feat!(config): update env vars being passed in

charts/curator/README.md

@@ -18,21 +18,63 @@ A Helm chart for Curator in a Container in Kubernetes
 | cronjob.env | object | `{}` |  |
 | cronjob.nodeSelector | object | `{}` |  |
 | cronjob.successfulJobsHistoryLimit | int | `1` |  |
+| curator.app | object | `{"appKeySecret":{"key":null,"name":null},"debug":null}` | environment variables to pass into app.php |
 | curator.auth.existingSecret | string | `"curator-auth"` | secret to use for initial admin user |
-| curator.cache.prefix | string | `""` | cache prefix |
-| curator.config | object | `{}` | These are used to override default php config files present in the containers. The files are mounted in the config directory and will append .php to the ends of the keys |
+| curator.cache | object | `{"driver":null,"host":null,"port":null,"prefix":null}` | environment variables to pass into cache.php |
+| curator.cache.driver | string | `nil` | cache type, possible values apc, array, database, file, memcached, redis |
+| curator.cache.host | string | `nil` | memcached host, only used when driver is memcached |
+| curator.cache.port | string | `nil` | memcached port, only used when driver is memcached |
+| curator.cache.prefix | string | `nil` | cache prefix, defaults to a value derived from APP_NAME if unset |
+| curator.cms | object | `{"assetCache":null,"assetMinify":null,"enableCSRF":null,"filesystemDriver":null,"filesystemMediaPath":null,"filesystemUploadsPath":null,"routesCache":null}` | environment variables to pass into cms.php |
+| curator.cms.filesystemDriver | string | `nil` | disk used for CMS media/uploads storage, defaults to "s3" if persistence.s3.enabled else "local" |
+| curator.config | object | `{}` | If one of these is defined the above config section will no longer be applicable if the new config doesn't utilze environment variables |
+| curator.database.connection | string | `nil` |  |
+| curator.database.databaseName | string | `nil` |  |
+| curator.database.host | string | `nil` |  |
+| curator.database.password.secretKeyRef.key | string | `nil` |  |
+| curator.database.password.secretKeyRef.name | string | `nil` |  |
+| curator.database.username | string | `nil` |  |
 | curator.env | object | `{}` | environment variables to set in the container |
 | curator.envFromSecret | list | `[]` | read environment variables from a secret |
+| curator.filesystems | object | `{"disk":null}` | environment variables to pass into filesystems.php |
+| curator.filesystems.disk | string | `nil` | default filesystem disk, defaults to "s3" if persistence.s3.enabled else "local" |
 | curator.livenessProbe.failureThreshold | int | `3` | Number of failures before pod is failed |
 | curator.livenessProbe.path | string | `"/ping"` | Endpoint the probe hits; keep it cheap and dependency-free |
 | curator.livenessProbe.periodSeconds | int | `10` | Period to wait between checks |
 | curator.livenessProbe.timeoutSeconds | int | `15` | Timeout for probe |
+| curator.logging.channel | string | `nil` |  |
+| curator.logging.deprecationsChannel | string | `nil` |  |
+| curator.logging.level | string | `nil` |  |
+| curator.mail.ehloDomain | string | `nil` |  |
+| curator.mail.fromAddress | string | `nil` |  |
+| curator.mail.fromName | string | `nil` |  |
+| curator.mail.host | string | `nil` |  |
+| curator.mail.passwordSecretRef.key | string | `nil` |  |
+| curator.mail.passwordSecretRef.name | string | `nil` |  |
+| curator.mail.port | string | `nil` |  |
+| curator.mail.username | string | `nil` |  |
+| curator.powerbi.adminClientIdSecretRef.key | string | `nil` |  |
+| curator.powerbi.adminClientIdSecretRef.name | string | `nil` |  |
+| curator.powerbi.adminClientSecretSecretRef.key | string | `nil` |  |
+| curator.powerbi.adminClientSecretSecretRef.name | string | `nil` |  |
+| curator.powerbi.cacheEnabled | string | `nil` |  |
+| curator.powerbi.cacheExpirySeconds | string | `nil` |  |
+| curator.powerbi.clientIdSecretRef.key | string | `nil` |  |
+| curator.powerbi.clientIdSecretRef.name | string | `nil` |  |
+| curator.powerbi.clientSecretSecretRef.key | string | `nil` |  |
+| curator.powerbi.clientSecretSecretRef.name | string | `nil` |  |
+| curator.powerbi.redirectURI | string | `nil` |  |
+| curator.powerbi.tenant | string | `nil` |  |
+| curator.queue.connection | string | `nil` |  |
 | curator.readinessProbe.failureThreshold | int | `3` | Number of failures before the pod is removed from the Service endpoints |
 | curator.readinessProbe.path | string | `"/healthz"` | Endpoint the probe hits; /healthz verifies the database is reachable |
 | curator.readinessProbe.periodSeconds | int | `10` | Period to wait between checks |
 | curator.readinessProbe.timeoutSeconds | int | `15` | Timeout for probe |
 | curator.sentry.dsn | string | `""` | Sentry Laravel DSN for error reporting |
 | curator.sentry.environment | string | `""` | Sentry Laravel environment name, defaults to the Helm release name if not set |
+| curator.session.cookie | string | `nil` |  |
+| curator.session.driver | string | `nil` |  |
+| curator.session.secureCookie | string | `nil` |  |
 | curator.startupProbe.failureThreshold | int | `10` |  |
 | curator.startupProbe.initialDelaySeconds | int | `10` |  |
 | curator.startupProbe.path | string | `"/ping"` | Endpoint the probe hits; keep it cheap and dependency-free |
@@ -74,9 +116,12 @@ A Helm chart for Curator in a Container in Kubernetes
 | persistence.enabled | bool | `true` | enable persistence |
 | persistence.existingClaim | string | `""` | existingClaim is the name of an existing persistent volume claim to use for storage |
 | persistence.labels | object | `{}` | persistent volume claim labels |
+| persistence.s3.accessKeyIdSecret | object | `{"key":null,"name":null}` | secret containing the AWS access key id, leave unset to rely on IRSA/instance role credentials |
 | persistence.s3.bucket | string | `"some-bucket"` | bucket to use for storage |
 | persistence.s3.enabled | bool | `false` | enable S3 storage, if disable and peristence.enabled is true, it will use PVC |
+| persistence.s3.endpoint | string | `nil` | custom S3-compatible endpoint, leave unset to use AWS |
 | persistence.s3.region | string | `""` | region bucket is in |
+| persistence.s3.secretAccessKeySecret | object | `{"key":null,"name":null}` | secret containing the AWS secret access key, leave unset to rely on IRSA/instance role credentials |
 | persistence.size | string | `"5Gi"` | size of persistent volume claim |
 | persistence.storageClass | string | `nil` | persistent volume claim storageClass |
 | persistence.subPath | string | `""` | persistent volume claim subpath |

