From d866ed1d0f19cacb1904f7cef017de39f1d5212e Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Fri, 13 Feb 2026 10:43:46 -0500 Subject: [PATCH 1/8] feat(config): update env vars being passed in --- charts/curator/templates/_env.tpl | 50 ++++++++++++++++++++++++------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index 15704e3..c6f55fa 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -1,4 +1,44 @@ {{ define "env.environment" }} +# app.php +{{ if .Values.curator.app.debug }} +- name: APP_DEBUG + value: {{ .Values.curator.app.debug }} +{{ end }} +{{ with (first .Values.ingress.hosts) -}} +- name: APP_URL + value: {{ .host }} +{{ end -}} +# TODO account for old value location +- name: APP_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }} + value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} +# cache.php +- name: CACHE_DRIVER + value: {{ .Values.curator.cache.type | default "memcached" }} +- name: CACHE_HOST + value: {{ .Values.curator.cache.host | default "memcached"}} +- name: CACHE_PORT + value: {{ .Values.curator.cache.port | default "11211" }} +- name: CACHE_PREFIX + value: {{ .Values.curator.cache.prefix | default .Values.environment }} +# cms.php +- name: ROUTES_CACHE + value: {{ .Values.curator.cms.routesCache | default true }} +- name: ASSET_CACHE + value: {{ .Values.curator.cms.assetCache | default true }} +- name: ASSET_MINIFY + value: {{ .Values.curator.cms.assetMinify | default true }} +- name: FILESYSTEM_DRIVER + value: {{ .Values.curator.cms.filesystemDriver | default "s3" }} +- name: FILESYSTEM_UPLOADS_PATH + value: {{ .Values.curator.cms.uploadsPath | default "s3" }} +- name: FILESYSTEM_MEDIA_PATH + value: {{ .Values.curator.cms.mediaPath | default "s3" }} +- name: ENABLE_CSRF + value: {{ .Values.curator.cms.enableCSRF | default true }} +# database.php - name: DB_HOST value: {{ .Values.mariadbOperator.mariadbEndpoint | default .Values.mariadbOperator.mariaDbName }} - name: DB_DATABASE @@ -10,16 +50,6 @@ secretKeyRef: name: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.name | default (printf "%s-mariadb" .Values.environment) }} key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }} -- name: CACHE_HOST - value: "memcached" -- name: CACHE_PORT - value: "11211" -- name: CACHE_PREFIX - value: {{ .Values.curator.cache.prefix | default .Values.environment }} -{{ with (first .Values.ingress.hosts) -}} -- name: APP_URL - value: {{ .host }} -{{ end -}} {{ if .Values.persistence.s3.enabled -}} - name: S3_BUCKET value: {{ .Values.persistence.s3.bucket | default .Values.environment }} From 496976a3bb62b6fb304d12f37641c338549ae690 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Fri, 13 Feb 2026 10:43:46 -0500 Subject: [PATCH 2/8] feat(config): update env vars being passed in --- charts/curator/templates/_env.tpl | 50 ++++++++++++++++++++++++------- charts/curator/values.yaml | 24 ++++++++++++++- 2 files changed, 63 insertions(+), 11 deletions(-) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index 15704e3..c6f55fa 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -1,4 +1,44 @@ {{ define "env.environment" }} +# app.php +{{ if .Values.curator.app.debug }} +- name: APP_DEBUG + value: {{ .Values.curator.app.debug }} +{{ end }} +{{ with (first .Values.ingress.hosts) -}} +- name: APP_URL + value: {{ .host }} +{{ end -}} +# TODO account for old value location +- name: APP_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }} + value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} +# cache.php +- name: CACHE_DRIVER + value: {{ .Values.curator.cache.type | default "memcached" }} +- name: CACHE_HOST + value: {{ .Values.curator.cache.host | default "memcached"}} +- name: CACHE_PORT + value: {{ .Values.curator.cache.port | default "11211" }} +- name: CACHE_PREFIX + value: {{ .Values.curator.cache.prefix | default .Values.environment }} +# cms.php +- name: ROUTES_CACHE + value: {{ .Values.curator.cms.routesCache | default true }} +- name: ASSET_CACHE + value: {{ .Values.curator.cms.assetCache | default true }} +- name: ASSET_MINIFY + value: {{ .Values.curator.cms.assetMinify | default true }} +- name: FILESYSTEM_DRIVER + value: {{ .Values.curator.cms.filesystemDriver | default "s3" }} +- name: FILESYSTEM_UPLOADS_PATH + value: {{ .Values.curator.cms.uploadsPath | default "s3" }} +- name: FILESYSTEM_MEDIA_PATH + value: {{ .Values.curator.cms.mediaPath | default "s3" }} +- name: ENABLE_CSRF + value: {{ .Values.curator.cms.enableCSRF | default true }} +# database.php - name: DB_HOST value: {{ .Values.mariadbOperator.mariadbEndpoint | default .Values.mariadbOperator.mariaDbName }} - name: DB_DATABASE @@ -10,16 +50,6 @@ secretKeyRef: name: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.name | default (printf "%s-mariadb" .Values.environment) }} key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }} -- name: CACHE_HOST - value: "memcached" -- name: CACHE_PORT - value: "11211" -- name: CACHE_PREFIX - value: {{ .Values.curator.cache.prefix | default .Values.environment }} -{{ with (first .Values.ingress.hosts) -}} -- name: APP_URL - value: {{ .host }} -{{ end -}} {{ if .Values.persistence.s3.enabled -}} - name: S3_BUCKET value: {{ .Values.persistence.s3.bucket | default .Values.environment }} diff --git a/charts/curator/values.yaml b/charts/curator/values.yaml index ecda858..383a52d 100644 --- a/charts/curator/values.yaml +++ b/charts/curator/values.yaml @@ -186,9 +186,30 @@ curator: # -- environment variables to set in the container env: {} # KEY: VALUE + # -- environment variables to pass into app.php + app: + debug: ~ + appKeySecret: + name: ~ + key: ~ + # -- environment variables to pass into cache.php cache: + # -- cache type, possible values apc, array, database, file, memcached, redis + type: ~ + # -- cache host + host: ~ + # -- cache port + port: ~ # -- cache prefix - prefix: "" + prefix: ~ + # -- environment variables to pass into cms.php + cms: + routesCache: ~ + assetCache: ~ + assetMinify: ~ + appKeySecret: + name: ~ + key: ~ ## Initial Admin parameters auth: # -- secret to use for initial admin user @@ -212,6 +233,7 @@ curator: # -- Timeout for probe timeoutSeconds: 15 # -- These are used to override default php config files present in the containers. The files are mounted in the config directory and will append .php to the ends of the keys + # -- If one of these is defined the above config section will no longer be applicable if the new config doesn't utilze environment variables config: {} # app: "" # auth: "" From 82c91550ff753fede4082500f95e9c857e27b775 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 14 Apr 2026 14:35:43 -0400 Subject: [PATCH 3/8] checkpoint --- charts/curator/templates/_env.tpl | 199 ++++++++++++++++++++++++++++-- charts/curator/values.yaml | 59 ++++++++- 2 files changed, 246 insertions(+), 12 deletions(-) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index c6f55fa..a75a291 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -9,53 +9,230 @@ value: {{ .host }} {{ end -}} # TODO account for old value location +{{ if .Values.curator.app.appKeySecret }} - name: APP_KEY valueFrom: secretKeyRef: name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }} value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} +{{ end }} # cache.php +{{ if .Values.curator.cache.driver }} - name: CACHE_DRIVER - value: {{ .Values.curator.cache.type | default "memcached" }} + value: {{ .Values.curator.cache.driver }} +{{ end }} +{{ if .Values.curator.cache.host }} - name: CACHE_HOST - value: {{ .Values.curator.cache.host | default "memcached"}} + value: {{ .Values.curator.cache.host }} +{{ end }} +{{ if .Values.curator.cache.port }} - name: CACHE_PORT - value: {{ .Values.curator.cache.port | default "11211" }} + value: {{ .Values.curator.cache.port }} +{{ end }} +{{ if .Values.curator.cache.prefix }} - name: CACHE_PREFIX value: {{ .Values.curator.cache.prefix | default .Values.environment }} +{{ end }} # cms.php +{{ if .Values.curator.cms.routesCache }} - name: ROUTES_CACHE - value: {{ .Values.curator.cms.routesCache | default true }} + value: {{ .Values.curator.cms.routesCache }} +{{ end }} +{{ if .Values.curator.cms.assetCache }} - name: ASSET_CACHE - value: {{ .Values.curator.cms.assetCache | default true }} + value: {{ .Values.curator.cms.assetCache }} +{{ end }} +{{ if .Values.curator.cms.assetMinify }} - name: ASSET_MINIFY - value: {{ .Values.curator.cms.assetMinify | default true }} -- name: FILESYSTEM_DRIVER - value: {{ .Values.curator.cms.filesystemDriver | default "s3" }} + value: {{ .Values.curator.cms.assetMinify }} +{{ end }} +{{ if .Values.curator.cms.filesystemsUploadsPath }} - name: FILESYSTEM_UPLOADS_PATH - value: {{ .Values.curator.cms.uploadsPath | default "s3" }} + value: {{ .Values.curator.cms.filesystemsUploadsPath }} +{{ end }} +{{ if .Values.curator.cms.filesystemsMediaPath }} - name: FILESYSTEM_MEDIA_PATH - value: {{ .Values.curator.cms.mediaPath | default "s3" }} + value: {{ .Values.curator.cms.filesystemsMediaPath }} +{{ end }} +{{ if .Values.curator.cms.enableCSRF }} - name: ENABLE_CSRF - value: {{ .Values.curator.cms.enableCSRF | default true }} + value: {{ .Values.curator.cms.enableCSRF }} +{{ end }} # database.php +{{ if .Values.curator.database.connection }} +- name: DB_DATABASE + value: {{ .Values.curator.database.connection}} +{{ else }} +{{ if .Values.curator.database.host }} +- name: DB_HOST + value: {{ .Values.curator.database.host }} +{{ else }} - name: DB_HOST value: {{ .Values.mariadbOperator.mariadbEndpoint | default .Values.mariadbOperator.mariaDbName }} +{{ end }} +{{ if .Values.curator.database.databaseName }} +- name: DB_DATABASE + value: {{ .Values.curator.database.databaseName}} +{{ else }} - name: DB_DATABASE value: {{ .Values.mariadbOperator.database.name | default .Values.environment }} +{{ end }} +{{ if .Values.curator.database.user }} +- name: DB_USERNAME + value: {{ .Values.curator.database.username }} +{{ else }} - name: DB_USERNAME value: {{ .Values.mariadbOperator.user.username | default "curator"}} +{{ end }} +{{ if and (.Values.curator.database.password.secretKeyRef.name .values.curator.database.password.secretKeyRef.key )}} +- name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.curator.database.password.secretKeyRef.name }} + key: {{ .Values.curator.database.password.secretKeyRef.key }} +{{ else }} - name: DB_PASSWORD valueFrom: secretKeyRef: name: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.name | default (printf "%s-mariadb" .Values.environment) }} key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }} +{{ end }} +# filesystems.php +### +# FILESYSTEM_DRIVER is created above. +# TODO should that go here instead? +### +{{ if .Values.curator.filesystems.filesystemDriver }} +- name: FILESYSTEM_DRIVER + value: {{ .Values.curator.filesystems.filesystemDriver }} +{{ end }} +{{ if .Values.curator.filesystems.awsBucket }} +- name: AWS_BUCKET + value: {{ .Values.curator.filesystems.awsBucket }} +{{ end }} +### +# AWS_DEFAULT_REGION is passed in via the pod identity webhook +### {{ if .Values.persistence.s3.enabled -}} - name: S3_BUCKET value: {{ .Values.persistence.s3.bucket | default .Values.environment }} - name: S3_REGION value: {{ .Values.persistence.s3.region | default .Values.environment }} {{- end }} +# logging.php +{{ if .Values.curator.logging.channel }} +- name: LOG_CHANNEL + value: {{ .Values.curator.logging.channel }} +{{ end }} +{{ if .Values.curator.logging.deprecationsChannel }} +- name: LOG_DEPRECATIONS_CHANNEL + value: {{ .Values.curator.logging.deprecationsChannel }} +{{ end }} +{{ if .Values.curator.logging.level }} +- name: LOG_LEVEL + value: {{ .Values.curator.logging.level }} +{{ end }} +# mail.php +{{ if .Values.curator.mail.host }} +- name: MAIL_HOST + value: {{ .Values.curator.mail.host }} +{{ end }} +{{ if and (.Values.curator.mail.passwordSecretRef.name .Values.curator.mail.passwordSecretRef.key) }} +- name: MAIL_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.curator.mail.passwordSecretRef.name }} + key: {{ .Values.curator.mail.passwordSecretRef.name.key }} +{{ end }} +{{ if .Values.curator.mail.port }} +- name: MAIL_PORT + value: {{ .Values.curator.mail.port }} +{{ end }} +{{ if .Values.curator.mail.username }} +- name: MAIL_USERNAME + value: {{ .Values.curator.mail.username }} +{{ end }} +{{ if .Values.curator.mail.fromAddress }} +- name: MAIL_FROM_ADDRESS + value: {{ .Values.curator.mail.fromAddress }} +{{ end }} +{{ if .Values.curator.mail.fromName }} +- name: MAIL_FROM_NAME + value: {{ .Values.curator.mail.fromName }} +{{ end }} +# powerbi.php +{{ if .Values.curator.powerbi.powerBiTenant }} +- name: MAIL_FROM_NAME + value: {{ .Values.curator.mail.powerBiTenant }} +{{ end }} +{{ if and (.Values.curator.powerbi.clientIdSecretRef.name .Values.curator.powerbi.clientIdSecretRef.key) }} +- name: POWER_BI_CLIENT_ID + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.clientIdSecretRef.name }} + key: {{ .Values.curator.powerbi.clientIdSecretRef.key }} +{{ end }} +{{ if and (.Values.curator.powerbi.clientSecretSecretRef.name .Values.curator.powerbi.clientSecretSecretRef.key) }} +- name: POWER_BI_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.clientSecretSecretRef.name }} + key: {{ .Values.curator.powerbi.clientSecretSecretRef.key }} +{{ end }} +{{ if and (.Values.curator.powerbi.adminClientIdSecretRef.name .Values.curator.powerbi.adminClientIdSecretRef.key) }} +- name: POWER_BI_ADMIN_CLIENT_ID + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.adminClientIdSecretRef.name }} + key: {{ .Values.curator.powerbi.adminClientIdSecretRef.key }} +{{ end }} +{{ if and (.Values.curator.powerbi.adminClientSecretSecretRef.name .Values.curator.powerbi.adminClientSecretSecretRef.key) }} +- name: POWER_BI_ADMIN_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.adminClientSecretSecretRef.name }} + key: {{ .Values.curator.powerbi.adminClientSecretSecretRef.key }} +{{ end }} +{{ if .Values.curator.powerbi.redirectURI }} +- name: POWER_BI_REDIRECT_URI + value: {{ .Values.curator.powerbi.redirectURI }} +{{ end }} +{{ if .Values.curator.powerbi.cacheEnabled }} +- name: POWER_BI_CACHE_ENABLED + value: {{ .Values.curator.powerbi.cacheEnabled }} +{{ end }} +{{ if .Values.curator.powerbi.cacheExpirySeconds }} +- name: POWER_BI_CACHE_EXPIRY_SECONDS + value: {{ .Values.curator.powerbi.cacheExpirySeconds }} +{{ end }} +# queue.php +{{ if .Values.curator.queue.connection }} +- name: QUEUE_CONNECTION + value: {{ .Values.curator.queue.connection }} +{{ end }} +# services.php +### +# No configurable items in services +### +# session.php +{{ if .Values.curator.session.sessionDriver }} +- name: SESSION_DRIVER + value: {{ .Values.curator.session.sessionDriver }} +{{ end }} +{{ if .Values.curator.session.sessionCookie }} +- name: SESSION_COOKIE + value: {{ .Values.curator.session.sessionCookie }} +{{ end }} +{{ if .Values.curator.session.sessionSecureCookie }} +- name: SESSION_SECURE_COOKIE + value: {{ .Values.curator.session.sessionSecureCookie }} +{{ end }} +# view.php +### +# No configurable items in view +### + + {{- range .Values.curator.envFromSecret }} - name: {{ .name }} valueFrom: diff --git a/charts/curator/values.yaml b/charts/curator/values.yaml index 383a52d..bd57a90 100644 --- a/charts/curator/values.yaml +++ b/charts/curator/values.yaml @@ -195,7 +195,7 @@ curator: # -- environment variables to pass into cache.php cache: # -- cache type, possible values apc, array, database, file, memcached, redis - type: ~ + driver: ~ # -- cache host host: ~ # -- cache port @@ -207,6 +207,63 @@ curator: routesCache: ~ assetCache: ~ assetMinify: ~ + filesystemsUploadsPath: ~ + filesystemsMediaPath: ~ + enableCSRF: ~ + database: + connection: ~ + host: ~ + name: ~ + username: ~ + password: + secretKeyRef: + name: ~ + key: ~ + filesystems: + driver: ~ + awsBucket: ~ + logging: + channel: ~ + deprecationsChannel: ~ + level: ~ + mail: + host: ~ + port: ~ + password: + secretKeyRef: + name: ~ + key: ~ + username: ~ + fromAddress: ~ + fromName: ~ + powerbi: + clientIdSecretRef: + secretKeyRef: + name: ~ + key: ~ + clientSecretSecretRef: + secretKeyRef: + name: ~ + key: ~ + adminClientIdSecretRef: + secretKeyRef: + name: ~ + key: ~ + adminClientSecretSecretRef: + secretKeyRef: + name: ~ + key: ~ + redirectURI: ~ + cacheEnabled: ~ + cacheExpirySeconds: ~ + queue: + connection: ~ + session: + driver: ~ + cookie: ~ + secureCookie: ~ + + appKeySecret: name: ~ key: ~ From c8be7b262bd53aeb6bdd8df3c1c3ccbf7c4a9a92 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 9 Jun 2026 09:37:25 -0400 Subject: [PATCH 4/8] feat(mail): add ehloDomain --- charts/curator/templates/_env.tpl | 4 ++++ charts/curator/values.yaml | 1 + 2 files changed, 5 insertions(+) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index a75a291..e808470 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -160,6 +160,10 @@ - name: MAIL_FROM_NAME value: {{ .Values.curator.mail.fromName }} {{ end }} +{{ if .Values.curator.mail.ehloDomain }} +- name: MAIL_EHLO_DOMAIN + value: {{ .Values.curator.mail.ehloDomain }} +{{ end }} # powerbi.php {{ if .Values.curator.powerbi.powerBiTenant }} - name: MAIL_FROM_NAME diff --git a/charts/curator/values.yaml