feat(mozcloud): externalSecrets -> secrets in container defs, syntax fixes

mozcloud/application/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: mozcloud
 description: Opinionated application chart used to deploy MozCloud Kubernetes 
   resources supporting resources
-version: 0.15.0
+version: 0.16.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib

mozcloud/application/README.md

@@ -1,6 +1,6 @@
 # mozcloud
 
-![Version: 0.15.0](https://img.shields.io/badge/Version-0.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Opinionated application chart used to deploy MozCloud Kubernetes resources supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud
-    version: ~0.15.0
+    version: ~0.16.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -65,10 +65,10 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 | tasks.common.container.command | list | `[]` |  |
 | tasks.common.container.configMaps | list | `[]` |  |
 | tasks.common.container.envVars | object | `{}` |  |
-| tasks.common.container.externalSecrets | list | `[]` |  |
 | tasks.common.container.image | object | `{}` |  |
 | tasks.common.container.resources.cpu | string | `"100m"` |  |
 | tasks.common.container.resources.memory | string | `"128Mi"` |  |
+| tasks.common.container.secrets | list | `[]` |  |
 | tasks.common.container.security | object | `{}` |  |
 | tasks.common.container.volumes | list | `[]` |  |
 | tasks.common.cronJob.jobHistory | object | `{}` |  |
@@ -90,10 +90,10 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 | tasks.jobs.default.containers.default.command | list | `[]` |  |
 | tasks.jobs.default.containers.default.configMaps | list | `[]` |  |
 | tasks.jobs.default.containers.default.envVars | object | `{}` |  |
-| tasks.jobs.default.containers.default.externalSecrets | list | `[]` |  |
 | tasks.jobs.default.containers.default.image.repository | string | `""` |  |
 | tasks.jobs.default.containers.default.image.tag | string | `""` |  |
 | tasks.jobs.default.containers.default.resources | object | `{}` |  |
+| tasks.jobs.default.containers.default.secrets | list | `[]` |  |
 | tasks.jobs.default.containers.default.security | object | `{}` |  |
 | tasks.jobs.default.containers.default.volumes | list | `[]` |  |
 | tasks.jobs.default.generateName | bool | `false` |  |
@@ -114,7 +114,6 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 | workloads.default.containers.default.command | list | `[]` |  |
 | workloads.default.containers.default.configMaps | list | `[]` |  |
 | workloads.default.containers.default.envVars | object | `{}` |  |
-| workloads.default.containers.default.externalSecrets | list | `[]` |  |
 | workloads.default.containers.default.healthCheck.liveness.enabled | bool | `true` |  |
 | workloads.default.containers.default.healthCheck.liveness.httpHeaders | list | `[]` |  |
 | workloads.default.containers.default.healthCheck.liveness.path | string | `"/__lbheartbeat__"` |  |
@@ -136,6 +135,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 | workloads.default.containers.default.port | int | `8000` |  |
 | workloads.default.containers.default.resources.cpu | string | `"100m"` |  |
 | workloads.default.containers.default.resources.memory | string | `"128Mi"` |  |
+| workloads.default.containers.default.secrets | list | `[]` |  |
 | workloads.default.containers.default.security | object | `{}` |  |
 | workloads.default.enabled | bool | `true` |  |
 | workloads.default.hosts.default.addresses | list | `[]` |  |
@@ -151,11 +151,11 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 | workloads.default.initContainers.default.command | list | `[]` |  |
 | workloads.default.initContainers.default.configMaps | list | `[]` |  |
 | workloads.default.initContainers.default.envVars | object | `{}` |  |
-| workloads.default.initContainers.default.externalSecrets | list | `[]` |  |
 | workloads.default.initContainers.default.image.repository | string | `""` |  |
 | workloads.default.initContainers.default.image.tag | string | `""` |  |
 | workloads.default.initContainers.default.resources.cpu | string | `"100m"` |  |
 | workloads.default.initContainers.default.resources.memory | string | `"128Mi"` |  |
+| workloads.default.initContainers.default.secrets | list | `[]` |  |
 | workloads.default.initContainers.default.security | object | `{}` |  |
 | workloads.default.initContainers.default.sidecar | bool | `false` |  |
 | workloads.default.labels | object | `{}` |  |

