feat: bump version to 0.1.4 and appVersion to 0.0.10; update authentication secrets in deployment and values

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

README.md

@@ -502,7 +502,7 @@ replicaCount: 2
 
 image:
   repository: noooste/garage-ui
-  tag: v0.0.4
+  tag: latest
 
 garage:
   endpoint: "http://garage.storage.svc.cluster.local:3900"

helm/garage-ui/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: garage-ui
 description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
 type: application
-version: 0.1.3
+version: 0.1.4
-appVersion: "v0.0.7"
+appVersion: "v0.0.10"
 keywords:
   - garage
   - s3

helm/garage-ui/README.md

@@ -2,8 +2,8 @@
 
 A Helm chart for deploying [Garage UI](https://github.com/Noooste/garage-ui), a modern web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems.
 
-[![Version](https://img.shields.io/badge/version-0.1.1-blue.svg)](Chart.yaml)
+[![Version](https://img.shields.io/badge/version-0.1.4-blue.svg)](Chart.yaml)
-[![App Version](https://img.shields.io/badge/app%20version-v0.0.6-green.svg)](Chart.yaml)
+[![App Version](https://img.shields.io/badge/app%20version-v0.0.10-green.svg)](Chart.yaml)
 
 ## Table of Contents
 

helm/garage-ui/templates/configmap.yaml

@@ -8,4 +8,6 @@ data:
   config.yaml: |
 {{- $config := deepCopy .Values.config }}
 {{- $_ := unset $config.garage "admin_token" }}
+{{- $_2 := unset $config.auth.admin "password" }}
+{{- $_3 := unset $config.auth.oidc "client_secret" }}
 {{- $config | toYaml | nindent 4 }}

helm/garage-ui/templates/deployment.yaml

@@ -46,6 +46,30 @@ spec:
               name: {{ include "garage-ui.fullname" . }}-admin-token
               key: admin-token
               {{- end }}
+        {{- if .Values.config.auth.oidc.enabled }}
+        - name: GARAGE_UI_AUTH_OIDC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              {{- if .Values.config.auth.oidc.existingSecret.name }}
+              name: {{ .Values.config.auth.oidc.existingSecret.name }}
+              key: {{ .Values.config.auth.oidc.existingSecret.key }}
+              {{- else }}
+              name: {{ include "garage-ui.fullname" . }}-oidc-client-secret
+              key: client-secret
+              {{- end }}
+        {{- end }}
+        {{- if .Values.config.auth.admin.enabled }}
+        - name: GARAGE_UI_AUTH_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              {{- if .Values.config.auth.admin.existingSecret.name }}
+              name: {{ .Values.config.auth.admin.existingSecret.name }}
+              key: {{ .Values.config.auth.admin.existingSecret.key }}
+              {{- else }}
+              name: {{ include "garage-ui.fullname" . }}-admin-password
+              key: admin-password
+              {{- end }}
+        {{- end }}
         {{- if .Values.livenessProbe.enabled }}
         livenessProbe:
           httpGet:

helm/garage-ui/templates/secret.yaml

@@ -9,3 +9,31 @@ type: Opaque
 data:
   admin-token: {{ .Values.config.garage.admin_token | b64enc | quote }}
 {{- end }}
+---
+{{- if and .Values.config.auth.admin.enabled (not .Values.config.auth.admin.existingSecret.name) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-admin-password
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if .Values.config.auth.admin.password }}
+  admin-password: {{ .Values.config.auth.admin.password | b64enc | quote }}
+  {{- else }}
+  admin-password: {{ randAlphaNum 32 | b64enc | quote }}
+  {{- end }}
+{{- end }}
+---
+{{- if and .Values.config.auth.oidc.enabled (not .Values.config.auth.oidc.existingSecret.name) .Values.config.auth.oidc.client_secret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-oidc-client-secret
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+type: Opaque
+data:
+  client-secret: {{ .Values.config.auth.oidc.client_secret | b64enc | quote }}
+{{- end }}

helm/garage-ui/values.yaml

@@ -62,6 +62,21 @@ config:
     # Options: "production", "development", "staging"
     environment: "production"
 