b/charts/curator/values.yaml index bd57a90..2feffff 100644 --- a/charts/curator/values.yaml +++ b/charts/curator/values.yaml @@ -236,6 +236,7 @@ curator: username: ~ fromAddress: ~ fromName: ~ + ehloDomain: ~ powerbi: clientIdSecretRef: secretKeyRef: From 9e02818f0ec1671ce04fde817c34768f6b856765 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 11 Aug 2026 09:20:37 -0400 Subject: [PATCH 5/8] fix(config): reconcile env var names with Curator PR #1098 defaults Fixes several bugs that would break existing sites or the migration target: FILESYSTEM_DRIVER/FILESYSTEM_DISK/MEMCACHED_HOST/PORT renamed to match what config/*.php actually reads on InterWorks/Curator#1098, CACHE_HOST/CACHE_PORT restored as always-emitted so zero-touch upgrades keep working, database.php DB_CONNECTION/DB_USERNAME key mismatches, mail/powerbi secretKeyRef double-nesting and copy-paste bugs (POWER_BI_TENANT was emitting MAIL_FROM_NAME), and a template parse error from unbalanced and(...) calls. Adds AWS_ACCESS_KEY_ID/ AWS_SECRET_ACCESS_KEY support to persistence.s3 for sites that need explicit credentials rather than IRSA/instance-role auth. Adds a helm-unittest suite (tests/env.yaml) asserting the zero-touch upgrade contract, the S3-enabled path, and explicit overrides. --- charts/curator/README.md | 51 ++++++++- charts/curator/templates/_env.tpl | 111 +++++++++--------- charts/curator/tests/env.yaml | 184 ++++++++++++++++++++++++++++++ charts/curator/values.yaml | 62 +++++----- 4 files changed, 322 insertions(+), 86 deletions(-) create mode 100644 charts/curator/tests/env.yaml diff --git a/charts/curator/README.md b/charts/curator/README.md index 2ba42a4..ae61dfb 100644 --- a/charts/curator/README.md +++ b/charts/curator/README.md @@ -1,6 +1,6 @@ # curator -![Version: 2.1.0](https://img.shields.io/badge/Version-2.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2025.08-03](https://img.shields.io/badge/AppVersion-2025.08--03-informational?style=flat-square) +![Version: 2.2.0](https://img.shields.io/badge/Version-2.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2025.08-03](https://img.shields.io/badge/AppVersion-2025.08--03-informational?style=flat-square) A Helm chart for Curator in a Container in Kubernetes @@ -17,14 +17,56 @@ A Helm chart for Curator in a Container in Kubernetes | cronjob.affinity | object | `{}` | | | cronjob.env | object | `{}` | | | cronjob.successfulJobsHistoryLimit | int | `1` | | +| curator.app | object | `{"appKeySecret":{"key":null,"name":null},"debug":null}` | environment variables to pass into app.php | | curator.auth.existingSecret | string | `"curator-auth"` | secret to use for initial admin user | -| curator.cache.prefix | string | `""` | cache prefix | -| curator.config | object | `{}` | These are used to override default php config files present in the containers. The files are mounted in the config directory and will append .php to the ends of the keys | +| curator.cache | object | `{"driver":null,"host":null,"port":null,"prefix":null}` | environment variables to pass into cache.php | +| curator.cache.driver | string | `nil` | cache type, possible values apc, array, database, file, memcached, redis | +| curator.cache.host | string | `nil` | memcached host, only used when driver is memcached | +| curator.cache.port | string | `nil` | memcached port, only used when driver is memcached | +| curator.cache.prefix | string | `nil` | cache prefix, defaults to a value derived from APP_NAME if unset | +| curator.cms | object | `{"assetCache":null,"assetMinify":null,"enableCSRF":null,"filesystemDriver":null,"filesystemMediaPath":null,"filesystemUploadsPath":null,"routesCache":null}` | environment variables to pass into cms.php | +| curator.cms.filesystemDriver | string | `nil` | disk used for CMS media/uploads storage, defaults to "s3" if persistence.s3.enabled else "local" | +| curator.config | object | `{}` | If one of these is defined the above config section will no longer be applicable if the new config doesn't utilze environment variables | +| curator.database.connection | string | `nil` | | +| curator.database.databaseName | string | `nil` | | +| curator.database.host | string | `nil` | | +| curator.database.password.secretKeyRef.key | string | `nil` | | +| curator.database.password.secretKeyRef.name | string | `nil` | | +| curator.database.username | string | `nil` | | | curator.env | object | `{}` | environment variables to set in the container | | curator.envFromSecret | list | `[]` | read environment variables from a secret | +| curator.filesystems | object | `{"disk":null}` | environment variables to pass into filesystems.php | +| curator.filesystems.disk | string | `nil` | default filesystem disk, defaults to "s3" if persistence.s3.enabled else "local" | | curator.livenessProbe.failureThreshold | int | `3` | Number of failures before pod is failed | | curator.livenessProbe.periodSeconds | int | `10` | Period to wait between checks | | curator.livenessProbe.timeoutSeconds | int | `15` | Timeout for probe | +| curator.logging.channel | string | `nil` | | +| curator.logging.deprecationsChannel | string | `nil` | | +| curator.logging.level | string | `nil` | | +| curator.mail.ehloDomain | string | `nil` | | +| curator.mail.fromAddress | string | `nil` | | +| curator.mail.fromName | string | `nil` | | +| curator.mail.host | string | `nil` | | +| curator.mail.passwordSecretRef.key | string | `nil` | | +| curator.mail.passwordSecretRef.name | string | `nil` | | +| curator.mail.port | string | `nil` | | +| curator.mail.username | string | `nil` | | +| curator.powerbi.adminClientIdSecretRef.key | string | `nil` | | +| curator.powerbi.adminClientIdSecretRef.name | string | `nil` | | +| curator.powerbi.adminClientSecretSecretRef.key | string | `nil` | | +| curator.powerbi.adminClientSecretSecretRef.name | string | `nil` | | +| curator.powerbi.cacheEnabled | string | `nil` | | +| curator.powerbi.cacheExpirySeconds | string | `nil` | | +| curator.powerbi.clientIdSecretRef.key | string | `nil` | | +| curator.powerbi.clientIdSecretRef.name | string | `nil` | | +| curator.powerbi.clientSecretSecretRef.key | string | `nil` | | +| curator.powerbi.clientSecretSecretRef.name | string | `nil` | | +| curator.powerbi.redirectURI | string | `nil` | | +| curator.powerbi.tenant | string | `nil` | | +| curator.queue.connection | string | `nil` | | +| curator.session.cookie | string | `nil` | | +| curator.session.driver | string | `nil` | | +| curator.session.secureCookie | string | `nil` | | | curator.startupProbe.failureThreshold | int | `10` | | | curator.startupProbe.initialDelaySeconds | int | `10` | | | curator.startupProbe.periodSeconds | int | `10` | | @@ -63,9 +105,12 @@ A Helm chart for Curator in a Container in Kubernetes | persistence.enabled | bool | `true` | enable persistence | | persistence.existingClaim | string | `""` | existingClaim is the name of an existing persistent volume claim to use for storage | | persistence.labels | object | `{}` | persistent volume claim labels | +| persistence.s3.accessKeyIdSecret | object | `{"key":null,"name":null}` | secret containing the AWS access key id, leave unset to rely on IRSA/instance role credentials | | persistence.s3.bucket | string | `"some-bucket"` | bucket to use for storage | | persistence.s3.enabled | bool | `false` | enable S3 storage, if disable and peristence.enabled is true, it will use PVC | +| persistence.s3.endpoint | string | `nil` | custom S3-compatible endpoint, leave unset to use AWS | | persistence.s3.region | string | `""` | region bucket is in | +| persistence.s3.secretAccessKeySecret | object | `{"key":null,"name":null}` | secret containing the AWS secret access key, leave unset to rely on IRSA/instance role credentials | | persistence.size | string | `"5Gi"` | size of persistent volume claim | | persistence.storageClass | string | `nil` | persistent volume claim storageClass | | persistence.subPath | string | `""` | persistent volume claim subpath | diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index e808470..d211437 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -17,21 +17,15 @@ value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} {{ end }} # cache.php -{{ if .Values.curator.cache.driver }} - name: CACHE_DRIVER - value: {{ .Values.curator.cache.driver }} -{{ end }} -{{ if .Values.curator.cache.host }} -- name: CACHE_HOST - value: {{ .Values.curator.cache.host }} -{{ end }} -{{ if .Values.curator.cache.port }} -- name: CACHE_PORT - value: {{ .Values.curator.cache.port }} -{{ end }} + value: {{ .Values.curator.cache.driver | default "memcached" }} +- name: MEMCACHED_HOST + value: {{ .Values.curator.cache.host | default "memcached" }} +- name: MEMCACHED_PORT + value: {{ .Values.curator.cache.port | default "11211" | quote }} {{ if .Values.curator.cache.prefix }} - name: CACHE_PREFIX - value: {{ .Values.curator.cache.prefix | default .Values.environment }} + value: {{ .Values.curator.cache.prefix }} {{ end }} # cms.php {{ if .Values.curator.cms.routesCache }} @@ -46,13 +40,15 @@ - name: ASSET_MINIFY value: {{ .Values.curator.cms.assetMinify }} {{ end }} -{{ if .Values.curator.cms.filesystemsUploadsPath }} +- name: FILESYSTEM_DRIVER + value: {{ .Values.curator.cms.filesystemDriver | default (ternary "s3" "local" .Values.persistence.s3.enabled) }} +{{ if .Values.curator.cms.filesystemUploadsPath }} - name: FILESYSTEM_UPLOADS_PATH - value: {{ .Values.curator.cms.filesystemsUploadsPath }} + value: {{ .Values.curator.cms.filesystemUploadsPath }} {{ end }} -{{ if .Values.curator.cms.filesystemsMediaPath }} +{{ if .Values.curator.cms.filesystemMediaPath }} - name: FILESYSTEM_MEDIA_PATH - value: {{ .Values.curator.cms.filesystemsMediaPath }} + value: {{ .Values.curator.cms.filesystemMediaPath }} {{ end }} {{ if .Values.curator.cms.enableCSRF }} - name: ENABLE_CSRF @@ -60,9 +56,9 @@ {{ end }} # database.php {{ if .Values.curator.database.connection }} -- name: DB_DATABASE - value: {{ .Values.curator.database.connection}} -{{ else }} +- name: DB_CONNECTION + value: {{ .Values.curator.database.connection }} +{{ end }} {{ if .Values.curator.database.host }} - name: DB_HOST value: {{ .Values.curator.database.host }} @@ -77,14 +73,14 @@ - name: DB_DATABASE value: {{ .Values.mariadbOperator.database.name | default .Values.environment }} {{ end }} -{{ if .Values.curator.database.user }} +{{ if .Values.curator.database.username }} - name: DB_USERNAME value: {{ .Values.curator.database.username }} {{ else }} - name: DB_USERNAME value: {{ .Values.mariadbOperator.user.username | default "curator"}} {{ end }} -{{ if and (.Values.curator.database.password.secretKeyRef.name .values.curator.database.password.secretKeyRef.key )}} +{{ if and .Values.curator.database.password.secretKeyRef.name .Values.curator.database.password.secretKeyRef.key }} - name: DB_PASSWORD valueFrom: secretKeyRef: @@ -98,26 +94,33 @@ key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }} {{ end }} # filesystems.php -### -# FILESYSTEM_DRIVER is created above. -# TODO should that go here instead? -### -{{ if .Values.curator.filesystems.filesystemDriver }} -- name: FILESYSTEM_DRIVER - value: {{ .Values.curator.filesystems.filesystemDriver }} -{{ end }} -{{ if .Values.curator.filesystems.awsBucket }} +- name: FILESYSTEM_DISK + value: {{ .Values.curator.filesystems.disk | default (ternary "s3" "local" .Values.persistence.s3.enabled) }} +{{ if .Values.persistence.s3.enabled -}} - name: AWS_BUCKET - value: {{ .Values.curator.filesystems.awsBucket }} + value: {{ .Values.persistence.s3.bucket }} +{{ if .Values.persistence.s3.region }} +- name: AWS_DEFAULT_REGION + value: {{ .Values.persistence.s3.region }} +{{ end }} +{{ if .Values.persistence.s3.endpoint }} +- name: AWS_ENDPOINT + value: {{ .Values.persistence.s3.endpoint }} +{{ end }} +{{ if .Values.persistence.s3.accessKeyIdSecret }} +- name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ .Values.persistence.s3.accessKeyIdSecret.name }} + key: {{ .Values.persistence.s3.accessKeyIdSecret.key }} +{{ end }} +{{ if .Values.persistence.s3.secretAccessKeySecret }} +- name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.persistence.s3.secretAccessKeySecret.name }} + key: {{ .Values.persistence.s3.secretAccessKeySecret.key }} {{ end }} -### -# AWS_DEFAULT_REGION is passed in via the pod identity webhook -### -{{ if .Values.persistence.s3.enabled -}} -- name: S3_BUCKET - value: {{ .Values.persistence.s3.bucket | default .Values.environment }} -- name: S3_REGION - value: {{ .Values.persistence.s3.region | default .Values.environment }} {{- end }} # logging.php {{ if .Values.curator.logging.channel }} @@ -137,12 +140,12 @@ - name: MAIL_HOST value: {{ .Values.curator.mail.host }} {{ end }} -{{ if and (.Values.curator.mail.passwordSecretRef.name .Values.curator.mail.passwordSecretRef.key) }} +{{ if and .Values.curator.mail.passwordSecretRef.name .Values.curator.mail.passwordSecretRef.key }} - name: MAIL_PASSWORD valueFrom: secretKeyRef: name: {{ .Values.curator.mail.passwordSecretRef.name }} - key: {{ .Values.curator.mail.passwordSecretRef.name.key }} + key: {{ .Values.curator.mail.passwordSecretRef.key }} {{ end }} {{ if .Values.curator.mail.port }} - name: MAIL_PORT @@ -165,32 +168,32 @@ value: {{ .Values.curator.mail.ehloDomain }} {{ end }} # powerbi.php -{{ if .Values.curator.powerbi.powerBiTenant }} -- name: MAIL_FROM_NAME - value: {{ .Values.curator.mail.powerBiTenant }} +{{ if .Values.curator.powerbi.tenant }} +- name: POWER_BI_TENANT + value: {{ .Values.curator.powerbi.tenant }} {{ end }} -{{ if and (.Values.curator.powerbi.clientIdSecretRef.name .Values.curator.powerbi.clientIdSecretRef.key) }} +{{ if and .Values.curator.powerbi.clientIdSecretRef.name .Values.curator.powerbi.clientIdSecretRef.key }} - name: POWER_BI_CLIENT_ID valueFrom: secretKeyRef: name: {{ .Values.curator.powerbi.clientIdSecretRef.name }} key: {{ .Values.curator.powerbi.clientIdSecretRef.key }} {{ end }} -{{ if and (.Values.curator.powerbi.clientSecretSecretRef.name .Values.curator.powerbi.clientSecretSecretRef.key) }} +{{ if and .Values.curator.powerbi.clientSecretSecretRef.name .Values.curator.powerbi.clientSecretSecretRef.key }} - name: POWER_BI_CLIENT_SECRET valueFrom: secretKeyRef: name: {{ .Values.curator.powerbi.clientSecretSecretRef.name }} key: {{ .Values.curator.powerbi.clientSecretSecretRef.key }} {{ end }} -{{ if and (.Values.curator.powerbi.adminClientIdSecretRef.name .Values.curator.powerbi.adminClientIdSecretRef.key) }} +{{ if and .Values.curator.powerbi.adminClientIdSecretRef.name .Values.curator.powerbi.adminClientIdSecretRef.key }} - name: POWER_BI_ADMIN_CLIENT_ID valueFrom: secretKeyRef: name: {{ .Values.curator.powerbi.adminClientIdSecretRef.name }} key: {{ .Values.curator.powerbi.adminClientIdSecretRef.key }} {{ end }} -{{ if and (.Values.curator.powerbi.adminClientSecretSecretRef.name .Values.curator.powerbi.adminClientSecretSecretRef.key) }} +{{ if and .Values.curator.powerbi.adminClientSecretSecretRef.name .Values.curator.powerbi.adminClientSecretSecretRef.key }} - name: POWER_BI_ADMIN_CLIENT_SECRET valueFrom: secretKeyRef: @@ -219,17 +222,17 @@ # No configurable items in services ### # session.php -{{ if .Values.curator.session.sessionDriver }} +{{ if .Values.curator.session.driver }} - name: SESSION_DRIVER - value: {{ .Values.curator.session.sessionDriver }} + value: {{ .Values.curator.session.driver }} {{ end }} -{{ if .Values.curator.session.sessionCookie }} +{{ if .Values.curator.session.cookie }} - name: SESSION_COOKIE - value: {{ .Values.curator.session.sessionCookie }} + value: {{ .Values.curator.session.cookie }} {{ end }} -{{ if .Values.curator.session.sessionSecureCookie }} +{{ if .Values.curator.session.secureCookie }} - name: SESSION_SECURE_COOKIE - value: {{ .Values.curator.session.sessionSecureCookie }} + value: {{ .Values.curator.session.secureCookie }} {{ end }} # view.php ### diff --git a/charts/curator/tests/env.yaml b/charts/curator/tests/env.yaml new file mode 100644 index 0000000..5da7cfc --- /dev/null +++ b/charts/curator/tests/env.yaml @@ -0,0 +1,184 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json +suite: test env.environment (config migration contract) +templates: + - deployment.yaml +tests: + - it: renders identical env vars for sites that upgrade with no values.yaml changes + set: + ingress.hosts: + - host: curator.example.com + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_DRIVER + value: memcached + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_HOST + value: memcached + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_PORT + value: "11211" + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: APP_URL + value: curator.example.com + - notContains: + path: spec.template.spec.containers[0].env + content: + name: AWS_BUCKET + - notContains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_PREFIX + + - it: switches storage to s3 when persistence.s3.enabled is set, with AWS credentials from secrets + set: + ingress.hosts: + - host: curator.example.com + persistence.s3.enabled: true + persistence.s3.bucket: my-bucket + persistence.s3.region: us-east-1 + persistence.s3.accessKeyIdSecret.name: aws-creds + persistence.s3.accessKeyIdSecret.key: access-key-id + persistence.s3.secretAccessKeySecret.name: aws-creds + persistence.s3.secretAccessKeySecret.key: secret-access-key + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: s3 + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: s3 + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_BUCKET + value: my-bucket + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_DEFAULT_REGION + value: us-east-1 + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: aws-creds + key: access-key-id + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: aws-creds + key: secret-access-key + + - it: honors explicit overrides for cache, cms, database, filesystems, mail and powerbi settings + set: + ingress.hosts: + - host: curator.example.com + curator.cache.driver: redis + curator.cache.host: my-redis + curator.cache.port: "6379" + curator.cache.prefix: my-prefix + curator.cms.filesystemDriver: local + curator.database.host: external-db + curator.database.databaseName: custom-db + curator.database.username: custom-user + curator.filesystems.disk: local + curator.mail.host: smtp.example.com + curator.mail.passwordSecretRef.name: mail-secret + curator.mail.passwordSecretRef.key: password + curator.powerbi.tenant: my-tenant + curator.powerbi.clientIdSecretRef.name: powerbi-secret + curator.powerbi.clientIdSecretRef.key: client-id + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_DRIVER + value: redis + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_HOST + value: my-redis + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_PREFIX + value: my-prefix + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_HOST + value: external-db + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_DATABASE + value: custom-db + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_USERNAME + value: custom-user + - contains: + path: spec.template.spec.containers[0].env + content: + name: MAIL_HOST + value: smtp.example.com + - contains: + path: spec.template.spec.containers[0].env + content: + name: MAIL_PASSWORD + valueFrom: + secretKeyRef: + name: mail-secret + key: password + - contains: + path: spec.template.spec.containers[0].env + content: + name: POWER_BI_TENANT + value: my-tenant + - contains: + path: spec.template.spec.containers[0].env + content: + name: POWER_BI_CLIENT_ID + valueFrom: + secretKeyRef: + name: powerbi-secret + key: client-id diff --git a/charts/curator/values.yaml b/charts/curator/values.yaml index 2feffff..0c0ef0c 100644 --- a/charts/curator/values.yaml +++ b/charts/curator/values.yaml @@ -115,6 +115,16 @@ persistence: bucket: some-bucket # -- region bucket is in region: "" + # -- custom S3-compatible endpoint, leave unset to use AWS + endpoint: ~ + # -- secret containing the AWS access key id, leave unset to rely on IRSA/instance role credentials + accessKeyIdSecret: + name: ~ + key: ~ + # -- secret containing the AWS secret access key, leave unset to rely on IRSA/instance role credentials + secretAccessKeySecret: + name: ~ + key: ~ # -- existingClaim is the name of an existing persistent volume claim to use for storage existingClaim: "" @@ -196,32 +206,35 @@ curator: cache: # -- cache type, possible values apc, array, database, file, memcached, redis driver: ~ - # -- cache host + # -- memcached host, only used when driver is memcached host: ~ - # -- cache port + # -- memcached port, only used when driver is memcached port: ~ - # -- cache prefix + # -- cache prefix, defaults to a value derived from APP_NAME if unset prefix: ~ # -- environment variables to pass into cms.php cms: routesCache: ~ assetCache: ~ assetMinify: ~ - filesystemsUploadsPath: ~ - filesystemsMediaPath: ~ + # -- disk used for CMS media/uploads storage, defaults to "s3" if persistence.s3.enabled else "local" + filesystemDriver: ~ + filesystemUploadsPath: ~ + filesystemMediaPath: ~ enableCSRF: ~ database: connection: ~ host: ~ - name: ~ + databaseName: ~ username: ~ password: secretKeyRef: name: ~ key: ~ + # -- environment variables to pass into filesystems.php filesystems: - driver: ~ - awsBucket: ~ + # -- default filesystem disk, defaults to "s3" if persistence.s3.enabled else "local" + disk: ~ logging: channel: ~ deprecationsChannel: ~ @@ -229,31 +242,27 @@ curator: mail: host: ~ port: ~ - password: - secretKeyRef: - name: ~ - key: ~ + passwordSecretRef: + name: ~ + key: ~ username: ~ fromAddress: ~ fromName: ~ ehloDomain: ~ powerbi: + tenant: ~ clientIdSecretRef: - secretKeyRef: - name: ~ - key: ~ + name: ~ + key: ~ clientSecretSecretRef: - secretKeyRef: - name: ~ - key: ~ + name: ~ + key: ~ adminClientIdSecretRef: - secretKeyRef: - name: ~ - key: ~ + name: ~ + key: ~ adminClientSecretSecretRef: - secretKeyRef: - name: ~ - key: ~ + name: ~ + key: ~ redirectURI: ~ cacheEnabled: ~ cacheExpirySeconds: ~ @@ -263,11 +272,6 @@ curator: driver: ~ cookie: ~ secureCookie: ~ - - - appKeySecret: - name: ~ - key: ~ ## Initial Admin parameters auth: # -- secret to use for initial admin user From 17c125c4f5596356c173174cf7d54b06aff54d45 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 11 Aug 2026 09:55:11 -0400 Subject: [PATCH 6/8] feat(config): add per-config-file env vars aligned with Curator defaults Adds Helm values/env vars for app.php, cache.php, cms.php, database.php, filesystems.php, logging.php, mail.php, powerbi.php, and session.php, matching the env var names and defaults on InterWorks/Curator#1098 so existing sites upgrade with no values.yaml changes required. Existing hardcoded defaults (memcached host/port, local vs s3 disk) are preserved via Helm defaults rather than PHP-side fallbacks, since the prefix/cache defaults changed between the two PRs. Adds optional AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY secretKeyRef support to persistence.s3 for sites that need explicit credentials rather than IRSA/instance-role auth, and a curator.database.host override wired into curatorDbEndpoint and the two job templates that hardcode the -primary suffix. Adds a helm-unittest suite (tests/env_test.yaml) covering the zero-touch upgrade contract, the S3-enabled path, and explicit per-config overrides. --- charts/curator/README.md | 49 +++- charts/curator/templates/_env.tpl | 237 ++++++++++++++++-- charts/curator/templates/_helpers.tpl | 8 +- .../curator/templates/job-create-admin.yaml | 2 +- charts/curator/templates/job-db-migrate.yaml | 2 +- charts/curator/tests/env_test.yaml | 184 ++++++++++++++ charts/curator/values.yaml | 89 ++++++- 7 files changed, 546 insertions(+), 25 deletions(-) create mode 100644 charts/curator/tests/env_test.yaml diff --git a/charts/curator/README.md b/charts/curator/README.md index 2d8c3ab..b18a8ae 100644 --- a/charts/curator/README.md +++ b/charts/curator/README.md @@ -18,21 +18,63 @@ A Helm chart for Curator in a Container in Kubernetes | cronjob.env | object | `{}` | | | cronjob.nodeSelector | object | `{}` | | | cronjob.successfulJobsHistoryLimit | int | `1` | | +| curator.app | object | `{"appKeySecret":{"key":null,"name":null},"debug":null}` | environment variables to pass into app.php | | curator.auth.existingSecret | string | `"curator-auth"` | secret to use for initial admin user | -| curator.cache.prefix | string | `""` | cache prefix | -| curator.config | object | `{}` | These are used to override default php config files present in the containers. The files are mounted in the config directory and will append .php to the ends of the keys | +| curator.cache | object | `{"driver":null,"host":null,"port":null,"prefix":null}` | environment variables to pass into cache.php | +| curator.cache.driver | string | `nil` | cache type, possible values apc, array, database, file, memcached, redis | +| curator.cache.host | string | `nil` | memcached host, only used when driver is memcached | +| curator.cache.port | string | `nil` | memcached port, only used when driver is memcached | +| curator.cache.prefix | string | `nil` | cache prefix, defaults to a value derived from APP_NAME if unset | +| curator.cms | object | `{"assetCache":null,"assetMinify":null,"enableCSRF":null,"filesystemDriver":null,"filesystemMediaPath":null,"filesystemUploadsPath":null,"routesCache":null}` | environment variables to pass into cms.php | +| curator.cms.filesystemDriver | string | `nil` | disk used for CMS media/uploads storage, defaults to "s3" if persistence.s3.enabled else "local" | +| curator.config | object | `{}` | If one of these is defined the above config section will no longer be applicable if the new config doesn't utilze environment variables | +| curator.database.connection | string | `nil` | | +| curator.database.databaseName | string | `nil` | | +| curator.database.host | string | `nil` | | +| curator.database.password.secretKeyRef.key | string | `nil` | | +| curator.database.password.secretKeyRef.name | string | `nil` | | +| curator.database.username | string | `nil` | | | curator.env | object | `{}` | environment variables to set in the container | | curator.envFromSecret | list | `[]` | read environment variables from a secret | +| curator.filesystems | object | `{"disk":null}` | environment variables to pass into filesystems.php | +| curator.filesystems.disk | string | `nil` | default filesystem disk, defaults to "s3" if persistence.s3.enabled else "local" | | curator.livenessProbe.failureThreshold | int | `3` | Number of failures before pod is failed | | curator.livenessProbe.path | string | `"/ping"` | Endpoint the probe hits; keep it cheap and dependency-free | | curator.livenessProbe.periodSeconds | int | `10` | Period to wait between checks | | curator.livenessProbe.timeoutSeconds | int | `15` | Timeout for probe | +| curator.logging.channel | string | `nil` | | +| curator.logging.deprecationsChannel | string | `nil` | | +| curator.logging.level | string | `nil` | | +| curator.mail.ehloDomain | string | `nil` | | +| curator.mail.fromAddress | string | `nil` | | +| curator.mail.fromName | string | `nil` | | +| curator.mail.host | string | `nil` | | +| curator.mail.passwordSecretRef.key | string | `nil` | | +| curator.mail.passwordSecretRef.name | string | `nil` | | +| curator.mail.port | string | `nil` | | +| curator.mail.username | string | `nil` | | +| curator.powerbi.adminClientIdSecretRef.key | string | `nil` | | +| curator.powerbi.adminClientIdSecretRef.name | string | `nil` | | +| curator.powerbi.adminClientSecretSecretRef.key | string | `nil` | | +| curator.powerbi.adminClientSecretSecretRef.name | string | `nil` | | +| curator.powerbi.cacheEnabled | string | `nil` | | +| curator.powerbi.cacheExpirySeconds | string | `nil` | | +| curator.powerbi.clientIdSecretRef.key | string | `nil` | | +| curator.powerbi.clientIdSecretRef.name | string | `nil` | | +| curator.powerbi.clientSecretSecretRef.key | string | `nil` | | +| curator.powerbi.clientSecretSecretRef.name | string | `nil` | | +| curator.powerbi.redirectURI | string | `nil` | | +| curator.powerbi.tenant | string | `nil` | | +| curator.queue.connection | string | `nil` | | | curator.readinessProbe.failureThreshold | int | `3` | Number of failures before the pod is removed from the Service endpoints | | curator.readinessProbe.path | string | `"/healthz"` | Endpoint the probe hits; /healthz verifies the database is reachable | | curator.readinessProbe.periodSeconds | int | `10` | Period to wait between checks | | curator.readinessProbe.timeoutSeconds | int | `15` | Timeout for probe | | curator.sentry.dsn | string | `""` | Sentry Laravel DSN for error reporting | | curator.sentry.environment | string | `""` | Sentry Laravel environment name, defaults to the Helm release name if not set | +| curator.session.cookie | string | `nil` | | +| curator.session.driver | string | `nil` | | +| curator.session.secureCookie | string | `nil` | | | curator.startupProbe.failureThreshold | int | `10` | | | curator.startupProbe.initialDelaySeconds | int | `10` | | | curator.startupProbe.path | string | `"/ping"` | Endpoint the probe hits; keep it cheap and dependency-free | @@ -74,9 +116,12 @@ A Helm chart for Curator in a Container in Kubernetes | persistence.enabled | bool | `true` | enable persistence | | persistence.existingClaim | string | `""` | existingClaim is the name of an existing persistent volume claim to use for storage | | persistence.labels | object | `{}` | persistent volume claim labels | +| persistence.s3.accessKeyIdSecret | object | `{"key":null,"name":null}` | secret containing the AWS access key id, leave unset to rely on IRSA/instance role credentials | | persistence.s3.bucket | string | `"some-bucket"` | bucket to use for storage | | persistence.s3.enabled | bool | `false` | enable S3 storage, if disable and peristence.enabled is true, it will use PVC | +| persistence.s3.endpoint | string | `nil` | custom S3-compatible endpoint, leave unset to use AWS | | persistence.s3.region | string | `""` | region bucket is in | +| persistence.s3.secretAccessKeySecret | object | `{"key":null,"name":null}` | secret containing the AWS secret access key, leave unset to rely on IRSA/instance role credentials | | persistence.size | string | `"5Gi"` | size of persistent volume claim | | persistence.storageClass | string | `nil` | persistent volume claim storageClass | | persistence.subPath | string | `""` | persistent volume claim subpath | diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index e56710e..7816d94 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -1,29 +1,236 @@ -{{- define "env.environment" -}} +{{ define "env.environment" }} +# app.php +{{ if .Values.curator.app.debug }} +- name: APP_DEBUG + value: {{ .Values.curator.app.debug }} +{{ end }} +{{ with (first .Values.ingress.hosts) -}} +- name: APP_URL + value: {{ .host }} +{{ end -}} +# TODO account for old value location +{{ if .Values.curator.app.appKeySecret }} +- name: APP_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }} + value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} +{{ end }} +# cache.php +- name: CACHE_DRIVER + value: {{ .Values.curator.cache.driver | default "memcached" }} +- name: MEMCACHED_HOST + value: {{ .Values.curator.cache.host | default "memcached" }} +- name: MEMCACHED_PORT + value: {{ .Values.curator.cache.port | default "11211" | quote }} +{{ if .Values.curator.cache.prefix }} +- name: CACHE_PREFIX + value: {{ .Values.curator.cache.prefix }} +{{ end }} +# cms.php +{{ if .Values.curator.cms.routesCache }} +- name: ROUTES_CACHE + value: {{ .Values.curator.cms.routesCache }} +{{ end }} +{{ if .Values.curator.cms.assetCache }} +- name: ASSET_CACHE + value: {{ .Values.curator.cms.assetCache }} +{{ end }} +{{ if .Values.curator.cms.assetMinify }} +- name: ASSET_MINIFY + value: {{ .Values.curator.cms.assetMinify }} +{{ end }} +- name: FILESYSTEM_DRIVER + value: {{ .Values.curator.cms.filesystemDriver | default (ternary "s3" "local" .Values.persistence.s3.enabled) }} +{{ if .Values.curator.cms.filesystemUploadsPath }} +- name: FILESYSTEM_UPLOADS_PATH + value: {{ .Values.curator.cms.filesystemUploadsPath }} +{{ end }} +{{ if .Values.curator.cms.filesystemMediaPath }} +- name: FILESYSTEM_MEDIA_PATH + value: {{ .Values.curator.cms.filesystemMediaPath }} +{{ end }} +{{ if .Values.curator.cms.enableCSRF }} +- name: ENABLE_CSRF + value: {{ .Values.curator.cms.enableCSRF }} +{{ end }} +# database.php +{{ if .Values.curator.database.connection }} +- name: DB_CONNECTION + value: {{ .Values.curator.database.connection }} +{{ end }} +{{ if .Values.curator.database.databaseName }} +- name: DB_DATABASE + value: {{ .Values.curator.database.databaseName}} +{{ else }} - name: DB_DATABASE value: {{ .Values.mariadbOperator.database.name | default .Values.environment }} +{{ end }} +{{ if .Values.curator.database.username }} +- name: DB_USERNAME + value: {{ .Values.curator.database.username }} +{{ else }} - name: DB_USERNAME value: {{ .Values.mariadbOperator.user.username | default "curator"}} +{{ end }} +{{ if and .Values.curator.database.password.secretKeyRef.name .Values.curator.database.password.secretKeyRef.key }} +- name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.curator.database.password.secretKeyRef.name }} + key: {{ .Values.curator.database.password.secretKeyRef.key }} +{{ else }} - name: DB_PASSWORD valueFrom: secretKeyRef: name: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.name | default (printf "%s-mariadb" .Values.environment) }} key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }} -- name: CACHE_HOST - value: "memcached" -- name: CACHE_PORT - value: "11211" -- name: CACHE_PREFIX - value: {{ .Values.curator.cache.prefix | default .Values.environment }} -{{ with (first .Values.ingress.hosts) -}} -- name: APP_URL - value: {{ .host }} -{{ end -}} +{{ end }} +# filesystems.php +- name: FILESYSTEM_DISK + value: {{ .Values.curator.filesystems.disk | default (ternary "s3" "local" .Values.persistence.s3.enabled) }} {{ if .Values.persistence.s3.enabled -}} -- name: S3_BUCKET - value: {{ .Values.persistence.s3.bucket | default .Values.environment }} -- name: S3_REGION - value: {{ .Values.persistence.s3.region | default .Values.environment }} +- name: AWS_BUCKET + value: {{ .Values.persistence.s3.bucket }} +{{ if .Values.persistence.s3.region }} +- name: AWS_DEFAULT_REGION + value: {{ .Values.persistence.s3.region }} +{{ end }} +{{ if .Values.persistence.s3.endpoint }} +- name: AWS_ENDPOINT + value: {{ .Values.persistence.s3.endpoint }} +{{ end }} +{{ if .Values.persistence.s3.accessKeyIdSecret }} +- name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ .Values.persistence.s3.accessKeyIdSecret.name }} + key: {{ .Values.persistence.s3.accessKeyIdSecret.key }} +{{ end }} +{{ if .Values.persistence.s3.secretAccessKeySecret }} +- name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.persistence.s3.secretAccessKeySecret.name }} + key: {{ .Values.persistence.s3.secretAccessKeySecret.key }} +{{ end }} {{- end }} +# logging.php +{{ if .Values.curator.logging.channel }} +- name: LOG_CHANNEL + value: {{ .Values.curator.logging.channel }} +{{ end }} +{{ if .Values.curator.logging.deprecationsChannel }} +- name: LOG_DEPRECATIONS_CHANNEL + value: {{ .Values.curator.logging.deprecationsChannel }} +{{ end }} +{{ if .Values.curator.logging.level }} +- name: LOG_LEVEL + value: {{ .Values.curator.logging.level }} +{{ end }} +# mail.php +{{ if .Values.curator.mail.host }} +- name: MAIL_HOST + value: {{ .Values.curator.mail.host }} +{{ end }} +{{ if and .Values.curator.mail.passwordSecretRef.name .Values.curator.mail.passwordSecretRef.key }} +- name: MAIL_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.curator.mail.passwordSecretRef.name }} + key: {{ .Values.curator.mail.passwordSecretRef.key }} +{{ end }} +{{ if .Values.curator.mail.port }} +- name: MAIL_PORT + value: {{ .Values.curator.mail.port }} +{{ end }} +{{ if .Values.curator.mail.username }} +- name: MAIL_USERNAME + value: {{ .Values.curator.mail.username }} +{{ end }} +{{ if .Values.curator.mail.fromAddress }} +- name: MAIL_FROM_ADDRESS + value: {{ .Values.curator.mail.fromAddress }} +{{ end }} +{{ if .Values.curator.mail.fromName }} +- name: MAIL_FROM_NAME + value: {{ .Values.curator.mail.fromName }} +{{ end }} +{{ if .Values.curator.mail.ehloDomain }} +- name: MAIL_EHLO_DOMAIN + value: {{ .Values.curator.mail.ehloDomain }} +{{ end }} +# powerbi.php +{{ if .Values.curator.powerbi.tenant }} +- name: POWER_BI_TENANT + value: {{ .Values.curator.powerbi.tenant }} +{{ end }} +{{ if and .Values.curator.powerbi.clientIdSecretRef.name .Values.curator.powerbi.clientIdSecretRef.key }} +- name: POWER_BI_CLIENT_ID + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.clientIdSecretRef.name }} + key: {{ .Values.curator.powerbi.clientIdSecretRef.key }} +{{ end }} +{{ if and .Values.curator.powerbi.clientSecretSecretRef.name .Values.curator.powerbi.clientSecretSecretRef.key }} +- name: POWER_BI_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.clientSecretSecretRef.name }} + key: {{ .Values.curator.powerbi.clientSecretSecretRef.key }} +{{ end }} +{{ if and .Values.curator.powerbi.adminClientIdSecretRef.name .Values.curator.powerbi.adminClientIdSecretRef.key }} +- name: POWER_BI_ADMIN_CLIENT_ID + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.adminClientIdSecretRef.name }} + key: {{ .Values.curator.powerbi.adminClientIdSecretRef.key }} +{{ end }} +{{ if and .Values.curator.powerbi.adminClientSecretSecretRef.name .Values.curator.powerbi.adminClientSecretSecretRef.key }} +- name: POWER_BI_ADMIN_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Values.curator.powerbi.adminClientSecretSecretRef.name }} + key: {{ .Values.curator.powerbi.adminClientSecretSecretRef.key }} +{{ end }} +{{ if .Values.curator.powerbi.redirectURI }} +- name: POWER_BI_REDIRECT_URI + value: {{ .Values.curator.powerbi.redirectURI }} +{{ end }} +{{ if .Values.curator.powerbi.cacheEnabled }} +- name: POWER_BI_CACHE_ENABLED + value: {{ .Values.curator.powerbi.cacheEnabled }} +{{ end }} +{{ if .Values.curator.powerbi.cacheExpirySeconds }} +- name: POWER_BI_CACHE_EXPIRY_SECONDS + value: {{ .Values.curator.powerbi.cacheExpirySeconds }} +{{ end }} +# queue.php +{{ if .Values.curator.queue.connection }} +- name: QUEUE_CONNECTION + value: {{ .Values.curator.queue.connection }} +{{ end }} +# services.php +### +# No configurable items in services +### +# session.php +{{ if .Values.curator.session.driver }} +- name: SESSION_DRIVER + value: {{ .Values.curator.session.driver }} +{{ end }} +{{ if .Values.curator.session.cookie }} +- name: SESSION_COOKIE + value: {{ .Values.curator.session.cookie }} +{{ end }} +{{ if .Values.curator.session.secureCookie }} +- name: SESSION_SECURE_COOKIE + value: {{ .Values.curator.session.secureCookie }} +{{ end }} +# view.php +### +# No configurable items in view +### {{- if .Values.curator.sentry.dsn }} - name: SENTRY_LARAVEL_DSN value: {{ .Values.curator.sentry.dsn }} diff --git a/charts/curator/templates/_helpers.tpl b/charts/curator/templates/_helpers.tpl index 6aeee85..40daa29 100644 --- a/charts/curator/templates/_helpers.tpl +++ b/charts/curator/templates/_helpers.tpl @@ -137,11 +137,13 @@ limits: {{/* Determines which mariadb endpoint to use Determination order: -Maxscale -> mariadbEndpoint -> mariadb +curator.database.host -> Maxscale -> mariadbEndpoint -> mariadb */}} {{- define "curatorDbEndpoint" -}} -{{/* Use maxscale for db endpoint */}} -{{- if (and .Values.mariadbOperator.maxscaleEndpoint .Values.mariadbOperator.mariadbNamespace) -}} +{{- if .Values.curator.database.host -}} +{{ .Values.curator.database.host }} +{{- /* Use maxscale for db endpoint */ -}} +{{- else if (and .Values.mariadbOperator.maxscaleEndpoint .Values.mariadbOperator.mariadbNamespace) -}} {{ .Values.mariadbOperator.maxscaleEndpoint }}.{{ .Values.mariadbOperator.mariadbNamespace }} {{- /* Use mariadbEndpoint for db endpoint */ -}} {{- else if (and .Values.mariadbOperator.mariadbEndpoint .Values.mariadbOperator.mariadbNamespace) -}} diff --git a/charts/curator/templates/job-create-admin.yaml b/charts/curator/templates/job-create-admin.yaml index 2692a8f..b6cc790 100644 --- a/charts/curator/templates/job-create-admin.yaml +++ b/charts/curator/templates/job-create-admin.yaml @@ -57,7 +57,7 @@ spec: name: {{ .Release.Name }}-admin key: admin-user - name: DB_HOST - value: {{ .Values.mariadbOperator.mariadbName }}-primary.{{ .Values.mariadbOperator.mariadbNamespace | default .Release.Namespace }} + value: {{ .Values.curator.database.host | default (printf "%s-primary.%s" .Values.mariadbOperator.mariadbName (.Values.mariadbOperator.mariadbNamespace | default .Release.Namespace)) }} {{- range $key, $value := .Values.curator.env }} - name: "{{ $key }}" value: "{{ $value }}" diff --git a/charts/curator/templates/job-db-migrate.yaml b/charts/curator/templates/job-db-migrate.yaml index 6f7d878..3ca98fe 100644 --- a/charts/curator/templates/job-db-migrate.yaml +++ b/charts/curator/templates/job-db-migrate.yaml @@ -47,7 +47,7 @@ spec: env: {{- include "env.environment" . | nindent 10 }} - name: DB_HOST - value: {{ .Values.mariadbOperator.mariadbName }}-primary.{{ .Values.mariadbOperator.mariadbNamespace | default .Release.Namespace }} + value: {{ .Values.curator.database.host | default (printf "%s-primary.%s" .Values.mariadbOperator.mariadbName (.Values.mariadbOperator.mariadbNamespace | default .Release.Namespace)) }} {{- range $key, $value := .Values.curator.env }} - name: "{{ $key }}" value: "{{ $value }}" diff --git a/charts/curator/tests/env_test.yaml b/charts/curator/tests/env_test.yaml new file mode 100644 index 0000000..5da7cfc --- /dev/null +++ b/charts/curator/tests/env_test.yaml @@ -0,0 +1,184 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json +suite: test env.environment (config migration contract) +templates: + - deployment.yaml +tests: + - it: renders identical env vars for sites that upgrade with no values.yaml changes + set: + ingress.hosts: + - host: curator.example.com + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_DRIVER + value: memcached + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_HOST + value: memcached + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_PORT + value: "11211" + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: APP_URL + value: curator.example.com + - notContains: + path: spec.template.spec.containers[0].env + content: + name: AWS_BUCKET + - notContains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_PREFIX + + - it: switches storage to s3 when persistence.s3.enabled is set, with AWS credentials from secrets + set: + ingress.hosts: + - host: curator.example.com + persistence.s3.enabled: true + persistence.s3.bucket: my-bucket + persistence.s3.region: us-east-1 + persistence.s3.accessKeyIdSecret.name: aws-creds + persistence.s3.accessKeyIdSecret.key: access-key-id + persistence.s3.secretAccessKeySecret.name: aws-creds + persistence.s3.secretAccessKeySecret.key: secret-access-key + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: s3 + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: s3 + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_BUCKET + value: my-bucket + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_DEFAULT_REGION + value: us-east-1 + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: aws-creds + key: access-key-id + - contains: + path: spec.template.spec.containers[0].env + content: + name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: aws-creds + key: secret-access-key + + - it: honors explicit overrides for cache, cms, database, filesystems, mail and powerbi settings + set: + ingress.hosts: + - host: curator.example.com + curator.cache.driver: redis + curator.cache.host: my-redis + curator.cache.port: "6379" + curator.cache.prefix: my-prefix + curator.cms.filesystemDriver: local + curator.database.host: external-db + curator.database.databaseName: custom-db + curator.database.username: custom-user + curator.filesystems.disk: local + curator.mail.host: smtp.example.com + curator.mail.passwordSecretRef.name: mail-secret + curator.mail.passwordSecretRef.key: password + curator.powerbi.tenant: my-tenant + curator.powerbi.clientIdSecretRef.name: powerbi-secret + curator.powerbi.clientIdSecretRef.key: client-id + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_DRIVER + value: redis + - contains: + path: spec.template.spec.containers[0].env + content: + name: MEMCACHED_HOST + value: my-redis + - contains: + path: spec.template.spec.containers[0].env + content: + name: CACHE_PREFIX + value: my-prefix + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DRIVER + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: FILESYSTEM_DISK + value: local + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_HOST + value: external-db + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_DATABASE + value: custom-db + - contains: + path: spec.template.spec.containers[0].env + content: + name: DB_USERNAME + value: custom-user + - contains: + path: spec.template.spec.containers[0].env + content: + name: MAIL_HOST + value: smtp.example.com + - contains: + path: spec.template.spec.containers[0].env + content: + name: MAIL_PASSWORD + valueFrom: + secretKeyRef: + name: mail-secret + key: password + - contains: + path: spec.template.spec.containers[0].env + content: + name: POWER_BI_TENANT + value: my-tenant + - contains: + path: spec.template.spec.containers[0].env + content: + name: POWER_BI_CLIENT_ID + valueFrom: + secretKeyRef: + name: powerbi-secret + key: client-id diff --git a/charts/curator/values.yaml b/charts/curator/values.yaml index 5b7ff70..8f08e51 100644 --- a/charts/curator/values.yaml +++ b/charts/curator/values.yaml @@ -115,7 +115,16 @@ persistence: bucket: some-bucket # -- region bucket is in region: "" - + # -- custom S3-compatible endpoint, leave unset to use AWS + endpoint: ~ + # -- secret containing the AWS access key id, leave unset to rely on IRSA/instance role credentials + accessKeyIdSecret: + name: ~ + key: ~ + # -- secret containing the AWS secret access key, leave unset to rely on IRSA/instance role credentials + secretAccessKeySecret: + name: ~ + key: ~ # -- existingClaim is the name of an existing persistent volume claim to use for storage existingClaim: "" # -- size of persistent volume claim @@ -186,14 +195,87 @@ curator: # -- environment variables to set in the container env: {} # KEY: VALUE + # -- environment variables to pass into app.php + app: + debug: ~ + appKeySecret: + name: ~ + key: ~ sentry: # -- Sentry Laravel DSN for error reporting dsn: "" # -- Sentry Laravel environment name, defaults to the Helm release name if not set environment: "" + # -- environment variables to pass into cache.php cache: - # -- cache prefix - prefix: "" + # -- cache type, possible values apc, array, database, file, memcached, redis + driver: ~ + # -- memcached host, only used when driver is memcached + host: ~ + # -- memcached port, only used when driver is memcached + port: ~ + # -- cache prefix, defaults to a value derived from APP_NAME if unset + prefix: ~ + # -- environment variables to pass into cms.php + cms: + routesCache: ~ + assetCache: ~ + assetMinify: ~ + # -- disk used for CMS media/uploads storage, defaults to "s3" if persistence.s3.enabled else "local" + filesystemDriver: ~ + filesystemUploadsPath: ~ + filesystemMediaPath: ~ + enableCSRF: ~ + database: + connection: ~ + host: ~ + databaseName: ~ + username: ~ + password: + secretKeyRef: + name: ~ + key: ~ + # -- environment variables to pass into filesystems.php + filesystems: + # -- default filesystem disk, defaults to "s3" if persistence.s3.enabled else "local" + disk: ~ + logging: + channel: ~ + deprecationsChannel: ~ + level: ~ + mail: + host: ~ + port: ~ + passwordSecretRef: + name: ~ + key: ~ + username: ~ + fromAddress: ~ + fromName: ~ + ehloDomain: ~ + powerbi: + tenant: ~ + clientIdSecretRef: + name: ~ + key: ~ + clientSecretSecretRef: + name: ~ + key: ~ + adminClientIdSecretRef: + name: ~ + key: ~ + adminClientSecretSecretRef: + name: ~ + key: ~ + redirectURI: ~ + cacheEnabled: ~ + cacheExpirySeconds: ~ + queue: + connection: ~ + session: + driver: ~ + cookie: ~ + secureCookie: ~ ## Initial Admin parameters auth: # -- secret to use for initial admin user @@ -234,6 +316,7 @@ curator: # -- Timeout for probe timeoutSeconds: 15 # -- These are used to override default php config files present in the containers. The files are mounted in the config directory and will append .php to the ends of the keys + # -- If one of these is defined the above config section will no longer be applicable if the new config doesn't utilze environment variables config: {} # app: "" # auth: "" From ae4e88652fe9f74f6cfebe7b693f7c920bd6b3ef Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 11 Aug 2026 13:35:47 -0400 Subject: [PATCH 7/8] fix(env): fixes app_key secretKeyRef --- charts/curator/templates/_env.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index 7816d94..a76b031 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -14,7 +14,7 @@ valueFrom: secretKeyRef: name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }} - value: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} + key: {{ .Values.curator.app.appKeySecret.key | default "app-key"}} {{ end }} # cache.php - name: CACHE_DRIVER From e9f81a9efca62ff301efad00963e5d41882d4165 Mon Sep 17 00:00:00 2001 From: Henry Arend Date: Tue, 11 Aug 2026 14:00:04 -0400 Subject: [PATCH 8/8] fix(config): quotes values that would only be numeric --- charts/curator/templates/_env.tpl | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/curator/templates/_env.tpl b/charts/curator/templates/_env.tpl index a76b031..cda9658 100644 --- a/charts/curator/templates/_env.tpl +++ b/charts/curator/templates/_env.tpl @@ -9,7 +9,7 @@ value: {{ .host }} {{ end -}} # TODO account for old value location -{{ if .Values.curator.app.appKeySecret }} +{{ if and (.Values.curator.app.appKeySecret.name .Values.curator.app.appKeySecret.key) }} - name: APP_KEY valueFrom: secretKeyRef: @@ -100,14 +100,14 @@ - name: AWS_ENDPOINT value: {{ .Values.persistence.s3.endpoint }} {{ end }} -{{ if .Values.persistence.s3.accessKeyIdSecret }} +{{ if and (.Values.persistence.s3.accessKeyIdSecret.name .Values.persistence.s3.accessKeyIdSecret.key)}} - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: name: {{ .Values.persistence.s3.accessKeyIdSecret.name }} key: {{ .Values.persistence.s3.accessKeyIdSecret.key }} {{ end }} -{{ if .Values.persistence.s3.secretAccessKeySecret }} +{{ if and (.Values.persistence.s3.secretKeyIdSecret.name .Values.persistence.s3.secretKeyIdSecret.key) }} - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: @@ -142,7 +142,7 @@ {{ end }} {{ if .Values.curator.mail.port }} - name: MAIL_PORT - value: {{ .Values.curator.mail.port }} + value: {{ .Values.curator.mail.port | quote }} {{ end }} {{ if .Values.curator.mail.username }} - name: MAIL_USERNAME @@ -203,7 +203,7 @@ {{ end }} {{ if .Values.curator.powerbi.cacheExpirySeconds }} - name: POWER_BI_CACHE_EXPIRY_SECONDS - value: {{ .Values.curator.powerbi.cacheExpirySeconds }} + value: {{ .Values.curator.powerbi.cacheExpirySeconds | quote }} {{ end }} # queue.php {{ if .Values.curator.queue.connection }} @@ -225,7 +225,7 @@ {{ end }} {{ if .Values.curator.session.secureCookie }} - name: SESSION_SECURE_COOKIE - value: {{ .Values.curator.session.secureCookie }} + value: {{ .Values.curator.session.secureCookie | quote }} {{ end }} # view.php ###