feat: update chart to 0.2

Author: avlllo

.github/workflows/golangci-lint.yaml

@@ -16,7 +16,7 @@ on:
       - '.golangci.yml'
 
 env:
-  GO_VERSION: '1.25'
+  GO_VERSION: '1.26'
   TASK_VERSION: '3.38.0'
 
 jobs:

.github/workflows/test-lib.yaml

@@ -11,7 +11,7 @@ on:
       - main
 
 env:
-  GO_VERSION: '1.25'
+  GO_VERSION: '1.26'
   TASK_VERSION: '3.38.0'
 
 jobs:

auth-center/.helm/values.yaml

@@ -13,32 +13,19 @@ service:
     http: 9000
     grpc: 8000
 administrator:
-  username: ""
-  password: ""
+  existingSecret: cs-account
 containerSecurityContext:
-  enabled: true
   seLinuxOptions: {}
   privileged: false
   allowPrivilegeEscalation: false
   readOnlyRootFilesystem: true
   seccompProfile:
     type: "RuntimeDefault"
 podSecurityContext:
-  enabled: true
   fsGroupChangePolicy: Always
   sysctls: []
   supplementalGroups: []
 env:
-  - name: ADMINISTRATOR_USERNAME
-    valueFrom:
-      secretKeyRef:
-        name: auth-center-account
-        key: username
-  - name: ADMINISTRATOR_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: auth-center-account
-        key: password
 postgresql:
   enabled: true
 serviceAccount:
@@ -58,7 +45,6 @@ resources:
     memory: 128Mi
     ephemeral-storage: 1Mi
 livenessProbe:
-  enabled: true
   httpGet:
     path: /live
     scheme: HTTP
@@ -67,7 +53,6 @@ livenessProbe:
   successThreshold: 1
   failureThreshold: 2
 readinessProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP
@@ -76,7 +61,6 @@ readinessProbe:
   successThreshold: 1
   failureThreshold: 3
 startupProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP

cluster-manager/.helm/values.yaml

@@ -13,34 +13,24 @@ service:
     grpc: 8000
     http: 9000
 containerSecurityContext:
-  enabled: true
   seLinuxOptions: {}
   privileged: false
   allowPrivilegeEscalation: false
   readOnlyRootFilesystem: true
   seccompProfile:
     type: "RuntimeDefault"
 podSecurityContext:
-  enabled: true
   fsGroupChangePolicy: Always
   sysctls: []
   supplementalGroups: []
 env:
-  - name: ADMINISTRATOR_USERNAME
-    valueFrom:
-      secretKeyRef:
-        name: auth-center-account
-        key: username
-  - name: ADMINISTRATOR_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: auth-center-account
-        key: password
   - name: PUBLIC_ACCESS_TOKEN_SALT_KEY
     valueFrom:
       secretKeyRef:
-        name: cs-keys
+        name: '{{ include "common.cs.keys.secretName" . }}'
         key: publicAccessTokenSalt
+administrator:
+  existingSecret: cs-account
 encryption:
   enabled: true
 postgresql:
@@ -63,7 +53,6 @@ resources: {}
 #   memory: 512Mi
 #   ephemeral-storage: 1Gi
 livenessProbe:
-  enabled: true
   httpGet:
     path: /live
     scheme: HTTP
@@ -72,7 +61,6 @@ livenessProbe:
   successThreshold: 1
   failureThreshold: 2
 readinessProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP
@@ -81,7 +69,6 @@ readinessProbe:
   successThreshold: 1
   failureThreshold: 3
 startupProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP

cluster-manager/pkg/helm/values.go

@@ -43,11 +43,17 @@ type Values struct {
 			PublicAccessTokenSalt string `json:"publicAccessTokenSalt,omitempty"`
 		} `json:"keys,omitzero"`
 
-		Postgresql TLSGlobal `json:"postgresql"`
-		Redis      TLSGlobal `json:"redis"`
-		Clickhouse TLSGlobal `json:"clickhouse"`
-		Grafana    TLSGlobal `json:"grafana,omitzero"`
-		Loki       TLSGlobal `json:"loki,omitzero"`
+		Administrator struct {
+			Username string `json:"username,omitempty"`
+			Password string `json:"password,omitempty"`
+		} `json:"administrator,omitzero"`
+
+		Postgresql AuthTLSGlobal `json:"postgresql"`
+		Redis      AuthTLSGlobal `json:"redis"`
+		Rabbitmq   AuthGlobal    `json:"rabbitmq,omitzero"`
+		Clickhouse AuthTLSGlobal `json:"clickhouse"`
+		Grafana    TLSGlobal     `json:"grafana,omitzero"`
+		Loki       TLSGlobal     `json:"loki,omitzero"`
 	} `json:"global,omitzero"`
 
