feat: refactor JWT key generation to create a Kubernetes secret directly; remove job and RBAC resources

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

helm/garage-ui/templates/jwt.yaml

@@ -2,104 +2,17 @@
 {{- $secretName := printf "%s-jwt-key" (include "garage-ui.fullname" .) }}
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
 {{- if not $existingSecret }}
-apiVersion: batch/v1
+{{- $privateKey := genPrivateKey "ed25519" }}
-kind: Job
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-spec:
-  template:
-    metadata:
-      name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-    spec:
-      restartPolicy: Never
-      serviceAccountName: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-      containers:
-      - name: jwt-key-generator
-        image: alpine:3.18
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-
-          # Install openssl
-          apk add --no-cache openssl kubectl
-
-          # Generate Ed25519 private key
-          openssl genpkey -algorithm ED25519 -out /tmp/jwt-key.pem
-
-          # Create Kubernetes secret
-          kubectl create secret generic {{ $secretName }} \
-            --from-file=jwt-key.pem=/tmp/jwt-key.pem \
-            --namespace={{ .Release.Namespace }} \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-          # Add labels to the secret
-          kubectl label secret {{ $secretName }} \
-            --namespace={{ .Release.Namespace }} \
-            helm.sh/chart={{ include "garage-ui.chart" . }} \
-            {{ include "garage-ui.selectorLabels" . | replace ": " "=" | replace "\n" " " }} \
-            app.kubernetes.io/version={{ .Chart.AppVersion | quote }} \
-            app.kubernetes.io/managed-by={{ .Release.Service }} \
-            --overwrite
-
-          # Add annotation to keep the secret
-          kubectl annotate secret {{ $secretName }} \
-            --namespace={{ .Release.Namespace }} \
-            "helm.sh/resource-policy=keep" \
-            --overwrite
-
-          echo "JWT private key generated and stored in secret: {{ $secretName }}"
----
 apiVersion: v1
-kind: ServiceAccount
+kind: Secret
 metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  name: {{ $secretName }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
   annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/resource-policy": keep
-    "helm.sh/hook-weight": "-10"
+type: Opaque
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+data:
----
+  jwt-key.pem: {{ $privateKey | b64enc | quote }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-subjects:
-- kind: ServiceAccount
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  namespace: {{ .Release.Namespace }}
-{{- end }}
 {{- end }}
+{{- end }}