charts/curator/templates/_env.tpl

@@ -1,29 +1,236 @@
-{{- define "env.environment" -}}
+{{ define "env.environment" }}
+# app.php
+{{ if .Values.curator.app.debug }}
+- name: APP_DEBUG
+  value: {{ .Values.curator.app.debug }}
+{{ end }}
+{{ with (first .Values.ingress.hosts) -}}
+- name: APP_URL
+  value: {{ .host }}
+{{ end -}}
+# TODO account for old value location
+{{ if and (.Values.curator.app.appKeySecret.name .Values.curator.app.appKeySecret.key) }}
+- name: APP_KEY
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.app.appKeySecret.name | default (printf "%s-admin" .Release.Name) }}
+      key: {{ .Values.curator.app.appKeySecret.key | default "app-key"}}
+{{ end }}
+# cache.php
+- name: CACHE_DRIVER
+  value: {{ .Values.curator.cache.driver | default "memcached" }}
+- name: MEMCACHED_HOST
+  value: {{ .Values.curator.cache.host | default "memcached" }}
+- name: MEMCACHED_PORT
+  value: {{ .Values.curator.cache.port | default "11211" | quote }}
+{{ if .Values.curator.cache.prefix }}
+- name: CACHE_PREFIX
+  value: {{ .Values.curator.cache.prefix }}
+{{ end }}
+# cms.php
+{{ if .Values.curator.cms.routesCache }}
+- name: ROUTES_CACHE
+  value: {{ .Values.curator.cms.routesCache }}
+{{ end }}
+{{ if .Values.curator.cms.assetCache }}
+- name: ASSET_CACHE
+  value: {{ .Values.curator.cms.assetCache }}
+{{ end }}
+{{ if .Values.curator.cms.assetMinify }}
+- name: ASSET_MINIFY
+  value: {{ .Values.curator.cms.assetMinify }}
+{{ end }}
+- name: FILESYSTEM_DRIVER
+  value: {{ .Values.curator.cms.filesystemDriver | default (ternary "s3" "local" .Values.persistence.s3.enabled) }}
+{{ if .Values.curator.cms.filesystemUploadsPath }}
+- name: FILESYSTEM_UPLOADS_PATH
+  value: {{ .Values.curator.cms.filesystemUploadsPath }}
+{{ end }}
+{{ if .Values.curator.cms.filesystemMediaPath }}
+- name: FILESYSTEM_MEDIA_PATH
+  value: {{ .Values.curator.cms.filesystemMediaPath }}
+{{ end }}
+{{ if .Values.curator.cms.enableCSRF }}
+- name: ENABLE_CSRF
+  value: {{ .Values.curator.cms.enableCSRF }}
+{{ end }}
+# database.php
+{{ if .Values.curator.database.connection }}
+- name: DB_CONNECTION
+  value: {{ .Values.curator.database.connection }}
+{{ end }}
+{{ if .Values.curator.database.databaseName }}
+- name: DB_DATABASE
+  value: {{ .Values.curator.database.databaseName}}
+{{ else }}
 - name: DB_DATABASE
   value: {{ .Values.mariadbOperator.database.name | default .Values.environment }}
+{{ end }}
+{{ if .Values.curator.database.username }}
+- name: DB_USERNAME
+  value: {{ .Values.curator.database.username }}
+{{ else }}
 - name: DB_USERNAME
   value: {{ .Values.mariadbOperator.user.username | default "curator"}}
+{{ end }}
+{{ if and .Values.curator.database.password.secretKeyRef.name .Values.curator.database.password.secretKeyRef.key }}
+- name: DB_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.database.password.secretKeyRef.name }}
+      key: {{ .Values.curator.database.password.secretKeyRef.key }}
+{{ else }}
