Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SFTP: Allow to configure users via a secret #80

Merged
merged 2 commits into from
Mar 20, 2025
Merged

SFTP: Allow to configure users via a secret #80

merged 2 commits into from
Mar 20, 2025

Conversation

paoloyx
Copy link
Contributor

@paoloyx paoloyx commented Mar 19, 2025

What this PR wants to bring

As title, I wonder if could be useful to configure the chart via a K8s secret that uses the same exact configuration as the one provided by .Values.sftp.users. If present, the secret would take the precedence.

For example, instead of doing this:

---
# Default values for sftp.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
[...]
sftp:
  # Array based configuration of users 
  users:
    - name: demo
      pass: demo
      # -- password is encrypted ([doc](https://github.com/atmoz/sftp/blob/ffeb104beec76cc622abda34ee2132c790b5559c/README.md#encrypted-password))
      passEncrypted: false
      uid: ""
      gid: ""
      dirs:
        - upload
      # -- public user keys ([doc](https://github.com/atmoz/sftp/blob/ffeb104beec76cc622abda34ee2132c790b5559c/README.md#logging-in-with-ssh-keys))
      pubKeys: []

We could alternatively get users' configuration from a my-users-config pre-existing secret in the following way:

# Default values for sftp.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
[...]
sftp:
    # -- Reference to and existing secret that provides users' configuration.
  # If present takes precedence over `.Values.sftp.users` configuration,
  # whose schema is expected to use within a `users.conf` key 
  usersSecret: "my-users-config"

    # Set as empty array but could be left as it is with its default values
  users: {}

The my-users-config secret would be like this (please notice that I'm reading from a users.conf key):

➜  kubectl get secret my-users-config -o jsonpath='{.data.users\.conf}' | base64 -d
- name: demo
  pass: demo
  # -- password is encrypted ([doc](https://github.com/atmoz/sftp/blob/ffeb104beec76cc622abda34ee2132c790b5559c/README.md#encrypted-password))
  passEncrypted: false
  uid: ""
  gid: ""
  dirs:
    - upload
  # -- public user keys ([doc](https://github.com/atmoz/sftp/blob/ffeb104beec76cc622abda34ee2132c790b5559c/README.md#logging-in-with-ssh-keys))
      pubKeys: []

Please note

The code can be refactored as you may feel best to do. Additionally I have not updated the tests, but it won't be a problem to manage them if necessary :)

@sj14
Copy link
Owner

sj14 commented Mar 19, 2025

Hi paoloyx, I like the idea that the users can provide their own secret with the required data.
Please see if you can update the tests. I would love to have a new test case for it, but I think it will just fail, as the secret can't be found, but not quite sure how this case will behave, maybe give it a try to see if it will generate something valuable.

@paoloyx paoloyx changed the title Allow to configure users via a secret SFTP: Allow to configure users via a secret Mar 19, 2025
---
The `config-users.yaml` has been changed in structure, while preserving functionality, but its sha256sum  has changed accordingly, so I think that we must update it
@@ -105,7 +105,7 @@ spec:
template:
metadata:
annotations:
checksum/config-users: 4d68f819641e6054bd3a67f943eb97d34b2bacee919283f8ad35bee4ae8a981d
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sj14
The config-users.yaml has been changed in structure, while preserving functionality, but its sha256sum has changed accordingly, so I think that we must update it.
This is true for every test output, does it sound good for you?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that's expected.

@sj14 sj14 merged commit 02a58a4 into sj14:main Mar 20, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants