feat: add support for using Kubernetes secrets for admin token management

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

helm/garage-ui/templates/configmap.yaml

@@ -6,4 +6,6 @@ metadata:
     {{- include "garage-ui.labels" . | nindent 4 }}
 data:
   config.yaml: |
-{{- .Values.config | toYaml | nindent 4 }}
+{{- $config := deepCopy .Values.config }}
+{{- $_ := unset $config.garage "admin_token" }}
+{{- $config | toYaml | nindent 4 }}

helm/garage-ui/templates/deployment.yaml

@@ -35,6 +35,17 @@ spec:
         - name: http
           containerPort: 8080
           protocol: TCP
+        env:
+        - name: GARAGE_UI_GARAGE_ADMIN_TOKEN
+          valueFrom:
+            secretKeyRef:
+              {{- if .Values.config.garage.existingSecret.name }}
+              name: {{ .Values.config.garage.existingSecret.name }}
+              key: {{ .Values.config.garage.existingSecret.key }}
+              {{- else }}
+              name: {{ include "garage-ui.fullname" . }}-admin-token
+              key: admin-token
+              {{- end }}
         {{- if .Values.livenessProbe.enabled }}
         livenessProbe:
           httpGet:

helm/garage-ui/templates/secret.yaml

@@ -0,0 +1,11 @@
+{{- if and (not .Values.config.garage.existingSecret.name) .Values.config.garage.admin_token }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-admin-token
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+type: Opaque
+data:
+  admin-token: {{ .Values.config.garage.admin_token | b64enc | quote }}
+{{- end }}

helm/garage-ui/values.yaml

@@ -87,8 +87,22 @@ config:
     # REQUIRED: Obtain this from your Garage server configuration
     # This token grants administrative access - keep it secure!
     # To generate: See Garage documentation for admin token setup
+    # NOTE: If existingSecret is configured, this value will be ignored
     admin_token: ""
 
+    # Use an existing Kubernetes secret for the admin token (recommended for production)
+    # When configured, this takes precedence over the admin_token value above
+    # The secret should contain a key with the admin token value
+    existingSecret:
+      # Name of the existing secret containing the admin token
+      # Leave empty to use the admin_token value above instead
+      # Example: "garage-admin-token"
+      name: ""
+
+      # Key within the secret that contains the admin token value
+      # Default: "admin-token"
+      key: "admin-token"
+
   # ========================================
   # Authentication Configuration
   # ========================================