Autogen secret key

charts/openproject/templates/_helpers.tpl

@@ -150,6 +150,10 @@ securityContext:
 - secretRef:
     name: {{ .Values.s3.auth.existingSecret }}
 {{- end }}
+{{- if .Values.openproject.railsSecretKey.enabled }}
+- secretRef:
+    name: {{ .Values.openproject.railsSecretKey.existingSecret | default (printf "%s-rails-secret-key" (include "common.names.fullname" .)) }}
+{{- end }}
 {{- if eq .Values.openproject.cache.store "memcache" }}
 - secretRef:
     name: {{ include "common.names.fullname" . }}-memcached

charts/openproject/templates/secret_rails_key.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.openproject.railsSecretKey.enabled (not .Values.openproject.railsSecretKey.existingSecret) }}
+---
+apiVersion: "v1"
+kind: "Secret"
+metadata:
+  name: "{{ include "common.names.fullname" . }}-rails-secret-key"
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+data:
+  {{- $name := printf "%s-rails-secret-key" (include "common.names.fullname" .) }}
+  {{- $existing := (lookup "v1" "Secret" .Release.Namespace $name) | default dict }}
+  {{- $existingData := (get $existing "data") | default dict }}
+  {{- $secret := (get $existingData "SECRET_KEY_BASE") | default (randAlphaNum 64 | b64enc) }}
+
+  SECRET_KEY_BASE: {{ $secret | quote }}
+
+...
+{{- end }}

charts/openproject/values.yaml

@@ -322,6 +322,15 @@
   #
   hsts: true
 
+  ## Configure Rails secret key
+  #  if enabled is set to false the Rails secret key needs to be configured via env vars
+  #  set the existingSecret use an existing secret containing the Rails secret key 
+  #  if existingSecret is not set the secret will be autogenerated
+  railsSecretKey:
+    enabled: true
+    existingSecret:
+
+
   ## Define Cache settings.
   #
   cache:
@@ -331,7 +340,7 @@
 
   ## Define the language to seed the instance in
   #
   seed_locale: "en"
 
   ##
   # Let OpenProject run in a subdirectory,

spec/charts/openproject/rails_secret_key_spec.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'base64'
+
+describe 'rails secret key configuration' do
+  let(:template) { HelmTemplate.new(default_values) }
+
+  let(:env_from) do
+    web_deployment = template.dig('Deployment/optest-openproject-web')
+    web_deployment.dig('spec', 'template', 'spec', 'containers', 0, 'envFrom')
+  end
+
+  context 'autogenerated secret key' do
+    let(:default_values) do
+      {}
+    end
+
+    let(:secret_key_data) do
+      template.dig('Secret/optest-openproject-rails-secret-key', 'data')
+    end
+
+    let(:rails_secret) do
+      env_from.select { |item| item.dig('secretRef', 'name')&.include?('rails-secret-key') }
+    end
+
+    it 'has rails secret key' do
+      expect(secret_key_data).to include 'SECRET_KEY_BASE'
+
+      secret_key_len = Base64.decode64(secret_key_data['SECRET_KEY_BASE']).length
+      expect(secret_key_len).to eq 64
+    end
+
+    it 'uses autogenerated secret key in container' do
+      expect(rails_secret).to contain_exactly(
+        { 'secretRef' => { 'name'=>'optest-openproject-rails-secret-key' } }
+      )
+    end
+  end
+
+  context 'existing secret key' do
+    let(:default_values) do
+      HelmTemplate.with_defaults(<<~YAML
+        openproject:
+          railsSecretKey:
+            enabled: true
+            existingSecret: my-rails-key
+      YAML
+      )
+    end
+
+    let(:rails_secret) do
+      env_from.select { |item| item.dig('secretRef', 'name')&.include?('my-rails-key') }
+    end
+
+    it 'uses existing secret key in container' do
+      expect(rails_secret).to contain_exactly(
+        { 'secretRef' => { 'name'=>'my-rails-key' } }
+      )
+    end
+  end
+
+  context 'disabled secret' do
+    let(:default_values) do
+      HelmTemplate.with_defaults(<<~YAML
+        openproject:
+          railsSecretKey:
+            enabled: false
+            existingSecret: my-rails-key
+      YAML
+      )
+    end
+
+    it 'uses rails secret key in container' do
+      expect(env_from).not_to include(
+        'secretRef' => { 'name' => 'my-rails-key' }
+      )
+
+      expect(env_from).not_to include(
+        'secretRef' => { 'name'=>'optest-openproject-rails-secret-key' }
+      )
+    end
+  end
+end