Harden flame-node chart security#137
Open
brucetony wants to merge 2 commits into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR refactors credential management across the flame-node Helm chart to support external secrets. It introduces a Keycloak credentials helper, converts hardcoded secrets to dynamic templates with conditional ChangesExternal Secrets and Credential Management
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
charts/flame-node/templates/secret.yaml (1)
22-33: ⚡ Quick winConsider
helm.sh/resource-policy: keepon the auto-generated Postgres credential secrets.These secrets now hold randomly-generated passwords that the persisted Postgres PVC/DB initialize against.
lookuppreserves them across upgrades, but if the Secret is ever deleted (e.g. partial uninstall while volumes are retained) while the PVC survives, a reinstall regenerates a new random password that won't match the on-disk database, breaking auth. Thekeycloak-client-secrets(line 9) already usesresource-policy: keep; applying the same here makes persistence robust. Applies equally to the kong (line 45) and keycloak (line 65) Postgres secrets.🛡️ Example for the postgres-credentials-secret
metadata: name: {{ $pgDefaultSecretName }} namespace: {{ .Release.Namespace }} + annotations: + helm.sh/resource-policy: keep type: Opaque🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@charts/flame-node/templates/secret.yaml` around lines 22 - 33, Add the Helm keep policy annotation to the autogenerated Postgres credential Secrets so they are not deleted by Helm (preventing mismatched DB passwords after partial uninstall/reinstall); specifically update the Secret templates that create the secret named by $pgDefaultSecretName and the Kong and Keycloak Postgres secrets to include metadata.annotations["helm.sh/resource-policy"]="keep" (add the annotation block under metadata in the Secret manifests such as the template that defines superPassword, DB_USER, DB_PASSWORD, DB_DATABASE and the equivalent Kong and Keycloak secret templates).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/flame-node/values.yaml`:
- Around line 300-307: The values.yaml currently sets weak defaults
adminUsername: admin and adminPassword: admin which defeats the required guard
in secret.yaml; update charts/flame-node/values.yaml to remove the unsafe
default by setting adminPassword: "" (and optionally adminUsername: "" or
document that it must be set) so the required "adminPassword is required"
validation in secret.yaml actually fails when not provided; alternatively
implement auto-generation/persistence using the same lookup pattern as the
Postgres secrets if you prefer non-empty defaults.
---
Nitpick comments:
In `@charts/flame-node/templates/secret.yaml`:
- Around line 22-33: Add the Helm keep policy annotation to the autogenerated
Postgres credential Secrets so they are not deleted by Helm (preventing
mismatched DB passwords after partial uninstall/reinstall); specifically update
the Secret templates that create the secret named by $pgDefaultSecretName and
the Kong and Keycloak Postgres secrets to include
metadata.annotations["helm.sh/resource-policy"]="keep" (add the annotation block
under metadata in the Secret manifests such as the template that defines
superPassword, DB_USER, DB_PASSWORD, DB_DATABASE and the equivalent Kong and
Keycloak secret templates).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 530e8f20-56c7-4f76-a2a0-822f46967785
📒 Files selected for processing (10)
charts/flame-node/Chart.yamlcharts/flame-node/flame-node-data-store/charts/blaze-0.1.0.tgzcharts/flame-node/flame-node-data-store/values.yamlcharts/flame-node/templates/_helpers.tplcharts/flame-node/templates/keycloak/env-configmap.yamlcharts/flame-node/templates/keycloak/flame-keycloak-realm-configmap.yamlcharts/flame-node/templates/keycloak/keycloak-secret-sync-job.yamlcharts/flame-node/templates/secret.yamlcharts/flame-node/values.yamlcharts/flame-node/values_min.yaml
brucetony
added
the
deploy/preview
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores