From 851b93b17de7c155463beba9c189fe608560819a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tizian=20R=C3=B6=C3=9Fler?= <t.roessler@openproject.com>
Date: Wed, 17 Sep 2025 10:18:34 +0200
Subject: [PATCH 1/2] add autogen for rails secret key

---
 charts/openproject/templates/_helpers.tpl      |  4 ++++
 .../templates/secret_rails_key.yaml            | 18 ++++++++++++++++++
 charts/openproject/values.yaml                 |  9 +++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 charts/openproject/templates/secret_rails_key.yaml

diff --git a/charts/openproject/templates/_helpers.tpl b/charts/openproject/templates/_helpers.tpl
index 16abb681..7ebed411 100644
--- a/charts/openproject/templates/_helpers.tpl
+++ b/charts/openproject/templates/_helpers.tpl
@@ -150,6 +150,10 @@ securityContext:
 - secretRef:
     name: {{ .Values.s3.auth.existingSecret }}
 {{- end }}
+{{- if .Values.openproject.railsSecretKey.enabled }}
+- secretRef:
+    name: {{ .Values.openproject.railsSecretKey.existingSecret | default (printf "%s-rails-secret-key" (include "common.names.fullname" .)) }}
+{{- end }}
 {{- if eq .Values.openproject.cache.store "memcache" }}
 - secretRef:
     name: {{ include "common.names.fullname" . }}-memcached
diff --git a/charts/openproject/templates/secret_rails_key.yaml b/charts/openproject/templates/secret_rails_key.yaml
new file mode 100644
index 00000000..14ed553c
--- /dev/null
+++ b/charts/openproject/templates/secret_rails_key.yaml
@@ -0,0 +1,18 @@
+{{- if and .Values.openproject.railsSecretKey.enabled (not .Values.openproject.railsSecretKey.existingSecret) }}
+---
+apiVersion: "v1"
+kind: "Secret"
+metadata:
+  name: "{{ include "common.names.fullname" . }}-rails-secret-key"
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+data:
+  {{- $name := printf "%s-rails-secret-key" (include "common.names.fullname" .) }}
+  {{- $existing := (lookup "v1" "Secret" .Release.Namespace $name) | default dict }}
+  {{- $existingData := (get $existing "data") | default dict }}
+  {{- $secret := (get $existingData "SECRET_KEY_BASE") | default (randAlphaNum 64 | b64enc) }}
+
+  SECRET_KEY_BASE: {{ $secret | quote }}
+ 
+...
+{{- end }}
diff --git a/charts/openproject/values.yaml b/charts/openproject/values.yaml
index d7f40ffe..cc564191 100644
--- a/charts/openproject/values.yaml
+++ b/charts/openproject/values.yaml
@@ -322,6 +322,15 @@ openproject:
   #
   hsts: true
 
+  ## Configure Rails secret key
+  #  if enabled is set to false the Rails secret key needs to be configured via env vars
+  #  set the existingSecret use an existing secret containing the Rails secret key 
+  #  if existingSecret is not set the secret will be autogenerated
+  railsSecretKey:
+    enabled: true
+    existingSecret:
+
+
   ## Define Cache settings.
   #
   cache:

From bc3ce3f52ff227d24a1fdc7691e799090a1b89a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tizian=20R=C3=B6=C3=9Fler?= <t.roessler@openproject.com>
Date: Wed, 17 Sep 2025 10:19:34 +0200
Subject: [PATCH 2/2] add tests for rails scret autogen

---
 .../openproject/rails_secret_key_spec.rb      | 84 +++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 spec/charts/openproject/rails_secret_key_spec.rb

diff --git a/spec/charts/openproject/rails_secret_key_spec.rb b/spec/charts/openproject/rails_secret_key_spec.rb
new file mode 100644
index 00000000..94ba9f0e
--- /dev/null
+++ b/spec/charts/openproject/rails_secret_key_spec.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'base64'
+
+describe 'rails secret key configuration' do
+  let(:template) { HelmTemplate.new(default_values) }
+
+  let(:env_from) do
+    web_deployment = template.dig('Deployment/optest-openproject-web')
+    web_deployment.dig('spec', 'template', 'spec', 'containers', 0, 'envFrom')
+  end
+
+  context 'autogenerated secret key' do
+    let(:default_values) do
+      {}
+    end
+
+    let(:secret_key_data) do
+      template.dig('Secret/optest-openproject-rails-secret-key', 'data')
+    end
+
+    let(:rails_secret) do
+      env_from.select { |item| item.dig('secretRef', 'name')&.include?('rails-secret-key') }
+    end
+
+    it 'has rails secret key' do
+      expect(secret_key_data).to include 'SECRET_KEY_BASE'
+
+      secret_key_len = Base64.decode64(secret_key_data['SECRET_KEY_BASE']).length
+      expect(secret_key_len).to eq 64
+    end
+
+    it 'uses autogenerated secret key in container' do
+      expect(rails_secret).to contain_exactly(
+        { 'secretRef' => { 'name'=>'optest-openproject-rails-secret-key' } }
+      )
+    end
+  end
+
+  context 'existing secret key' do
+    let(:default_values) do
+      HelmTemplate.with_defaults(<<~YAML
+        openproject:
+          railsSecretKey:
+            enabled: true
+            existingSecret: my-rails-key
+      YAML
+      )
+    end
+
+    let(:rails_secret) do
+      env_from.select { |item| item.dig('secretRef', 'name')&.include?('my-rails-key') }
+    end
+
+    it 'uses existing secret key in container' do
+      expect(rails_secret).to contain_exactly(
+        { 'secretRef' => { 'name'=>'my-rails-key' } }
+      )
+    end
+  end
+
+  context 'disabled secret' do
+    let(:default_values) do
+      HelmTemplate.with_defaults(<<~YAML
+        openproject:
+          railsSecretKey:
+            enabled: false
+            existingSecret: my-rails-key
+      YAML
+      )
+    end
+
+    it 'uses rails secret key in container' do
+      expect(env_from).not_to include(
+        'secretRef' => { 'name' => 'my-rails-key' }
+      )
+
+      expect(env_from).not_to include(
+        'secretRef' => { 'name'=>'optest-openproject-rails-secret-key' }
+      )
+    end
+  end
+end