Generate controller/router secrets with oneshot job

Makefile

@@ -159,7 +159,7 @@ deploy-exporters: cli
 
 .PHONY: lint-helm
 lint-helm:
-	helm lint deploy/helm/jumpstarter --set jumpstarter-controller.controllerSecret=abcd --set jumpstarter-controller.routerSecret=abcd
+	helm lint deploy/helm/jumpstarter
 
 
 .PHONY: undeploy
@@ -215,10 +215,6 @@ grpcurl: $(GRPCURL) ## Download grpcurl locally if necessary.
 $(GRPCURL): $(LOCALBIN)
 	$(call go-install-tool,$(GRPCURL),github.com/fullstorydev/grpcurl/cmd/grpcurl,$(GRPCURL_VERSION))
 
-.PHONY: helm-lint
-helm-lint:
-	helm lint ./deploy/helm/jumpstarter/
-
 .PHONY: kind
 kind: $(KIND)
 $(KIND): $(LOCALBIN)

deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/secrets-job.yaml

@@ -0,0 +1,30 @@
+{{- $namespace := default .Release.Namespace .Values.namespace }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: jumpstarter-controller
+  name: jumpstarter-secrets
+  namespace: {{ $namespace }}
+spec:
+  template:
+    metadata:
+      name: jumpstarter-secrets
+    spec:
+      serviceAccountName: controller-manager
+      containers:
+        - name: jumpstarter-secrets
+          image: quay.io/openshift/origin-cli
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+              {{- range $name := tuple "jumpstarter-router-secret" "jumpstarter-controller-secret" }}
+              if ! oc get secret {{ $name }} -n {{ $namespace }} >/dev/null 2>&1; then
+                oc create secret generic {{ $name }} -n={{ $namespace }} \
+                  --from-literal=key="$(openssl rand -hex 32)"
+              fi
+              {{- end }}
+      restartPolicy: Never

deploy/helm/jumpstarter/charts/jumpstarter-controller/values.yaml

@@ -1,8 +1,6 @@
 
 namespace: ""
 
-routerSecret: ""
-
 grpc:
   hostname: ""
   routerHostname: ""

deploy/helm/jumpstarter/values.yaml

@@ -29,12 +29,6 @@ global:
 ## @param jumpstarter-controller.tag Tag for the controller image.
 ## @param jumpstarter-controller.imagePullPolicy Image pull policy for the controller.
 
-## @param jumpstarter-controller.controllerSecret Secret used to sign tokens for the controller.
-##                                                If not set, a random secret will be generated.
-##                                                Please fill in to deploy from ArgoCD or the secret will be regenerated for each sync.
-## @param jumpstarter-controller.routerSecret Secret used to sign tokens for the router.
-##                                            If not set, a random secret will be generated.
-##                                            Please fill in to deploy from ArgoCD or the secret will be regenerated for each sync.
 ## @param jumpstarter-controller.namespace Namespace where the controller will be deployed, defaults to global.namespace.
 ## @param jumpstarter-controller.authenticationConfig Configuration for OIDC authentication, see https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration for documentation
 
@@ -71,8 +65,6 @@ jumpstarter-controller:
     imagePullPolicy: IfNotPresent
 
     namespace: ""
-    controllerSecret: ""
-    routerSecret: ""
 
     authenticationConfig: |
       apiVersion: jumpstarter.dev/v1alpha1

hack/deploy_with_helm.sh

@@ -107,13 +107,13 @@ kubectl config set-context --current --namespace=jumpstarter-lab
 
 echo -e "${GREEN}Waiting for grpc endpoints to be ready:${NC}"
 for ep in ${GRPC_ENDPOINT} ${GRPC_ROUTER_ENDPOINT}; do
-    RETRIES=30
+    RETRIES=60
     echo -e "${GREEN} * Checking ${ep} ... ${NC}"
     while ! ${GRPCURL} -insecure ${ep} list; do
         sleep 2
         RETRIES=$((RETRIES-1))
         if [ ${RETRIES} -eq 0 ]; then
-            echo -e "${GREEN} * ${ep} not ready after 60s, exiting ... ${NC}"
+            echo -e "${GREEN} * ${ep} not ready after 120s, exiting ... ${NC}"
             exit 1
         fi
     done