mozcloud/application/templates/_annotations.yaml

@@ -19,9 +19,9 @@ Returns:
   (string) YAML-encoded dict of merged annotations.
 */ -}}
 {{- define "mozcloud.annotations" -}}
-{{- $annotations := default (dict) .annotations -}}
+{{- $annotations := default dict .annotations -}}
 {{- $context := .context -}}
-{{- $otel := default (dict) .otel -}}
+{{- $otel := default dict .otel -}}
 {{- $type := .type -}}
 {{- $params := dict "annotations" $annotations "type" $type "otel" $otel -}}
 {{- if $otel -}}
@@ -126,7 +126,7 @@ Returns:
 {{ include "mozcloud.annotations.otel.resources" (dict "labels" $labels) }}
   {{- /* Auto instrumentation */}}
   {{- $autoInstrumentationAnnotations := dict }}
-  {{- $containers := default (list) $config.containers }}
+  {{- $containers := default list $config.containers }}
   {{- $autoInstrumentationEnabled := and $containers (dig "autoInstrumentation" "enabled" false $config) ($config.autoInstrumentation).language }}
   {{- if $autoInstrumentationEnabled }}
     {{- $params := dict "containers" $containers "language" $config.autoInstrumentation.language }}

mozcloud/application/templates/_formatter.yaml

@@ -250,7 +250,7 @@ Example:
     {{- /* Merge host configs with defaults */}}
     {{- $hostValues := $defaultWorkload.hosts -}}
     {{- $hosts := dict -}}
-    {{- $configHosts := default (dict) $config.hosts -}}
+    {{- $configHosts := default dict $config.hosts -}}
     {{- range $hostName, $hostConfig := $configHosts -}}
       {{- $_ := set $hosts $hostName (mergeOverwrite ($hostValues.default | deepCopy) $hostConfig) -}}
     {{- end -}}

mozcloud/application/templates/_labels.yaml

@@ -55,7 +55,7 @@ Returns:
 {{- /* Generate labels */ -}}
 {{- $params := mergeOverwrite .context (dict "labels" .labels) -}}
 {{- $labels := include "mozcloud-labels-lib.labels" $params | fromYaml -}}
-{{- $labels = mergeOverwrite (default (dict) .labels) $labels -}}
+{{- $labels = mergeOverwrite (default dict .labels) $labels -}}
 {{- $_ := set $output "labels" $labels -}}
 {{- /* Generate selector labels */ -}}
 {{- $selectorLabels := include "mozcloud-labels-lib.selectorLabels" $params | fromYaml -}}

mozcloud/application/templates/_pod.yaml

@@ -41,7 +41,7 @@ Example:
 */ -}}
 {{- define "pod.container.resources" -}}
 {{- $requests := .requests -}}
-{{- $limits := default (dict) .limits -}}
+{{- $limits := default dict .limits -}}
 {{- $resources := dict "requests" .requests "limits" $limits -}}
 {{- /* Validate CPU requests and limits */ -}}
 {{- $requestSuffix := "" -}}
@@ -159,7 +159,7 @@ Returns:
 {{- define "pod.container.securityContext" -}}
 allowPrivilegeEscalation: false
 capabilities:
-  {{- if gt (len (default (list) .addCapabilities)) 0 }}
+  {{- if gt (len (default list .addCapabilities)) 0 }}
   add:
     {{- range $capability := .addCapabilities }}
     - {{ $capability }}

mozcloud/application/templates/gateway/backend.yaml

@@ -25,9 +25,9 @@ Returns:
 {{- $provider := index (index .Values "cloud" | default dict) "provider" | default "gke" -}}
 backends:
   {{- range $workloadName, $workloadConfig := $workloads }}
-  {{- range $hostName, $hostConfig := default (dict) $workloadConfig.hosts }}
+  {{- range $hostName, $hostConfig := default dict $workloadConfig.hosts }}
   {{- if $hostConfig.backends }}
-  {{- range $backend := (default (list) $hostConfig.backends) }}
+  {{- range $backend := (default list $hostConfig.backends) }}
   {{ $backend.name }}:
     component: {{ $workloadConfig.component }}
     api: {{ default "gateway" $hostConfig.api }}