 - name: DB_PASSWORD
   valueFrom:
     secretKeyRef:
       name: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.name | default (printf "%s-mariadb" .Values.environment) }}
       key: {{ .Values.mariadbOperator.user.userPasswordSecretKeyRef.key | default "password" }}
-- name: CACHE_HOST
-  value: "memcached"
-- name: CACHE_PORT
-  value: "11211"
-- name: CACHE_PREFIX
-  value: {{ .Values.curator.cache.prefix | default .Values.environment }}
-{{ with (first .Values.ingress.hosts) -}}
-- name: APP_URL
-  value: {{ .host }}
-{{ end -}}
+{{ end }}
+# filesystems.php
+- name: FILESYSTEM_DISK
+  value: {{ .Values.curator.filesystems.disk | default (ternary "s3" "local" .Values.persistence.s3.enabled) }}
 {{ if .Values.persistence.s3.enabled -}}
-- name: S3_BUCKET
-  value: {{ .Values.persistence.s3.bucket | default .Values.environment }}
-- name: S3_REGION
-  value: {{ .Values.persistence.s3.region | default .Values.environment }}
+- name: AWS_BUCKET
+  value: {{ .Values.persistence.s3.bucket }}
+{{ if .Values.persistence.s3.region }}
+- name: AWS_DEFAULT_REGION
+  value: {{ .Values.persistence.s3.region }}
+{{ end }}
+{{ if .Values.persistence.s3.endpoint }}
+- name: AWS_ENDPOINT
+  value: {{ .Values.persistence.s3.endpoint }}
+{{ end }}
+{{ if and (.Values.persistence.s3.accessKeyIdSecret.name .Values.persistence.s3.accessKeyIdSecret.key)}}
+- name: AWS_ACCESS_KEY_ID
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.persistence.s3.accessKeyIdSecret.name }}
+      key: {{ .Values.persistence.s3.accessKeyIdSecret.key }}
+{{ end }}
+{{ if and (.Values.persistence.s3.secretKeyIdSecret.name .Values.persistence.s3.secretKeyIdSecret.key) }}
+- name: AWS_SECRET_ACCESS_KEY
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.persistence.s3.secretAccessKeySecret.name }}
+      key: {{ .Values.persistence.s3.secretAccessKeySecret.key }}
+{{ end }}
 {{- end }}
+# logging.php
+{{ if .Values.curator.logging.channel }}
+- name: LOG_CHANNEL
+  value: {{ .Values.curator.logging.channel }}
+{{ end }}
+{{ if .Values.curator.logging.deprecationsChannel }}
+- name: LOG_DEPRECATIONS_CHANNEL
+  value: {{ .Values.curator.logging.deprecationsChannel }}
+{{ end }}
+{{ if .Values.curator.logging.level }}
+- name: LOG_LEVEL
+  value: {{ .Values.curator.logging.level }}
+{{ end }}
+# mail.php
+{{ if .Values.curator.mail.host }}
+- name: MAIL_HOST
+  value: {{ .Values.curator.mail.host }}
+{{ end }}
+{{ if and .Values.curator.mail.passwordSecretRef.name .Values.curator.mail.passwordSecretRef.key }}
+- name: MAIL_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.mail.passwordSecretRef.name }}
+      key: {{ .Values.curator.mail.passwordSecretRef.key }}
+{{ end }}
+{{ if .Values.curator.mail.port }}
+- name: MAIL_PORT
+  value: {{ .Values.curator.mail.port | quote }}
+{{ end }}
+{{ if .Values.curator.mail.username }}
+- name: MAIL_USERNAME
+  value: {{ .Values.curator.mail.username }}
+{{ end }}
+{{ if .Values.curator.mail.fromAddress }}
