Update Helm to use configmaps for user config rather than secrets (#4122

) * Update Hel to use configmaps for user config rather than secrets * fix checksum * update configmap
armadaproject · Jan 7, 2025 · 5d24d0a · 5d24d0a
1 parent 6e5c1eb
commit 5d24d0a
Show file tree

Hide file tree

Showing 20 changed files with 60 additions and 68 deletions.
diff --git a/deployment/armada/templates/secret.yaml → deployment/armada/templates/configmap.yaml b/deployment/armada/templates/secret.yaml → deployment/armada/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "armada.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "armada.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "armada.config.filename" . }}: |
 {{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
+{{ toYaml .Values.applicationConfig | indent 4 }}
 {{- end }}
diff --git a/deployment/armada/templates/deployment.yaml b/deployment/armada/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "armada.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "armada.labels.all" . | nindent 8 }}
     spec:
@@ -131,8 +131,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "armada.config.name" . }}
+          configMap:
+            name: {{ include "armada.config.name" . }}
         {{- if .Values.applicationConfig.pulsar.authenticationEnabled }}
         - name: pulsar-token
           secret:

diff --git a/deployment/binoculars/templates/secret.yaml → ...yment/binoculars/templates/configmap.yaml b/deployment/binoculars/templates/secret.yaml → ...yment/binoculars/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "binoculars.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "binoculars.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "binoculars.config.filename" . }}: |
 {{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
+{{ toYaml .Values.applicationConfig | indent 4 }}
 {{- end }}
diff --git a/deployment/binoculars/templates/deployment.yaml b/deployment/binoculars/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "binoculars.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "binoculars.labels.all" . | nindent 8 }}
     spec:
@@ -102,8 +102,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "binoculars.config.name" . }}
+          configMap:
+            name: {{ include "binoculars.config.name" . }}
         {{- if .Values.applicationConfig.grpc.tls.enabled }}
         - name: tls-certs
           secret:

diff --git a/...ment/event-ingester/templates/secret.yaml → ...t/event-ingester/templates/configmap.yaml b/...ment/event-ingester/templates/secret.yaml → ...t/event-ingester/templates/configmap.yaml
@@ -1,13 +1,13 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "event_ingester.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "event_ingester.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "event_ingester.config.filename" . }}: |
 {{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
+{{ toYaml .Values.applicationConfig | indent 4 }}
 {{- end }}
+
diff --git a/deployment/event-ingester/templates/deployment.yaml b/deployment/event-ingester/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "event_ingester.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "event_ingester.labels.all" . | nindent 8 }}
     spec:
@@ -87,8 +87,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "event_ingester.config.name" . }}
+          configMap:
+            name: {{ include "event_ingester.config.name" . }}
         {{- if .Values.applicationConfig.pulsar.authenticationEnabled }}
         - name: pulsar-token
           secret:

diff --git a/deployment/executor/templates/secret.yaml → deployment/executor/templates/configmap.yaml b/deployment/executor/templates/secret.yaml → deployment/executor/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "executor.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "executor.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "executor.config.filename" . }}: |
   {{- if .Values.applicationConfig }}
-  {{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
+  {{ toYaml .Values.applicationConfig | indent 4 }}
   {{- end }}
diff --git a/deployment/executor/templates/deployment.yaml b/deployment/executor/templates/deployment.yaml
@@ -14,7 +14,7 @@ spec:
     metadata:
       name: {{ include "executor.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "executor.labels.all" . | nindent 8 }}
     spec:
@@ -90,8 +90,8 @@ spec:
       {{- end }}
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "executor.config.name" . }}
+          configMap:
+            name: {{ include "executor.config.name" . }}
         {{- if .Values.additionalVolumes }}
         {{- toYaml .Values.additionalVolumes | nindent 8 }}
         {{- end }}
diff --git a/...lookout-ingester-v2/templates/secret.yaml → ...kout-ingester-v2/templates/configmap.yaml b/...lookout-ingester-v2/templates/secret.yaml → ...kout-ingester-v2/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "lookout_ingester_v2.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "lookout_ingester_v2.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "lookout_ingester_v2.config.filename" . }}: |
 {{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
+{{ toYaml .Values.applicationConfig | indent 4 }}
 {{- end }}
diff --git a/deployment/lookout-ingester-v2/templates/deployment.yaml b/deployment/lookout-ingester-v2/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "lookout_ingester_v2.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "lookout_ingester_v2.labels.all" . | nindent 8 }}
     spec:
@@ -87,8 +87,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "lookout_ingester_v2.config.name" . }}
+          configMap:
+            name: {{ include "lookout_ingester_v2.config.name" . }}
         {{- if .Values.applicationConfig.pulsar.authenticationEnabled }}
         - name: pulsar-token
           secret:

