Merge pull request #1179 from consideRatio/pr/merge-config-sources

Reduce complexity by merging configmap/secret into secret

Author: consideRatio

helm-chart/binderhub/files/binderhub_config.py

@@ -1,48 +1,21 @@
-import os
-from collections.abc import Mapping
 from functools import lru_cache
 from urllib.parse import urlparse
 
 from ruamel.yaml import YAML
 
 yaml = YAML(typ="safe")
 
-
-def _merge_dictionaries(a, b):
-    """Merge two dictionaries recursively.
-
-    Simplified From https://stackoverflow.com/a/7205107
-    """
-    merged = a.copy()
-    for key in b:
-        if key in a:
-            if isinstance(a[key], Mapping) and isinstance(b[key], Mapping):
-                merged[key] = _merge_dictionaries(a[key], b[key])
-            else:
-                merged[key] = b[key]
-        else:
-            merged[key] = b[key]
-    return merged
-
-
 # memoize so we only load config once
 @lru_cache()
 def _load_values():
     """Load configuration from disk
 
     Memoized to only load once
     """
-    cfg = {}
-    for source in ("config", "secret"):
-        path = f"/etc/binderhub/{source}/values.yaml"
-        if os.path.exists(path):
-            print(f"Loading {path}")
-            with open(path) as f:
-                values = yaml.load(f)
-            cfg = _merge_dictionaries(cfg, values)
-        else:
-            print(f"No config at {path}")
-    return cfg
+    path = "/etc/binderhub/config/values.yaml"
+    print(f"Loading {path}")
+    with open(path) as f:
+        return yaml.load(f)
 
 
 def get_value(key, default=None):

helm-chart/binderhub/templates/configmap.yaml

@@ -27,9 +27,8 @@ spec:
         {{- . | toYaml | nindent 8 }}
         {{- end }}
       annotations:
-        # This lets us autorestart when the configmap changes!
-        checksum/config-map: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        # This lets us autorestart when the secret's pass-through config changes
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
         {{- with .Values.podAnnotations }}
         {{- . | toYaml | nindent 8 }}
         {{- end }}
@@ -44,9 +43,6 @@ spec:
       {{- end }}
       volumes:
       - name: config
-        configMap:
-          name: binder-config
-      - name: secret-config
         secret:
           secretName: binder-secret
       {{- if .Values.config.BinderHub.use_registry }}
@@ -74,8 +70,7 @@ spec:
         volumeMounts:
           - mountPath: /etc/binderhub/config/
             name: config
-          - mountPath: /etc/binderhub/secret/
-            name: secret-config
+            readOnly: true
           {{- if .Values.config.BinderHub.use_registry }}
           - mountPath: /root/.docker
             name: docker-secret

helm-chart/binderhub/templates/deployment.yaml

@@ -1,19 +1,26 @@
+{{- /*
+  Note that changes to the rendered version of this
+  file will trigger a restart of the BinderHub pod
+  through a annotation containing a hash of this
+  file rendered.
+*/ -}}
 kind: Secret
 apiVersion: v1
 metadata:
   name: binder-secret
 type: Opaque
-data:
-  {{- $values :=  dict "config" dict }}
-  {{- $cfg := .Values.config }}
-  {{- /* every 'pick' here should be matched with a corresponding 'omit' in secret.yaml */ -}}
-  {{- if $cfg.GitHubRepoProvider }}
-  {{- $_ := set $values.config "GitHubRepoProvider" (pick $cfg.GitHubRepoProvider "client_id" "client_secret" "access_token") }}
-  {{- end }}
-  {{- if $cfg.GitLabRepoProvider }}
-  {{- $_ := set $values.config "GitLabRepoProvider" (pick $cfg.GitLabRepoProvider "access_token" "private_token") }}
-  {{- end }}
-  values.yaml: {{ $values | toYaml | b64enc | quote }}
+stringData:
+  {{- /*
+    Stash away relevant Helm template values for
+    the BinderHub Python application to read from
+    in binderhub_config.py.
+  */}}
+  values.yaml: |
+    {{- pick .Values "config" "cors" "dind" "extraConfig" | toYaml | nindent 4 }}
+
+  {{- /* Glob files to allow them to be mounted by the binderhub pod */}}
+  {{- /* key=filename: value=content */}}
+  {{- (.Files.Glob "files/*").AsConfig | nindent 2 }}
 ---
 {{- if or .Values.config.BinderHub.use_registry .Values.config.BinderHub.buildDockerConfig }}
 kind: Secret