+    # Domain name for the application
+    # Example: "garage-ui.example.com"
+    domain: "garage-ui.example.com"
+
+    # Protocol for internal communication
+    # Options: "http", "https"
+    # Keep as "http" for internal Kubernetes communication (TLS termination at ingress)
+    protocol: "http"
+
+    # Full external URL for OAuth2 redirects and external links
+    # This is the public-facing URL users access
+    # Example: "https://garage-ui.example.com"
+    # REQUIRED when OIDC authentication is enabled
+    root_url: "https://garage-ui.example.com"
+
   # ========================================
   # Garage S3 Storage Configuration
   # ========================================
@@ -106,30 +121,44 @@ config:
   # ========================================
   # Authentication Configuration
   # ========================================
+  # You can enable one or both authentication methods
   auth:
-    # Authentication mode
+    # Admin Authentication Settings
-    # Options:
-    #   "none"  - No authentication (open access - not recommended for production)
-    #   "basic" - Simple username/password authentication
-    #   "oidc"  - OpenID Connect integration (recommended for production)
-    mode: "none"
-
-    # Basic Authentication Settings
-    # Only used when mode = "basic"
     # Provides simple username/password protection
-    basic:
+    admin:
-      # Username for basic auth login
+      # Enable or disable admin authentication
+      # Set to true to enable username/password login
+      enabled: false
+
+      # Username for admin login
       username: "admin"
 
-      # Password for basic auth login
+      # Password for admin login
-      # IMPORTANT: Change this default password immediately!
+      # NOTE: If existingSecret is configured, this value will be ignored
+      # Leave empty to auto-generate a random password (when existingSecret is not specified)
       password: "changeme"
 
+      # Use an existing Kubernetes secret for the admin password (recommended for production)
+      # When configured, this takes precedence over the password value above
+      # The secret should contain a key with the admin password value
+      existingSecret:
+        # Name of the existing secret containing the admin password
+        # Leave empty to use the password value above or auto-generate
+        # Example: "admin-credentials"
+        name: ""
+
+        # Key within the secret that contains the admin password value
+        # Default: "admin-password"
+        key: "admin-password"
+
     # OpenID Connect (OIDC) Configuration
-    # Only used when mode = "oidc"
     # Integrates with identity providers like Keycloak, Auth0, Okta, etc.
+    # NOTE: When OIDC is enabled, server.root_url must be configured
+    # The OAuth2 redirect URL is automatically constructed as: {root_url}/auth/oidc/callback
+    # Make sure to register this callback URL in your OIDC provider settings
     oidc:
-      # Enable/disable OIDC (must be true when mode = "oidc")
+      # Enable or disable OIDC authentication
+      # Set to true to enable OIDC login
       enabled: false
 
       # Display name of your OIDC provider
@@ -142,8 +171,22 @@ config:
 
       # OAuth2 client secret registered with your OIDC provider
       # IMPORTANT: Keep this secret secure! Consider using Kubernetes secrets
+      # NOTE: If existingSecret is configured, this value will be ignored
       client_secret: "your-client-secret"
 
+      # Use an existing Kubernetes secret for the client secret (recommended for production)
+      # When configured, this takes precedence over the client_secret value above
+      # The secret should contain a key with the client secret value
+      existingSecret:
+        # Name of the existing secret containing the client secret
+        # Leave empty to use the client_secret value above instead
+        # Example: "oidc-client-secret"
+        name: ""
+
+        # Key within the secret that contains the client secret value
+        # Default: "client-secret"
+        key: "client-secret"
+
       # OAuth2/OIDC scopes to request during authentication
       # Standard scopes: openid (required), email, profile
       # Add custom scopes as needed by your provider