diff --git a/deployment/lookout-v2/templates/secret.yaml → ...out-migration-v2/templates/configmap.yaml b/deployment/lookout-v2/templates/secret.yaml → ...out-migration-v2/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "lookout_v2.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "lookout_v2.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "lookout_v2.config.filename" . }}: |
-{{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
-{{- end }}
+    {{- if .Values.applicationConfig }}
+    {{ toYaml .Values.applicationConfig | indent 4 }}
+    {{- end }}
diff --git a/deployment/lookout-migration-v2/templates/job.yaml b/deployment/lookout-migration-v2/templates/job.yaml
@@ -49,8 +49,8 @@ spec:
             allowPrivilegeEscalation: false
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "lookout_v2.config.name" . }}
+          configMap:
+            name: {{ include "lookout_v2.config.name" . }}
         {{- if .Values.additionalVolumes }}
         {{- toYaml .Values.additionalVolumes | nindent 8 }}
         {{- end }}
diff --git a/...ookout-migration-v2/templates/secret.yaml → ...yment/lookout-v2/templates/configmap.yaml b/...ookout-migration-v2/templates/secret.yaml → ...yment/lookout-v2/templates/configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "lookout_v2.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "lookout_v2.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "lookout_v2.config.filename" . }}: |
-{{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
-{{- end }}
+    {{- if .Values.applicationConfig }}
+    {{ toYaml .Values.applicationConfig | indent 4 }}
+    {{- end }}
diff --git a/deployment/lookout-v2/templates/deployment.yaml b/deployment/lookout-v2/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "lookout_v2.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "lookout_v2.labels.all" . | nindent 8 }}
     spec:
@@ -101,8 +101,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "lookout_v2.config.name" . }}
+          configMap:
+            name: {{ include "lookout_v2.config.name" . }}
         {{- if .Values.applicationConfig.tls.enabled }}
         - name: tls-certs
           secret:

diff --git a/...scheduler-migration/templates/secret.yaml → ...eduler-migration/templates/configmap.yaml b/...scheduler-migration/templates/secret.yaml → ...eduler-migration/templates/configmap.yaml
@@ -1,13 +1,13 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "armada-scheduler.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "armada-scheduler.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "armada-scheduler.config.filename" . }}: |
-{{- if .Values.applicationConfig }}
-{{ toYaml .Values.applicationConfig | b64enc | indent 4 }}
-{{- end }}
+    {{- if .Values.applicationConfig }}
+    {{ toYaml .Values.applicationConfig | indent 4 }}
+    {{- end }}
+
diff --git a/deployment/scheduler-migration/templates/job.yaml b/deployment/scheduler-migration/templates/job.yaml
@@ -49,8 +49,8 @@ spec:
             allowPrivilegeEscalation: false
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "armada-scheduler.config.name" . }}
+          configMap:
+            name: {{ include "armada-scheduler.config.name" . }}
         {{- if .Values.additionalVolumes }}
         {{- toYaml .Values.additionalVolumes | nindent 8 }}
         {{- end }}
diff --git a/...scheduler/templates/scheduler-secret.yaml → ...eduler/templates/scheduler-configmap.yaml b/...scheduler/templates/scheduler-secret.yaml → ...eduler/templates/scheduler-configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "armada-scheduler.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "armada-scheduler.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "armada-scheduler.config.filename" . }}: |
-{{- if .Values.scheduler.applicationConfig }}
-{{ toYaml .Values.scheduler.applicationConfig | b64enc | indent 4 }}
-{{- end }}
+    {{- if .Values.scheduler.applicationConfig }}
+    {{ toYaml .Values.scheduler.applicationConfig | indent 4 }}
+    {{- end }}
diff --git a/.../templates/scheduler-ingester-secret.yaml → ...mplates/scheduler-ingester-configmap.yaml b/.../templates/scheduler-ingester-secret.yaml → ...mplates/scheduler-ingester-configmap.yaml
@@ -1,13 +1,12 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: {{ include "armada-scheduler-ingester.config.name" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "armada-scheduler-ingester.labels.all" . | nindent 4 }}
-type: Opaque
 data:
   {{ include "armada-scheduler-ingester.config.filename" . }}: |
-{{- if .Values.ingester.applicationConfig }}
-{{ toYaml .Values.ingester.applicationConfig | b64enc | indent 4 }}
-{{- end }}
+    {{- if .Values.ingester.applicationConfig }}
+    {{ toYaml .Values.ingester.applicationConfig | indent 4 }}
+    {{- end }}
diff --git a/deployment/scheduler/templates/scheduler-ingester-deployment.yaml b/deployment/scheduler/templates/scheduler-ingester-deployment.yaml
@@ -18,7 +18,7 @@ spec:
     metadata:
       name: {{ include "armada-scheduler.name" . }}-ingester
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/scheduler-ingester-secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/scheduler-ingester-configmap.yaml") . | sha256sum }}
       labels:
         {{- include "armada-scheduler-ingester.labels.all" . | nindent 8 }}
     spec:
@@ -87,8 +87,8 @@ spec:
                 topologyKey: kubernetes.io/hostname
       volumes:
         - name: user-config
-          secret:
-            secretName: {{ include "armada-scheduler-ingester.config.name" . }}
+          configMap:
+            name: {{ include "armada-scheduler-ingester.config.name" . }}
         {{- if .Values.ingester.applicationConfig.pulsar.authenticationEnabled }}
         - name: pulsar-token
           secret:

diff --git a/deployment/scheduler/templates/scheduler-statefulset.yaml b/deployment/scheduler/templates/scheduler-statefulset.yaml
@@ -19,7 +19,7 @@ spec:
     metadata:
       name: {{ include "armada-scheduler.name" . }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/scheduler-secret.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/scheduler-configmap.yaml") . | sha256sum }}
       labels:
         {{- include "armada-scheduler.labels.all" . | nindent 8 }}
     spec:
@@ -132,8 +132,8 @@ spec:
             secretName: armada-scheduler-service-tls
         {{- end}}
         - name: user-config
-          secret:
-            secretName: {{ include "armada-scheduler.config.name" . }}
+          configMap:
+            name: {{ include "armada-scheduler.config.name" . }}
         {{- if .Values.scheduler.applicationConfig.pulsar.authenticationEnabled }}
         - name: pulsar-token
           secret: