From ee7c9f0a0c871950c2ba3d07a63d4b113fe156c9 Mon Sep 17 00:00:00 2001 From: Iain Sproat <68657+iainsproat@users.noreply.github.com> Date: Fri, 30 Sep 2022 10:34:08 +0100 Subject: [PATCH 1/7] feat(helm): s3 configuration can be loaded from configmap (#1048) * feat(helm): s3 configuration can be loaded from configmap - Variables for s3's configuration can now be read in from a configmap in the cluster. This allows deployment tooling, such as Terraform or CloudFormation, to dynamically create an s3 bucket and create a configmap with the necessary values. This decouples the cluster deployment from the helm release. * Update values.schema.json for helm chart - also include changes from a previous commit that had not been included previously --- .../speckle-server/templates/_helpers.tpl | 19 ++++++- .../templates/server/deployment.yml | 9 +-- utils/helm/speckle-server/values.schema.json | 57 ++++++++++++------- utils/helm/speckle-server/values.yaml | 14 ++++- 4 files changed, 69 insertions(+), 30 deletions(-) diff --git a/utils/helm/speckle-server/templates/_helpers.tpl b/utils/helm/speckle-server/templates/_helpers.tpl index 8a5c7acff..037a7d5d9 100644 --- a/utils/helm/speckle-server/templates/_helpers.tpl +++ b/utils/helm/speckle-server/templates/_helpers.tpl @@ -179,7 +179,8 @@ Creates a Cilium Network Policy egress definition for connecting to S3 compatibl {{- if .Values.s3.networkPolicy.inCluster.enabled -}} {{ include "speckle.networkpolicy.egress.internal.cilium" (dict "endpointSelector" .Values.s3.networkPolicy.inCluster.cilium.endpointSelector "serviceSelector" .Values.s3.networkPolicy.inCluster.cilium.serviceSelector "port" $port) }} {{- else if .Values.s3.networkPolicy.externalToCluster.enabled -}} - {{- $host := ( include "speckle.networkPolicy.domainFromUrl" .Values.s3.endpoint ) -}} + {{- $s3Values := ( include "server.s3Values" . | fromJson ) -}} + {{- $host := ( include "speckle.networkPolicy.domainFromUrl" $s3Values.endpoint ) -}} {{ include "speckle.networkpolicy.egress.external.cilium" (dict "ip" $host "port" $port) }} {{- end -}} {{- end }} @@ -251,7 +252,8 @@ Params: Creates a DNS match pattern for discovering blob storage IP */}} {{- define "speckle.networkpolicy.dns.blob_storage.cilium" -}} -{{- $domain := ( include "speckle.networkPolicy.domainFromUrl" .Values.s3.endpoint ) -}} +{{- $s3Values := ( include "server.s3Values" . | fromJson ) -}} +{{- $domain := ( include "speckle.networkPolicy.domainFromUrl" $s3Values.endpoint ) -}} {{- if ne (include "speckle.isIPv4" $domain ) "true" -}} {{ include "speckle.networkpolicy.matchNameOrPattern" $domain }} {{- end }} @@ -516,3 +518,16 @@ Params: {{- $secretDecoded := (b64dec $secret) -}} {{- printf "%s" $secretDecoded }} {{- end }} + +{{/* +Retrieve the s3 parameters from ConfigMap if enabled, or default to retrieving them from the provided values +*/}} +{{- define "server.s3Values" -}} +{{- if .Values.s3.configMap.enabled }} + {{- $configMap := (lookup "v1" "ConfigMap" .Values.namespace .Values.s3.configMap.name ) -}} + {{- printf "%s" ( $configMap.data | toJson ) }} +{{- else }} + {{- $result := dict "endpoint" .Values.s3.endpoint "bucket" .Values.s3.bucket "access_key" .Values.s3.access_key }} + {{- $result | toJson }} +{{- end }} +{{- end }} diff --git a/utils/helm/speckle-server/templates/server/deployment.yml b/utils/helm/speckle-server/templates/server/deployment.yml index 77a84216d..ab3e3defd 100644 --- a/utils/helm/speckle-server/templates/server/deployment.yml +++ b/utils/helm/speckle-server/templates/server/deployment.yml @@ -129,13 +129,14 @@ spec: {{- end }} # *** S3 Object Storage *** - {{- if .Values.s3.endpoint }} + {{- if (or .Values.s3.configMap.enabled .Values.s3.endpoint) }} + {{- $s3values := ((include "server.s3Values" .) | fromJson ) }} - name: S3_ENDPOINT - value: {{ .Values.s3.endpoint }} + value: {{ $s3values.endpoint }} - name: S3_ACCESS_KEY - value: {{ .Values.s3.access_key }} + value: {{ $s3values.access_key }} - name: S3_BUCKET - value: {{ .Values.s3.bucket }} + value: {{ $s3values.bucket }} - name: S3_SECRET_KEY valueFrom: secretKeyRef: diff --git a/utils/helm/speckle-server/values.schema.json b/utils/helm/speckle-server/values.schema.json index e8a6899e9..3ebffa2d2 100644 --- a/utils/helm/speckle-server/values.schema.json +++ b/utils/helm/speckle-server/values.schema.json @@ -121,12 +121,12 @@ "secretName": { "type": "string", "description": "Required. A secret containing the full connection string to the Postgres database (e.g. in format of `protocol://username:password@host:port/database`) stored within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "Required. The key within the Kubernetes Secret holding the connection string.", - "default": "postgres_url" + "default": "" } } }, @@ -195,19 +195,34 @@ "s3": { "type": "object", "properties": { + "configMap": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "If enabled, the s3.endpoint, s3.bucket, and s3.access_key values will be determined from a configMap and the values provided in this helm release ignored.", + "default": false + }, + "name": { + "type": "string", + "description": "The name of the ConfigMap in which values for the keys (`endpoint`, `bucket`, and `access_key`) are provided. Expected to be in the namespace defined by the `namespace` parameter of this Helm Chart.", + "default": "" + } + } + }, "endpoint": { "type": "string", - "description": "The URL at which the s3 compatible storage is hosted", + "description": "The URL at which the s3 compatible storage is hosted. If `s3.configMap.enabled` is true, this value is ignored.", "default": "" }, "bucket": { "type": "string", - "description": "The s3 compatible bucket in which Speckle data will be stored", + "description": "The s3 compatible bucket in which Speckle data