Niklas Ye
b7d296f6e9
The bootstrap hook created `admin` with no password, so the account could only use its API key and could not sign in on the web UI or the TUI. It also won the one-shot /api/bootstrap against whoever ran it by hand, and failed with exit 1 when the Secret already existed, which fails the Helm release. The hook now generates a 32-character password, stores username, password and api-key in the <release>-admin-key Secret, and reuses the stored password on later runs, so recreating the database brings the same account back. The password is written before the account is created, so a crash in between cannot leave an administrator nobody has the password for. When the server was bootstrapped by something else, it checks the stored password against /api/login and removes only the password it generated if that does not sign in, then exits cleanly. bootstrap.enabled: false still removes the hook and its role. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
{{- if .Values.bootstrap.enabled }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ include "terdut-server.fullname" . }}-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "terdut-server.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: post-install,post-upgrade
|
|
helm.sh/hook-weight: "-1"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "terdut-server.fullname" . }}-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "terdut-server.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: post-install,post-upgrade
|
|
helm.sh/hook-weight: "-1"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["create"]
|
|
# Reading, filling in and (when the account turns out not to be ours) cleaning up the
|
|
# one Secret by name; `create` cannot be restricted to a name.
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["{{ include "terdut-server.bootstrapSecretName" . }}"]
|
|
verbs: ["get", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "terdut-server.fullname" . }}-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "terdut-server.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: post-install,post-upgrade
|
|
helm.sh/hook-weight: "-1"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ include "terdut-server.fullname" . }}-bootstrap
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "terdut-server.fullname" . }}-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end }}
|