 	TLS struct {
@@ -57,13 +63,6 @@ type Values struct {
 		CertKey string `json:"certKey,omitempty"`
 	} `json:"tls,omitzero"`
 
-	AuthAPI struct {
-		Administrator struct {
-			Username string `json:"username,omitempty"`
-			Password string `json:"password,omitempty"`
-		} `json:"administrator,omitzero"`
-	} `json:"auth-center,omitzero"`
-
 	ImagePullSecret struct {
 		Username string `json:"username,omitempty"`
 		Password string `json:"password,omitempty"`
@@ -248,20 +247,40 @@ type TLSGlobal struct {
 	} `json:"tls"`
 }
 
-// buildHelmArgs recursively converts a value to Helm command-line arguments.
-// It traverses the value and generates the appropriate --set or --set-string arguments
-// based on the value's kind.
+// AuthTLSGlobal is the global-section block for services that share both an
+// existing auth secret name and TLS settings across consumer sub-charts
+// (postgresql, redis, clickhouse).
+type AuthTLSGlobal struct {
+	Auth struct {
+		ExistingSecret string `json:"existingSecret,omitempty"`
+	} `json:"auth,omitzero"`
+	TLS struct {
+		Enabled bool `json:"enabled"`
+		Verify  bool `json:"verify"`
+	} `json:"tls"`
+}
+
+// AuthGlobal is the global-section block for services that share only an
+// existing auth secret name across consumer sub-charts (rabbitmq has no TLS
+// knobs at the global level).
+type AuthGlobal struct {
+	Auth struct {
+		ExistingSecret string `json:"existingSecret,omitempty"`
+	} `json:"auth,omitzero"`
+}
+
+// buildHelmArgs recursively converts a struct's fields to Helm command-line arguments.
+// It traverses the struct and generates the appropriate --set or --set-string arguments
+// based on field types.
 //
-// Each value is processed according to its kind:
+// Each field is processed according to its kind:
 //   - Strings use --set-string
 //   - Bool, numeric types use --set
-//   - Arrays/Slices are expanded into per-element args using the `name[i]` form
-//   - Structs are processed recursively over their fields
+//   - Arrays/Slices are JSON marshaled and use --set
+//   - Structs are processed recursively
 //
-// Struct fields with `json:"-"` are skipped.
-// Struct fields with `json:",omitempty"` or `json:",omitzero"` are skipped if they
-// contain zero values; this is communicated through the `hasOmit` argument when
-// recursing.
+// Fields with `json:"-"` are skipped.
+// Fields with `json:",omitempty"` or `json:",omitzero"` are skipped if they contain zero values.
 //
 // Returns an error if JSON marshaling fails for array/slice fields.
 func buildHelmArgs(v any, prefix string, hasOmit bool) ([]string, error) {

cluster-manager/pkg/helm/values_test.go

@@ -61,11 +61,11 @@ func TestBuildHelmArgs(t *testing.T) {
 				Nested     struct {
 					Field1 string `json:"field1"`
 					Field2 int    `json:"field2"`
-				} `json:"nested"`
+				} `json:"nested,omitempty"`
 				NestedEmpty struct {
 					Field1 string `json:"field1"`
 					Field2 int    `json:"field2"`
-				} `json:"nestedEmpty,omitzero"`
+				} `json:"nestedEmpty,omitempty"`
 				NestedZero struct {
 					Field1 string `json:"field1"`
 					Field2 int    `json:"field2"`
@@ -225,6 +225,10 @@ func generateValues() Values {
 	values.Global.ImageShortNames = false
 	values.Global.Keys.Encryption = "encryption-key"
 	values.Global.Keys.Token = "token-key"
+	values.Global.Postgresql.Auth.ExistingSecret = "pg-secret"
+	values.Global.Redis.Auth.ExistingSecret = "redis-secret"
+	values.Global.Rabbitmq.Auth.ExistingSecret = "rabbitmq-secret"
+	values.Global.Clickhouse.Auth.ExistingSecret = "ch-secret"
 
 	values.TLS.CertCA = "ca-cert-data"
 	values.TLS.Cert = "cert-data"
@@ -275,9 +279,9 @@ func generateValues() Values {
 	// CS Manager
 	values.CSManager.RegistrationToken = "registration-token"
 