will be stored. If `s3.configMap.enabled` is true, this value is ignored.", "default": "" }, "access_key": { "type": "string", - "description": "The key of the access key used to authenticate with the s3 compatible storage", + "description": "The key of the access key used to authenticate with the s3 compatible storage. If `s3.configMap.enabled` is true, this value is ignored.", "default": "" }, "secret_key": { @@ -216,12 +231,12 @@ "secretName": { "type": "string", "description": "Required. A Kubernetes secret containing the s3 secret_key. This is expected to be the name of an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "Required. The key within the Kubernetes Secret, the value of which is the s3 secret.", - "default": "s3_secret_key" + "default": "" } } }, @@ -306,12 +321,12 @@ "secretName": { "type": "string", "description": "Required. A secret containing the full connection string to the Redis store (e.g. in format of `protocol://username:password@host:port/database`) stored within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "Required. The key within the Kubernetes Secret holding the Redis connection string.", - "default": "redis_url" + "default": "" } } }, @@ -391,12 +406,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the Session secret. This is a unique value (can be generated randomly). This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the Session secret as its value.", - "default": "session_secret" + "default": "" } } }, @@ -432,12 +447,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the Google client secret. This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the Google client secret as its value.", - "default": "google_client_secret" + "default": "" } } } @@ -462,12 +477,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the GitHub client secret. This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the GitHub client secret as its value.", - "default": "github_client_secret" + "default": "" } } } @@ -507,12 +522,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the Azure AD client secret. This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the Azure AD client secret as its value.", - "default": "azure_ad_client_secret" + "default": "" } } }, @@ -562,12 +577,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the email password. This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the email password as its value.", - "default": "email_password" + "default": "" } } }, @@ -690,12 +705,12 @@ "secretName": { "type": "string", "description": "The name of the Kubernetes Secret containing the Apollo monitoring key. This is expected to be provided within the Kubernetes cluster as an opaque Kubernetes Secret. Ref: https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets", - "default": "server-vars" + "default": "" }, "secretKey": { "type": "string", "description": "The key within the Kubernetes Secret holding the Apollo monitoring key as its value.", - "default": "apollo_key" + "default": "" } } } diff --git a/utils/helm/speckle-server/values.yaml b/utils/helm/speckle-server/values.yaml index 9bf103fe5..90cd125de 100644 --- a/utils/helm/speckle-server/values.yaml +++ b/utils/helm/speckle-server/values.yaml @@ -184,16 +184,24 @@ db: ## @descriptionEnd ## s3: - ## @param s3.endpoint The URL at which the s3 compatible storage is hosted + configMap: + ## @param s3.configMap.enabled If enabled, the s3.endpoint, s3.bucket, and s3.access_key values will be determined from a configMap and the values provided in this helm release ignored. + ## This allows these values to be generated by external tooling, e.g. Terraform or CloudFormation, and then inserted into the Kubernetes cluster by these tools. + ## + enabled: false + ## @param s3.configMap.name The name of the ConfigMap in which values for the keys (`endpoint`, `bucket`, and `access_key`) are provided. Expected to be in the namespace defined by the `namespace` parameter of this Helm Chart. + ## + name: '' + ## @param s3.endpoint The URL at which the s3 compatible storage is hosted. If `s3.configMap.enabled` is true, this value is ignored. ## The url should be prefixed by the protocol (e.g. `https://`) ## The url may need to include the port if it is not the default (e.g. `443` for `https` protocol) ## endpoint: '' - ## @param s3.bucket The s3 compatible bucket in which Speckle data will be stored + ## @param s3.bucket The s3 compatible bucket in which Speckle data will be stored. If `s3.configMap.enabled` is true, this value is ignored. ## The access key should be granted write permissions to this bucket ## bucket: '' - ## @param s3.access_key The key of the access key used to authenticate with the s3 compatible storage + ## @param s3.access_key The key of the access key used to authenticate with the s3 compatible storage. If `s3.configMap.enabled` is true, this value is ignored. ## access_key: '' secret_key: From ca95863c558dfcf6a4508f2f7ed2f549c5c37a21 Mon Sep 17 00:00:00 2001 From: Kristaps Fabians Geikins Date: Mon, 3 Oct 2022 12:00:26 +0300 Subject: [PATCH 2/7] fix(frontend): multiple resource viewer toolbar/navbar incorrect (#1063) --- .../main/pages/stream/CommitObjectViewer.vue | 28 +++++++++---------- .../toolbars/MultipleResourcesToolbar.vue | 26 +++++++---------- 2 files changed, 24 insertions(+), 30 deletions(-) diff --git a/packages/frontend/src/main/pages/stream/CommitObjectViewer.vue b/packages/frontend/src/main/pages/stream/CommitObjectViewer.vue index bed8e97ab..f7994c153 100644 --- a/packages/frontend/src/main/pages/stream/CommitObjectViewer.vue +++ b/packages/frontend/src/main/pages/stream/CommitObjectViewer.vue @@ -5,21 +5,20 @@ firstResource && (isMultiple || isCommit || isObject) && !singleResourceError " > - - - + + - @@ -240,7 +240,7 @@ /> - +
-
-
+