mozcloud/application/templates/gateway/gateway.yaml

@@ -48,7 +48,7 @@ Returns:
 {{- /* Collect all unique gateway configurations */}}
 {{- $gatewayConfigs := dict }}
 {{- range $workloadName, $workloadConfig := $workloads }}
-  {{- range $hostName, $hostConfig := default (dict) $workloadConfig.hosts }}
+  {{- range $hostName, $hostConfig := default dict $workloadConfig.hosts }}
     {{- /* Skip if using a shared gateway */}}
     {{- if not ($hostConfig).sharedGateway }}
       {{- /* Build gateway configuration key based on unique attributes */}}
@@ -73,7 +73,7 @@ Returns:
       {{- end }}
       {{- $certs := list }}
       {{- if eq $hostConfig.type "external" }}
-        {{- if gt (len (default (list) $hostConfig.tls.certs)) 0 }}
+        {{- if gt (len (default list $hostConfig.tls.certs)) 0 }}
           {{- $certs = $hostConfig.tls.certs }}
         {{- else }}
           {{- $certs = list (printf "%s-%s-%s" $globals.app_code $globals.realm $globals.env_code) }}

mozcloud/application/templates/gateway/httproute.yaml

@@ -27,7 +27,7 @@ Returns:
 {{- $workloads := .workloads -}}
 httpRoutes:
   {{- range $workloadName, $workloadConfig := $workloads }}
-  {{- range $hostName, $hostConfig := default (dict) $workloadConfig.hosts }}
+  {{- range $hostName, $hostConfig := default dict $workloadConfig.hosts }}
   {{- if (($hostConfig).httpRoutes).createHttpRoutes }}
   {{ $hostName }}:
     component: {{ $workloadConfig.component }}
@@ -45,7 +45,7 @@ httpRoutes:
         {{- $hasMultipleTypes := false }}
         {{- $types := dict }}
         {{- range $wlName, $wlConfig := $workloads }}
-          {{- range $hName, $hConfig := default (dict) $wlConfig.hosts }}
+          {{- range $hName, $hConfig := default dict $wlConfig.hosts }}
             {{- if not ($hConfig).sharedGateway }}
               {{- $_ := set $types $hConfig.type true }}
             {{- end }}

mozcloud/application/templates/gke/frontendconfig.yaml

@@ -24,7 +24,7 @@ Returns:
 {{- $workloads := .workloads }}
 frontendConfigs:
   {{- range $workloadName, $workloadConfig := $workloads }}
-  {{- range $hostName, $hostConfig := default (dict) $workloadConfig.hosts }}
+  {{- range $hostName, $hostConfig := default dict $workloadConfig.hosts }}
   {{- if eq $hostConfig.type "external" }}
   {{ $hostName }}:
     component: {{ $workloadConfig.component }}

mozcloud/application/templates/ingress/ingress.yaml

@@ -30,7 +30,7 @@ Returns:
 {{- $workloads := .workloads }}
 ingresses:
   {{- range $workloadName, $workloadConfig := $workloads }}
-  {{- range $hostName, $hostConfig := default (dict) $workloadConfig.hosts }}
+  {{- range $hostName, $hostConfig := default dict $workloadConfig.hosts }}
   {{- if eq $hostConfig.type "external" }}
   {{ $hostName }}:
     component: {{ $workloadConfig.component }}

mozcloud/application/templates/task/_jobTemplate.yaml

@@ -32,13 +32,13 @@ Returns:
 {{- define "mozcloud.job.jobTemplate" -}}
 {{- $common := deepCopy .common }}
 {{- $context := .context }}
-{{- $jobConfig := mergeOverwrite (default (dict) $common.job) .config }}
+{{- $jobConfig := mergeOverwrite (default dict $common.job) .config }}
 {{- $prefix := include "mozcloud.preview.prefix" $context }}
 {{- $volumes := dict }}
 {{- /* Compute labels for the pod template using the mozcloud-labels library */ -}}
 {{- $chartMetadata := dict "Chart" $context.Chart "Release" $context.Release }}
 {{- $labelParams := mergeOverwrite $chartMetadata (include "mozcloud.labelParams" $context | fromYaml) }}
-{{- $labelsParams := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default (dict) $jobConfig.labels) }}
+{{- $labelsParams := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default dict $jobConfig.labels) }}
 {{- $podLabels := (include "mozcloud.labels" $labelsParams | fromYaml).labels }}
 {{- if $jobConfig.activeDeadlineSeconds }}
 activeDeadlineSeconds: {{ $jobConfig.activeDeadlineSeconds }}
@@ -75,9 +75,9 @@ template:
       {{- $params = dict "containers" $jobConfig.containers "type" "containers" }}
       {{- $containers := include "mozcloud.formatter.containers" $params | fromYaml }}
       {{- range $containerName, $containerConfig := $containers }}
-        {{- $containerConfig = mergeOverwrite (deepCopy (default (dict) $common.container)) $containerConfig }}
+        {{- $containerConfig = mergeOverwrite (deepCopy (default dict $common.container)) $containerConfig }}
       - name: {{ $containerName }}
-        {{- $globalImage := default (dict) $context.Values.global.mozcloud.image }}
+        {{- $globalImage := default dict $context.Values.global.mozcloud.image }}
         {{- $imageRepo := default (($globalImage).repository) ($containerConfig.image).repository }}
         {{- $imageTag := default (($globalImage).tag) ($containerConfig.image).tag }}
         {{- if not $imageRepo }}
@@ -119,13 +119,13 @@ template:
             value: {{ $envVarValue | quote }}
           {{- end }}
         {{- end }}
-        {{- if or $containerConfig.configMaps $containerConfig.externalSecrets }}
+        {{- if or $containerConfig.configMaps $containerConfig.secrets }}
         envFrom:
-          {{- range $configMap := default (list) $containerConfig.configMaps }}
+          {{- range $configMap := default list $containerConfig.configMaps }}
           - configMapRef:
               name: {{ printf "%s%s" $prefix $configMap }}
           {{- end }}
-          {{- range $secret := default (list) $containerConfig.externalSecrets }}
+          {{- range $secret := default list $containerConfig.secrets }}
           - secretRef:
               name: {{ printf "%s%s" $prefix $secret }}
           {{- end }}

mozcloud/application/templates/task/cronjob.yaml

@@ -3,7 +3,7 @@
 {{- $context := deepCopy . }}
 {{- $globals := .Values.global.mozcloud }}
 {{- $labelParams := mergeOverwrite $chartMetadata (include "mozcloud.labelParams" . | fromYaml) }}
-{{- $formatterParams := mergeOverwrite (. | deepCopy) (dict "common" $common "cronJobs" (default (dict) .Values.tasks.cronJobs)) }}
+{{- $formatterParams := mergeOverwrite (. | deepCopy) (dict "common" $common "cronJobs" (default dict .Values.tasks.cronJobs)) }}
 {{- $cronJobs := include "mozcloud.task.formatter.cronJob" $formatterParams | fromYaml }}
 {{- if $cronJobs }}
 {{- $_ := set $context "component_code" "cronjob" -}}
@@ -15,10 +15,10 @@ kind: CronJob
 metadata:
   name: {{ $name }}
   labels:
-    {{- $params := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default (dict) $config.labels) }}
+    {{- $params := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default dict $config.labels) }}
     {{- $labels := include "mozcloud.labels" $params | fromYaml }}
     {{- $labels.labels | toYaml | nindent 4 }}
-  {{- $params = dict "annotations" (default (dict) $config.annotations) "context" ($context | deepCopy) "otel" ($config.otel) "type" "cronJob" }}
+  {{- $params = dict "annotations" (default dict $config.annotations) "context" ($context | deepCopy) "otel" ($config.otel) "type" "cronJob" }}
   {{- $annotations := include "mozcloud.annotations" $params | fromYaml }}
   {{- if $annotations }}
   annotations:

