feat(pod): support roll deployment for external TLS certificates

The privious implemented feature pipe the secret not correctly to the sha256sum
function. This leads everytime to the same sha256 sum.

This patch fixes this bug.

.gitea/workflows/helm.yaml

@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5.0.1
-    - uses: azure/setup-helm@v4.3.0
+    - uses: azure/setup-helm@v4.3.1
       with:
-        version: v4.0.0 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.0.1 # renovate: datasource=github-releases depName=helm/helm
     - name: Lint helm files
       run: |
         helm lint --values values.yaml .
@@ -26,9 +26,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5.0.1
-    - uses: azure/setup-helm@v4.3.0
+    - uses: azure/setup-helm@v4.3.1
       with:
-        version: v4.0.0 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.0.1 # renovate: datasource=github-releases depName=helm/helm
     - env:
         HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
       name: Install helm-unittest

.gitea/workflows/release.yaml

@@ -8,7 +8,7 @@ on:
 jobs:
   publish-chart:
     container:
-      image: docker.io/volkerraschek/helm:4.0.1
+      image: docker.io/volkerraschek/helm:3.19.2
     runs-on: ubuntu-latest
     steps:
       - name: Install packages via apk

templates/_pod.tpl

@@ -4,6 +4,14 @@
 
 {{- define "athens-proxy.pod.annotations" }}
 {{- include "athens-proxy.annotations" . }}
+{{- if and .Values.certificate.enabled }}
+{{- $secretName := include "athens-proxy.certificates.server.name" $ }}
+{{- if and .Values.certificate.existingSecret.enabled (gt (len .Values.certificate.existingSecret.secretName) 0) }}
+{{- $secretName = .Values.certificate.existingSecret.secretName }}
+{{- end }}
+{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{ printf "checksum/secret-%s: %s" $secretName ($secret | toYaml | sha256sum) }}
+{{- end }}
 {{- if and .Values.config.env.enabled (not .Values.config.env.existingSecret.enabled) }}
 {{ printf "checksum/secret-%s: %s" (include "athens-proxy.secrets.env.name" $) (include (print $.Template.BasePath "/secretEnv.yaml") . | sha256sum) }}
 {{- end }}
@@ -21,8 +29,6 @@
 {{- end }}
 {{- end }}
 
-
-
 {{/* labels */}}
 
 {{- define "athens-proxy.pod.labels" -}}

unittests/deployment/certificate.yaml

@@ -46,6 +46,44 @@ tests:
     certificate.new.issuerRef.kind: ClusterIssuer
     certificate.new.issuerRef.name: MyIssuer
   asserts:
+    - exists:
+        path: spec.template.metadata.annotations["checksum/secret-athens-proxy-unittest-tls"]
+      template: templates/deployment.yaml
+    - contains:
+        path: spec.template.spec.containers[0].env
+        content:
+          name: ATHENS_TLSCERT_FILE
+          value: /etc/athens-proxy/tls/tls.crt
+      template: templates/deployment.yaml
+    - contains:
+        path: spec.template.spec.containers[0].env
+        content:
+          name: ATHENS_TLSKEY_FILE
+          value: /etc/athens-proxy/tls/tls.key
+      template: templates/deployment.yaml
+    - contains:
+        path: spec.template.spec.containers[0].volumeMounts
+        content:
+          name: tls
+          mountPath: /etc/athens-proxy/tls
+      template: templates/deployment.yaml
+    - contains:
+        path: spec.template.spec.volumes
+        content:
+          name: tls
+          secret:
+            secretName: athens-proxy-unittest-tls
+      template: templates/deployment.yaml
+
+- it: Rendering with external TLS config
+  set:
+    certificate.enabled: true
+    certificate.existingSecret.enabled: true
+    certificate.existingSecret.secretName: my-own-secret
+  asserts:
+    - exists:
+        path: spec.template.metadata.annotations["checksum/secret-my-own-secret"]
+      template: templates/deployment.yaml
     - contains:
         path: spec.template.spec.containers[0].env
         content: