6 +46,30 @@ spec: name: {{ include "garage-ui.fullname" . }}-admin-token key: admin-token {{- end }} + {{- if .Values.config.auth.oidc.enabled }} + - name: GARAGE_UI_AUTH_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + {{- if .Values.config.auth.oidc.existingSecret.name }} + name: {{ .Values.config.auth.oidc.existingSecret.name }} + key: {{ .Values.config.auth.oidc.existingSecret.key }} + {{- else }} + name: {{ include "garage-ui.fullname" . }}-oidc-client-secret + key: client-secret + {{- end }} + {{- end }} + {{- if .Values.config.auth.admin.enabled }} + - name: GARAGE_UI_AUTH_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.config.auth.admin.existingSecret.name }} + name: {{ .Values.config.auth.admin.existingSecret.name }} + key: {{ .Values.config.auth.admin.existingSecret.key }} + {{- else }} + name: {{ include "garage-ui.fullname" . }}-admin-password + key: admin-password + {{- end }} + {{- end }} {{- if .Values.livenessProbe.enabled }} livenessProbe: httpGet: diff --git a/helm/garage-ui/templates/secret.yaml b/helm/garage-ui/templates/secret.yaml index 5dba027..4eaee99 100644 --- a/helm/garage-ui/templates/secret.yaml +++ b/helm/garage-ui/templates/secret.yaml @@ -9,3 +9,31 @@ type: Opaque data: admin-token: {{ .Values.config.garage.admin_token | b64enc | quote }} {{- end }} +--- +{{- if and .Values.config.auth.admin.enabled (not .Values.config.auth.admin.existingSecret.name) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "garage-ui.fullname" . }}-admin-password + labels: + {{- include "garage-ui.labels" . | nindent 4 }} +type: Opaque +data: + {{- if .Values.config.auth.admin.password }} + admin-password: {{ .Values.config.auth.admin.password | b64enc | quote }} + {{- else }} + admin-password: {{ randAlphaNum 32 | b64enc | quote }} + {{- end }} +{{- end }} +--- +{{- if and .Values.config.auth.oidc.enabled (not .Values.config.auth.oidc.existingSecret.name) .Values.config.auth.oidc.client_secret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "garage-ui.fullname" . }}-oidc-client-secret + labels: + {{- include "garage-ui.labels" . | nindent 4 }} +type: Opaque +data: + client-secret: {{ .Values.config.auth.oidc.client_secret | b64enc | quote }} +{{- end }} diff --git a/helm/garage-ui/values.yaml b/helm/garage-ui/values.yaml index 5d8570b..77f8400 100644 --- a/helm/garage-ui/values.yaml +++ b/helm/garage-ui/values.yaml @@ -62,6 +62,21 @@ config: # Options: "production", "development", "staging" environment: "production" + # Domain name for the application + # Example: "garage-ui.example.com" + domain: "garage-ui.example.com" + + # Protocol for internal communication + # Options: "http", "https" + # Keep as "http" for internal Kubernetes communication (TLS termination at ingress) + protocol: "http" + + # Full external URL for OAuth2 redirects and external links + # This is the public-facing URL users access + # Example: "https://garage-ui.example.com" + # REQUIRED when OIDC authentication is enabled + root_url: "https://garage-ui.example.com" + # ======================================== # Garage S3 Storage Configuration # ======================================== @@ -106,30 +121,44 @@ config: # ======================================== # Authentication Configuration # ======================================== + # You can enable one or both authentication methods auth: - # Authentication mode - # Options: - # "none" - No authentication (open access - not recommended for production) - # "basic" - Simple username/password authentication - # "oidc" - OpenID Connect integration (recommended for production) - mode: "none" - - # Basic Authentication Settings - # Only used when mode = "basic" + # Admin Authentication Settings # Provides simple username/password protection - basic: - # Username for basic auth login + admin: + # Enable or disable admin authentication + # Set to true to enable username/password login + enabled: false + + # Username for admin login username: "admin" - # Password for basic auth login - # IMPORTANT: Change this default password immediately! + # Password for admin login + # NOTE: If existingSecret is configured, this value will be ignored + # Leave empty to auto-generate a random password (when existingSecret is not specified) password: "changeme" + # Use an existing Kubernetes secret for the admin password (recommended for production) + # When configured, this takes precedence over the password value above + # The secret should contain a key with the admin password value + existingSecret: + # Name of the existing secret containing the admin password + # Leave empty to use the password value above or auto-generate + # Example: "admin-credentials" + name: "" + + # Key within the secret that contains the admin password value + # Default: "admin-password" + key: "admin-password" + # OpenID Connect (OIDC) Configuration - # Only used when mode = "oidc" # Integrates with identity providers like Keycloak, Auth0, Okta, etc. + # NOTE: When OIDC is enabled, server.root_url must be configured + # The OAuth2 redirect URL is automatically constructed as: {root_url}/auth/oidc/callback + # Make sure to register this callback URL in your OIDC provider settings oidc: - # Enable/disable OIDC (must be true when mode = "oidc") + # Enable or disable OIDC authentication + # Set to true to enable OIDC login enabled: false # Display name of your OIDC provider @@ -142,8 +171,22 @@ config: # OAuth2 client secret registered with your OIDC provider # IMPORTANT: Keep this secret secure! Consider using Kubernetes secrets + # NOTE: If existingSecret is configured, this value will be ignored client_secret: "your-client-secret" + # Use an existing Kubernetes secret for the client secret (recommended for production) + # When configured, this takes precedence over the client_secret value above + # The secret should contain a key with the client secret value + existingSecret: + # Name of the existing secret containing the client secret + # Leave empty to use the client_secret value above instead + # Example: "oidc-client-secret" + name: "" + + # Key within the secret that contains the client secret value + # Default: "client-secret" + key: "client-secret" + # OAuth2/OIDC scopes to request during authentication # Standard scopes: openid (required), email, profile # Add custom scopes as needed by your provider