mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-25 13:36:50 +00:00
Michael Graff
3898d524fe
Signed-off-by: Michael Graff <explorer@flame.org> Signed-off-by: 安正超 <anzhengchao@gmail.com> Co-authored-by: 安正超 <anzhengchao@gmail.com> Co-authored-by: loverustfs <hello@rustfs.com>
47 lines
2.1 KiB
YAML
47 lines
2.1 KiB
YAML
{{- if not .Values.secret.existingSecret }}
|
|
{{- $accessKey := .Values.secret.rustfs.access_key | default "" }}
|
|
{{- $secretKey := .Values.secret.rustfs.secret_key | default "" }}
|
|
{{- $allowInsecure := .Values.secret.allowInsecureDefaults | default false }}
|
|
{{/* Either key set to the well-known default counts as insecure. */}}
|
|
{{- $hasDefaultKey := or (eq $accessKey "rustfsadmin") (eq $secretKey "rustfsadmin") }}
|
|
{{- $bothEmpty := and (eq $accessKey "") (eq $secretKey "") }}
|
|
{{- $oneEmpty := and (not $bothEmpty) (or (eq $accessKey "") (eq $secretKey "")) }}
|
|
{{/* Always fail when only one of the two keys is supplied — never silently
|
|
auto-fill a single missing key with the well-known default. */}}
|
|
{{- if $oneEmpty }}
|
|
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must both be set, or both be left empty. Setting only one of the two is ambiguous and is rejected to avoid silently using the well-known default for the missing key.") }}
|
|
{{- end }}
|
|
{{- if and (not $allowInsecure) (or $bothEmpty $hasDefaultKey) }}
|
|
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must be set to non-default, non-empty values, or set secret.existingSecret to a Secret you control. To opt into the well-known default credentials for local development only, set secret.allowInsecureDefaults=true.") }}
|
|
{{- end }}
|
|
{{- if and $allowInsecure $bothEmpty }}
|
|
{{- $accessKey = "rustfsadmin" }}
|
|
{{- $secretKey = "rustfsadmin" }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "rustfs.secretName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- toYaml .Values.commonLabels | nindent 4 }}
|
|
type: Opaque
|
|
data:
|
|
RUSTFS_ACCESS_KEY: {{ $accessKey | b64enc | quote }}
|
|
RUSTFS_SECRET_KEY: {{ $secretKey | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
---
|
|
{{- if .Values.imageRegistryCredentials.enabled }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "rustfs.imagePullSecret.name" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- toYaml .Values.commonLabels | nindent 4 }}
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: {{ template "imagePullSecret" . }}
|
|
{{- end }}
|