+- name: MAIL_FROM_ADDRESS
+  value: {{ .Values.curator.mail.fromAddress }}
+{{ end }}
+{{ if .Values.curator.mail.fromName }}
+- name: MAIL_FROM_NAME
+  value: {{ .Values.curator.mail.fromName }}
+{{ end }}
+{{ if .Values.curator.mail.ehloDomain }}
+- name: MAIL_EHLO_DOMAIN
+  value: {{ .Values.curator.mail.ehloDomain }}
+{{ end }}
+# powerbi.php
+{{ if .Values.curator.powerbi.tenant }}
+- name: POWER_BI_TENANT
+  value: {{ .Values.curator.powerbi.tenant }}
+{{ end }}
+{{ if and .Values.curator.powerbi.clientIdSecretRef.name .Values.curator.powerbi.clientIdSecretRef.key }}
+- name: POWER_BI_CLIENT_ID
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.powerbi.clientIdSecretRef.name }}
+      key: {{ .Values.curator.powerbi.clientIdSecretRef.key }}
+{{ end }}
+{{ if and .Values.curator.powerbi.clientSecretSecretRef.name .Values.curator.powerbi.clientSecretSecretRef.key }}
+- name: POWER_BI_CLIENT_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.powerbi.clientSecretSecretRef.name }}
+      key: {{ .Values.curator.powerbi.clientSecretSecretRef.key }}
+{{ end }}
+{{ if and .Values.curator.powerbi.adminClientIdSecretRef.name .Values.curator.powerbi.adminClientIdSecretRef.key }}
+- name: POWER_BI_ADMIN_CLIENT_ID
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.powerbi.adminClientIdSecretRef.name }}
+      key: {{ .Values.curator.powerbi.adminClientIdSecretRef.key }}
+{{ end }}
+{{ if and .Values.curator.powerbi.adminClientSecretSecretRef.name .Values.curator.powerbi.adminClientSecretSecretRef.key }}
+- name: POWER_BI_ADMIN_CLIENT_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.curator.powerbi.adminClientSecretSecretRef.name }}
+      key: {{ .Values.curator.powerbi.adminClientSecretSecretRef.key }}
+{{ end }}
+{{ if .Values.curator.powerbi.redirectURI }}
+- name: POWER_BI_REDIRECT_URI
+  value: {{ .Values.curator.powerbi.redirectURI }}
+{{ end }}
+{{ if .Values.curator.powerbi.cacheEnabled }}
+- name: POWER_BI_CACHE_ENABLED
+  value: {{ .Values.curator.powerbi.cacheEnabled }}
+{{ end }}
+{{ if .Values.curator.powerbi.cacheExpirySeconds }}
+- name: POWER_BI_CACHE_EXPIRY_SECONDS
+  value: {{ .Values.curator.powerbi.cacheExpirySeconds | quote }}
+{{ end }}
+# queue.php
+{{ if .Values.curator.queue.connection }}
+- name: QUEUE_CONNECTION
+  value: {{ .Values.curator.queue.connection }}
+{{ end }}
+# services.php
+###
+# No configurable items in services
+###
+# session.php
+{{ if .Values.curator.session.driver }}
+- name: SESSION_DRIVER
+  value: {{ .Values.curator.session.driver }}
+{{ end }}
+{{ if .Values.curator.session.cookie }}
+- name: SESSION_COOKIE
+  value: {{ .Values.curator.session.cookie }}
+{{ end }}
+{{ if .Values.curator.session.secureCookie }}
+- name: SESSION_SECURE_COOKIE
+  value: {{ .Values.curator.session.secureCookie | quote }}
+{{ end }}
+# view.php
+###
+# No configurable items in view
+###
 {{- if .Values.curator.sentry.dsn }}
 - name: SENTRY_LARAVEL_DSN
   value: {{ .Values.curator.sentry.dsn }}

