Skip to content

fix: fail templating when a required secret name is unset #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
twk3 merged 2 commits into from
Nov 2, 2026
Merged

fix: fail templating when a required secret name is unset #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b113d78
fix: require currents.apiInternalToken.secretName
claude Nov 2, 2026
10cc819
fix: require currents.betterAuth.secretName and currents.rootUser.pas…
claude Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions charts/currents/templates/director/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,15 +56,13 @@ spec:
{{- end }}
{{- include "currents.connectionConfigEnv" . | nindent 12 }}
{{- include "currents.URLConfigEnv" . | nindent 12 }}
{{- if .Values.currents.apiInternalToken.secretName }}
- name: API_URL
value: http://{{ include "currents.server.fullname" . }}/api/v1
- name: API_SECRET
valueFrom:
secretKeyRef:
name: {{ .Values.currents.apiInternalToken.secretName }}
name: {{ required "currents.apiInternalToken.secretName is required: the director authenticates to the server with this token" .Values.currents.apiInternalToken.secretName }}
key: {{ .Values.currents.apiInternalToken.key }}
{{- end }}
{{- with (concat .Values.global.env .Values.director.env) }}
{{- toYaml . | nindent 12 }}
{{- end }}
Expand Down
12 changes: 3 additions & 9 deletions charts/currents/templates/server/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,33 +60,27 @@ spec:
value: "true"
- name: ON_PREM_EMAIL
value: {{ tpl .Values.currents.rootUser.email . }}
{{- if .Values.currents.rootUser.password.secretName }}
- name: ON_PREM_PASSWORD
valueFrom:
secretKeyRef:
name: {{ .Values.currents.rootUser.password.secretName }}
name: {{ required "currents.rootUser.password.secretName is required: it sets the root admin's password for the first sign-in" .Values.currents.rootUser.password.secretName }}
key: {{ .Values.currents.rootUser.password.key }}
{{- end }}
{{- include "currents.connectionConfigEnv" . | nindent 12 }}
{{- include "currents.URLConfigEnv" . | nindent 12 }}
{{- include "currents.emailEnv" . | nindent 12 }}
{{- include "currents.samlSSOEnv" . | nindent 12 }}
{{- include "currents.mcpOAuthEnv" . | nindent 12 }}
{{- include "currents.appContentStorageEnv" . | nindent 12 }}
{{- if .Values.currents.betterAuth.secretName }}
- name: BETTER_AUTH_SECRET
valueFrom:
secretKeyRef:
name: {{ .Values.currents.betterAuth.secretName }}
name: {{ required "currents.betterAuth.secretName is required: the server signs session cookies with it" .Values.currents.betterAuth.secretName }}
key: {{ .Values.currents.betterAuth.key }}
{{- end }}
{{- if .Values.currents.apiInternalToken.secretName }}
- name: API_SECRET
valueFrom:
secretKeyRef:
name: {{ .Values.currents.apiInternalToken.secretName }}
name: {{ required "currents.apiInternalToken.secretName is required: the director authenticates to the server with this token" .Values.currents.apiInternalToken.secretName }}
key: {{ .Values.currents.apiInternalToken.key }}
{{- end }}
{{- with (concat .Values.global.env .Values.server.env) }}
{{- toYaml . | nindent 12 }}
{{- end }}
Expand Down
13 changes: 10 additions & 3 deletions charts/currents/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ currents:
# -- The email address of the root user
email: 'admin@{{ .Values.currents.domains.appHost }}'
password:
# -- The K8s secret containing the root user password. The password is used during initial setup only.
# -- The K8s secret containing the root user password, used for the first sign-in
# only. Templating fails when it is unset, because the server refuses to start
# without `ON_PREM_PASSWORD`. Generate one with `openssl rand -hex 16`.
# @section -- Required
secretName: ""
# -- The K8s secret key for the root user password
Expand Down Expand Up @@ -76,7 +78,9 @@ currents:
# -- Whether to enable the both default ingresses (server, and director)
enabled: false
betterAuth:
# -- The K8s secret containing the Better Auth secret
# -- The K8s secret containing the secret the server signs session cookies with.
# Templating fails when it is unset, because the server refuses to start without
# `BETTER_AUTH_SECRET`. Generate one with `openssl rand -hex 32`.
# @section -- Required
secretName: ""
# -- The K8s secret key for the Better Auth secret
Expand Down Expand Up @@ -140,7 +144,10 @@ currents:
# @section -- Remote MCP and OAuth
clientIdMetadataDocuments: true
apiInternalToken:
# -- The K8s secret to use for the internal API token
# -- The K8s secret holding the token the director authenticates to the server with;
# both deployments read it. Templating fails when it is unset, because an empty
# `API_SECRET` leaves the director unable to cancel runs. Generate at least 32 random
# characters with `openssl rand -hex 32`.
# @section -- Required
secretName: ""
# -- The K8s secret key to use for the internal API token
Expand Down
6 changes: 3 additions & 3 deletions docs/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ The following table lists the configurable parameters of the `currents` chart an
|-----|------|---------|-------------|
| currents.domains.appHost | string | `"currents-app.localhost"` | The host for the app |
| currents.domains.recordApiHost | string | `"currents-record.localhost"` | The host for the recording endpoint that the test reporters communicate with |
| currents.rootUser.password.secretName | string | `""` | The K8s secret containing the root user password. The password is used during initial setup only. |
| currents.rootUser.password.secretName | string | `""` | The K8s secret containing the root user password, used for the first sign-in only. Templating fails when it is unset, because the server refuses to start without `ON_PREM_PASSWORD`. Generate one with `openssl rand -hex 16`. |
| currents.email.smtp.host | string | `""` | the SMTP server to use. Required unless `transporter` is `ses`. |
| currents.email.smtp.secretName | string | `""` | K8s secret to use for the SMTP username/password. Required unless `transporter` is `ses`. |
| currents.betterAuth.secretName | string | `""` | The K8s secret containing the Better Auth secret |
| currents.apiInternalToken.secretName | string | `""` | The K8s secret to use for the internal API token |
| currents.betterAuth.secretName | string | `""` | The K8s secret containing the secret the server signs session cookies with. Templating fails when it is unset, because the server refuses to start without `BETTER_AUTH_SECRET`. Generate one with `openssl rand -hex 32`. |
| currents.apiInternalToken.secretName | string | `""` | The K8s secret holding the token the director authenticates to the server with; both deployments read it. Templating fails when it is unset, because an empty `API_SECRET` leaves the director unable to cancel runs. Generate at least 32 random characters with `openssl rand -hex 32`. |
| currents.clickhouse.user.secretName | string | `""` | The k8s secret to use for the ClickHouse password |
| currents.clickhouse.user.secretPasswordKey | string | `""` | The k8s secret key to use to access the ClickHouse password |
| currents.clickhouse.user.secretAccessTokenKey | string | `""` | The k8s secret key to use to access the ClickHouse access token |
Expand Down
Loading