-	// AuthAPI
-	values.AuthAPI.Administrator.Username = "user"
-	values.AuthAPI.Administrator.Password = "pass"
+	// Administrator
+	values.Global.Administrator.Username = "user"
+	values.Global.Administrator.Password = "pass"
 
 	return values
 }
@@ -311,15 +315,19 @@ func TestValuesToHelmArgs(t *testing.T) {
 		"--set-string 'postgresql.auth.username=postgres'",
 		"--set-string 'postgresql.auth.password=postgres-password'",
 		"--set 'postgresql.persistence.enabled=true'",
+		"--set-string 'global.postgresql.auth.existingSecret=pg-secret'",
 		"--set 'global.postgresql.tls.enabled=true'",
 		"--set 'global.postgresql.tls.verify=true'",
 		"--set-string 'postgresql.persistence.storageClass=standard-1'",
 		"--set 'redis.deploy=true'",
 		"--set-string 'redis.auth.username=redis'",
 		"--set-string 'redis.auth.password=redis-password'",
 		"--set 'redis.persistence.enabled=false'",
+		"--set-string 'global.redis.auth.existingSecret=redis-secret'",
 		"--set 'global.redis.tls.enabled=false'",
 		"--set 'global.redis.tls.verify=false'",
+		"--set-string 'global.rabbitmq.auth.existingSecret=rabbitmq-secret'",
+		"--set-string 'global.clickhouse.auth.existingSecret=ch-secret'",
 		"--set 'metrics.enabled=false'",
 		"--set 'rabbitmq.deploy=true'",
 		"--set-string 'rabbitmq.auth.username=rabbitmq'",
@@ -341,8 +349,8 @@ func TestValuesToHelmArgs(t *testing.T) {
 		"--set-string 'notifier.env[1].name=HTTPS_PROXY'",
 		"--set-string 'notifier.env[1].value=https://proxy.local'",
 		"--set-string 'cs-manager.registrationToken=registration-token'",
-		"--set-string 'auth-center.administrator.username=user'",
-		"--set-string 'auth-center.administrator.password=pass'",
+		"--set-string 'global.administrator.username=user'",
+		"--set-string 'global.administrator.password=pass'",
 	}
 
 	if diff := cmp.Diff(args, expectedArgs,
@@ -367,10 +375,6 @@ func TestValuesToYaml(t *testing.T) {
 	lines := strings.Split(yaml, "\n")
 
 	expectedLines := []string{
-		"auth-center:",
-		"  administrator:",
-		"    password: pass",
-		"    username: user",
 		"clickhouse:",
 		"  deploy: false",
 		"  externalHost: clickhouse.local",
@@ -379,8 +383,13 @@ func TestValuesToYaml(t *testing.T) {
 		"cs-manager:",
 		"  registrationToken: registration-token",
 		"global:",
+		"  administrator:",
+		"    password: pass",
+		"    username: user",
 		"  centralCsUrl: https://central-cs.local",
 		"  clickhouse:",
+		"    auth:",
+		"      existingSecret: ch-secret",
 		"    tls:",
 		"      enabled: false",
 		"      verify: false",
@@ -392,10 +401,17 @@ func TestValuesToYaml(t *testing.T) {
 		"    token: token-key",
 		"  ownCsUrl: https://cs.local",
 		"  postgresql:",
+		"    auth:",
+		"      existingSecret: pg-secret",
 		"    tls:",
 		"      enabled: true",
 		"      verify: true",
+		"  rabbitmq:",
+		"    auth:",
+		"      existingSecret: rabbitmq-secret",
 		"  redis:",
+		"    auth:",
+		"      existingSecret: redis-secret",
 		"    tls:",
 		"      enabled: false",
 		"      verify: false",

cluster-manager/pkg/service/cluster_generic.go

@@ -519,9 +519,9 @@ func (cg *ClusterGeneric) buildValues(cfg *model.ClusterConfig, token string) *h
 		}
 	}
 
-	// AuthAPI
-	v.AuthAPI.Administrator.Username = cg.AdministratorUsername
-	v.AuthAPI.Administrator.Password = cg.AdministratorPassword
+	// Administrator
+	v.Global.Administrator.Username = cg.AdministratorUsername
+	v.Global.Administrator.Password = cg.AdministratorPassword
 
 	return &v
 }

cs-manager/.helm/values.yaml

@@ -17,15 +17,13 @@ ownCsUrl: ""
 centralCsUrl: ""
 registrationToken: ""
 containerSecurityContext:
-  enabled: true
   seLinuxOptions: {}
   privileged: false
   allowPrivilegeEscalation: false
   readOnlyRootFilesystem: true
   seccompProfile:
     type: "RuntimeDefault"
 podSecurityContext:
-  enabled: true
   fsGroupChangePolicy: Always
   sysctls: []
   supplementalGroups: []
@@ -53,7 +51,6 @@ resources:
     memory: 512Mi
     ephemeral-storage: 1Gi
 livenessProbe:
-  enabled: true
   httpGet:
     path: /live
     scheme: HTTP
@@ -62,7 +59,6 @@ livenessProbe:
   successThreshold: 1
   failureThreshold: 2
 readinessProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP
@@ -71,7 +67,6 @@ readinessProbe:
   successThreshold: 1
   failureThreshold: 3
 startupProbe:
-  enabled: true
   httpGet:
     path: /ready
     scheme: HTTP