ory/k8s

Oathkeeper fails to start if secret is disabled

Closed this issue · 2 comments

IxDay commented

Preflight checklist

Describe the bug

When using the oathkeeper chart if I disabled the secret generation, the oathkeeper container refuse to start since the secret is mounted by default as a volume but does not exist.

Reproducing the bug

Set the following values.yaml for the oathkeeper chart:

secret:
  enabled: true

Then try to deploy to Kubernetes to see that the deployment fails

Relevant log output

No response

Relevant configuration

secret:
  enabled: true

Version

0.27.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes with Helm

Additional Context

No response

Hello there!
I think this might rather be a documentation issue. We enforce that a secret will be present, whether created by the chart or by the user.
The logic used by all of the charts is as follows:

secret:
  # -- switch to false to prevent creating the secret
  enabled: true
  # -- Provide custom name of existing secret, or custom name of secret to be created
  nameOverride: ""

default option - the chart creates a secret with default name

secret:
  # -- switch to false to prevent creating the secret
  enabled: true
  # -- Provide custom name of existing secret, or custom name of secret to be created
  nameOverride: "my-secret"

custom name - the chart creates a secret with specified name

secret:
  # -- switch to false to prevent creating the secret
  enabled: false
  # -- Provide custom name of existing secret, or custom name of secret to be created
  nameOverride: ""

custom secret - we expect a secret with the default name will be present and can be used

secret:
  # -- switch to false to prevent creating the secret
  enabled: false
  # -- Provide custom name of existing secret, or custom name of secret to be created
  nameOverride: "my-secret"

custom name and secret - the chart expects that a secret with the custom name will be present and can be used

IxDay commented

Indeed, I will close this as a won't fix