charts/curator/templates/_helpers.tpl

@@ -137,11 +137,13 @@ limits:
 {{/*
 Determines which mariadb endpoint to use
 Determination order:
-Maxscale -> mariadbEndpoint -> mariadb
+curator.database.host -> Maxscale -> mariadbEndpoint -> mariadb
 */}}
 {{- define "curatorDbEndpoint" -}}
-{{/* Use maxscale for db endpoint */}}
-{{- if (and .Values.mariadbOperator.maxscaleEndpoint .Values.mariadbOperator.mariadbNamespace) -}}
+{{- if .Values.curator.database.host -}}
+{{ .Values.curator.database.host }}
+{{- /* Use maxscale for db endpoint */ -}}
+{{- else if (and .Values.mariadbOperator.maxscaleEndpoint .Values.mariadbOperator.mariadbNamespace) -}}
 {{ .Values.mariadbOperator.maxscaleEndpoint }}.{{ .Values.mariadbOperator.mariadbNamespace }}
 {{- /* Use mariadbEndpoint for db endpoint */ -}}
 {{- else if (and .Values.mariadbOperator.mariadbEndpoint .Values.mariadbOperator.mariadbNamespace) -}}

charts/curator/templates/job-create-admin.yaml

@@ -57,7 +57,7 @@ spec:
                 name: {{ .Release.Name }}-admin
                 key: admin-user
           - name: DB_HOST
-            value: {{ .Values.mariadbOperator.mariadbName }}-primary.{{ .Values.mariadbOperator.mariadbNamespace | default .Release.Namespace }}
+            value: {{ .Values.curator.database.host | default (printf "%s-primary.%s" .Values.mariadbOperator.mariadbName (.Values.mariadbOperator.mariadbNamespace | default .Release.Namespace)) }}
           {{- range $key, $value := .Values.curator.env }}
           - name: "{{ $key }}"
             value: "{{ $value }}"

charts/curator/templates/job-db-migrate.yaml

@@ -47,7 +47,7 @@ spec:
         env:
           {{- include "env.environment" . | nindent 10 }}
           - name: DB_HOST
-            value: {{ .Values.mariadbOperator.mariadbName }}-primary.{{ .Values.mariadbOperator.mariadbNamespace | default .Release.Namespace }}
+            value: {{ .Values.curator.database.host | default (printf "%s-primary.%s" .Values.mariadbOperator.mariadbName (.Values.mariadbOperator.mariadbNamespace | default .Release.Namespace)) }}
           {{- range $key, $value := .Values.curator.env }}
           - name: "{{ $key }}"
             value: "{{ $value }}"