mozcloud/application/templates/task/job.yaml

@@ -3,7 +3,7 @@
 {{- $context := deepCopy . }}
 {{- $globals := .Values.global.mozcloud }}
 {{- $labelParams := mergeOverwrite $chartMetadata (include "mozcloud.labelParams" . | fromYaml) }}
-{{- $formatterParams := mergeOverwrite (. | deepCopy) (dict "common" $common "jobs" (default (dict) .Values.tasks.jobs)) }}
+{{- $formatterParams := mergeOverwrite (. | deepCopy) (dict "common" $common "jobs" (default dict .Values.tasks.jobs)) }}
 {{- $jobs := include "mozcloud.task.formatter.job" $formatterParams | fromYaml }}
 {{- if $jobs }}
 {{- $_ := set $context "component_code" "job" -}}
@@ -21,7 +21,7 @@ metadata:
   {{- end }}
   name: {{ $name }}
   labels:
-    {{- $params := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default (dict) $config.labels) }}
+    {{- $params := dict "context" (mergeOverwrite (deepCopy $context) $labelParams) "labels" (default dict $config.labels) }}
     {{- $labels := include "mozcloud.labels" $params | fromYaml }}
     {{- $labels.labels | toYaml | nindent 4 }}
   {{- $type := "" }}
@@ -32,7 +32,7 @@ metadata:
   {{- end }}
   {{- $params = dict "syncWave" (($config.argo).syncWave) "type" $type }}
   {{- $argoAnnotations := include "mozcloud.annotations.argo" $params | fromYaml }}
-  {{- $params = dict "annotations" (mergeOverwrite $argoAnnotations (default (dict) $config.annotations)) "context" ($context | deepCopy) "type" "job" }}
+  {{- $params = dict "annotations" (mergeOverwrite $argoAnnotations (default dict $config.annotations)) "context" ($context | deepCopy) "type" "job" }}
   {{- $annotations := include "mozcloud.annotations" $params | fromYaml }}
   {{- if $annotations }}
   annotations:

mozcloud/application/templates/workload/deployment.yaml

@@ -76,7 +76,7 @@ spec:
       {{- if gt (keys $volumes | len) 0 }}
         {{- range $volumeName, $volumeConfig := $volumes }}
           {{- if eq $volumeConfig.type "configMap" }}
-            {{- $configMapData := index (default (dict) $context.Values.configMaps) $volumeName }}
+            {{- $configMapData := index (default dict $context.Values.configMaps) $volumeName }}
             {{- if $configMapData }}
               {{- $checksumKey := printf "checksum/configmap-%s" $volumeName }}
               {{- $_ := set $configMapChecksums $checksumKey ($configMapData | toYaml | sha256sum) }}
@@ -208,7 +208,7 @@ spec:
               value: {{ $envVarValue | quote }}
             {{- end }}
           {{- end }}
-          {{- if or $containerConfig.configMaps $defaultSecretEnabled $containerConfig.externalSecrets }}
+          {{- if or $containerConfig.configMaps $defaultSecretEnabled $containerConfig.secrets }}
           envFrom:
             {{- if $containerConfig.configMaps }}
             {{- range $configMap := $containerConfig.configMaps }}
@@ -220,10 +220,10 @@ spec:
             - secretRef:
                 name: {{ $defaultSecretName }}
             {{- end }}
-            {{- if $containerConfig.externalSecrets }}
-            {{- range $externalSecret := $containerConfig.externalSecrets }}
+            {{- if $containerConfig.secrets }}
+            {{- range $secret := $containerConfig.secrets }}
             - secretRef:
-                name: {{ printf "%s%s" $prefix $externalSecret }}
+                name: {{ printf "%s%s" $prefix $secret }}
             {{- end }}
             {{- end }}
           {{- end }}
@@ -357,7 +357,7 @@ spec:
               value: {{ $envVarValue | quote }}
             {{- end }}
           {{- end }}
-          {{- if or $containerConfig.configMaps $defaultSecretEnabled $containerConfig.externalSecrets }}
+          {{- if or $containerConfig.configMaps $defaultSecretEnabled $containerConfig.secrets }}
           envFrom:
             {{- if $containerConfig.configMaps }}
             {{- range $configMap := $containerConfig.configMaps }}
@@ -369,10 +369,10 @@ spec:
             - secretRef:
                 name: {{ $defaultSecretName }}
             {{- end }}
-            {{- if $containerConfig.externalSecrets }}
-            {{- range $externalSecret := $containerConfig.externalSecrets }}
+            {{- if $containerConfig.secrets }}
+            {{- range $secret := $containerConfig.secrets }}
             - secretRef:
-                name: {{ printf "%s%s" $prefix $externalSecret }}
+                name: {{ printf "%s%s" $prefix $secret }}
             {{- end }}
             {{- end }}
           {{- end }}