chore(authelia): cleanup secret a bit (#7768)

* chore(authelia): cleanup secret a bit

* Daemonset -> DaemonSet

* fix some typos

* no group  on nested var

* more typos

* cspell

* lowercase all

charts/enterprise/authelia/Chart.yaml

@@ -36,7 +36,7 @@ sources:
   - https://github.com/authelia/chartrepo
   - https://github.com/authelia/authelia
 type: application
-version: 15.0.8
+version: 15.0.9
 annotations:
   truecharts.org/catagories: |
     - security

charts/enterprise/authelia/questions.yaml

@@ -22,8 +22,8 @@ questions:
       required: true
   - variable: default_redirection_url
     group: "App Configuration"
-    label: "Default Redirection Url"
-    description: "If user tries to authenticate without any referer, this is used"
+    label: "Default Redirection URL"
+    description: "If user tries to authenticate without any referrer, this is used"
     schema:
       type: string
       default: ""
@@ -44,7 +44,7 @@ questions:
           description: "dark"
   - variable: log
     group: "App Configuration"
-    label: "Log Configuration "
+    label: "Log Configuration"
     schema:
       additional_attrs: true
       type: dict
@@ -179,7 +179,7 @@ questions:
   - variable: regulation
     group: "App Configuration"
     label: "Regulation Configuration"
-    description: "his mechanism prevents attackers from brute forcing the first factor."
+    description: "This mechanism prevents attackers from brute forcing the first factor."
     schema:
       additional_attrs: true
       type: dict
@@ -241,15 +241,15 @@ questions:
                   subquestions:
                     - variable: implementation
                       label: "Implementation"
-                      description: "The LDAP implementation, this affects elements like the attribute utilised for resetting a password"
+                      description: "The LDAP implementation, this affects elements like the attribute utilized for resetting a password"
                       schema:
                         type: string
                         default: "custom"
                         enum:
                           - value: "activedirectory"
-                            description: "activedirectory"
+                            description: "Active Directory"
                           - value: "custom"
-                            description: "custom"
+                            description: "Custom"
                     - variable: url
                       label: "URL"
                       description: "The url to the ldap server. Format: <scheme>://<address>[:<port>]"
@@ -446,7 +446,7 @@ questions:
   - variable: notifier
     group: "App Configuration"
     label: "Notifier Configuration"
-    description: "otifications are sent to users when they require a password reset, a u2f registration or a TOTP registration."
+    description: "Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration."
     schema:
       additional_attrs: true
       type: dict
@@ -804,7 +804,7 @@ questions:
             type: dict
             attrs:
               - variable: enabled
-                label: "enabled"
+                label: "Enabled"
                 schema:
                   type: boolean
                   default: false

charts/enterprise/authelia/templates/_secrets.tpl

@@ -2,26 +2,31 @@
 {{- define "authelia.secrets" -}}
 {{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}}
 {{- $fetchname := printf "%s-authelia-secrets" $basename -}}
-{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace $fetchname }}
-{{- $oidckey := "" }}
-{{- $oidcsecret := "" }}
-{{- $jwtsecret := "" }}
-{{- $sessionsecret := "" }}
-{{- $encryptionkey := "" }}
+
+{{/* Initialize all keys */}}
+{{- $oidckey := genPrivateKey "rsa" }}
+{{- $oidcsecret := randAlphaNum 32 }}
+{{- $jwtsecret := randAlphaNum 50 }}
+{{- $sessionsecret := randAlphaNum 50 }}
+{{- $encryptionkey := randAlphaNum 100 }}
+
 enabled: true
 data:
-  {{- if $autheliaprevious }}
-  SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY" | b64dec  }}
-  JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN" | b64dec }}
-  ENCRYPTION_KEY: {{ index $autheliaprevious.data "ENCRYPTION_KEY" | b64dec }}
-  {{- else }}
-  {{- $jwtsecret := randAlphaNum 50 }}
-  {{- $sessionsecret := randAlphaNum 50 }}
-  {{- $encryptionkey := randAlphaNum 100 }}
+  {{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }}
+    {{/* Get previous values and decode */}}
+    {{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }}
+    {{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }}
+    {{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }}
+
+    {{/* Check if those keys ever existed. as OIDC is optional */}}
+    {{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }}
+      {{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }}
+      {{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }}
+    {{ end }}
+  {{ end }}
   SESSION_ENCRYPTION_KEY: {{ $sessionsecret }}
-  JWT_TOKEN: {{ $jwtsecret}}
+  JWT_TOKEN: {{ $jwtsecret }}
   ENCRYPTION_KEY: {{ $encryptionkey }}
-  {{- end }}
 
   {{- if .Values.authentication_backend.ldap.enabled }}
   LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
@@ -42,15 +47,8 @@ data:
   REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }}
   {{- end }}
 
-  {{- if $autheliaprevious }}
-  {{- if and ( hasKey $autheliaprevious.data "OIDC_PRIVATE_KEY" ) ( hasKey $autheliaprevious.data "OIDC_HMAC_SECRET" ) }}
-  OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY" | b64dec  }}
-  OIDC_HMAC_SECRET: {{ index $autheliaprevious.data "OIDC_HMAC_SECRET" | b64dec  }}
-  {{- else }}
-  {{- $oidckey := genPrivateKey "rsa"   }}
-  {{- $oidcsecret := randAlphaNum 32 }}
+  {{- if .Values.identity_providers.oidc.enabled }}
   OIDC_PRIVATE_KEY: {{ $oidckey }}
   OIDC_HMAC_SECRET: {{ $oidcsecret }}
   {{- end }}
-  {{- end }}
 {{- end -}}