fix: use secret for artifactoryUrl

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+

charts/snyk-broker/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: snyk-broker
-version: 2.6.3
+version: 2.6.4
 description: A Helm chart for Kubernetes
 type: application

charts/snyk-broker/templates/broker_deployment.yaml

@@ -245,9 +245,21 @@ spec:
                   name: {{ .Values.scmType}}-broker-token{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
                   key: "{{ .Values.scmType}}-broker-token-key"
             - name: ARTIFACTORY_URL
-              value: {{ .Values.artifactoryUrl }}
+              valueFrom:
+                secretKeyRef:
+                  name: artifactory-url{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
+                  key: "artifactory-url"
             - name: PORT
               value: {{ .Values.deployment.container.containerPort | squote }}
+            - name: BROKER_CLIENT_URL
+              value: {{ .Values.brokerClientUrl }}
+            {{- if .Values.brokerClientValidationUrl }}
+            - name: BROKER_CLIENT_VALIDATION_URL
+              valueFrom:
+                secretKeyRef:
+                  name: artifactory-broker-client-validation-url{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
+                  key: "artifactory-broker-client-validation-url"
+            {{- end }}
           {{- end }}
           {{- if or (eq .Values.scmType "nexus") (eq .Values.scmType "nexus2") }}
           # Nexus (3 or 2)
@@ -266,10 +278,8 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.scmType }}-nexus-url{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
                   key: "{{ .Values.scmType}}-nexus-url"
-
             - name: BROKER_CLIENT_VALIDATION_URL
               value: {{ .Values.brokerClientValidationUrl }}
-
             - name: PORT
               value: {{ .Values.deployment.container.containerPort | squote }}
           {{- end }}
@@ -367,15 +377,15 @@ spec:
           # Snyk Code Local Engine
             - name: GIT_CLIENT_URL
               value: {{ tpl .Values.gitClientUrl . }}
-         {{- end }}        
+         {{- end }}
          # Logging
             - name: LOG_LEVEL
               value: {{ .Values.logLevel }}
             - name: LOG_ENABLE_BODY
               value: {{ .Values.logEnableBody | squote }}
 
          {{- if and (.Values.caCert) (not .Values.caCertFile) }}
-         # HTTPS Inspection 
+         # HTTPS Inspection
             - name: CA_CERT
               value: /home/node/cacert/{{ .Values.caCert }}
             - name: NODE_EXTRA_CA_CERTS
@@ -388,7 +398,7 @@ spec:
             - name: NODE_EXTRA_CA_CERTS
               value: /home/node/cacert/cacert
          {{- end }}
-         
+
          {{- if .Values.httpsCert }}
          # HTTPS Config
             - name: HTTPS_CERT
@@ -398,7 +408,7 @@ spec:
             - name: HTTPS_KEY
               value: /home/node/tls-cert/tls.key
          {{- end }}
-         
+
          {{- if .Values.tlsRejectUnauthorized  }}
          # Troubleshooting - Set to 0 for SSL inspection testing
             - name: NODE_TLS_REJECT_UNAUTHORIZED
@@ -456,10 +466,10 @@ spec:
         {{- range .Values.env }}
          # custom env var in override.yaml
             - name: {{ .name }}
-              value: {{ .value | squote }} 
+              value: {{ .value | squote }}
         {{- end}}
             - name: BROKER_DISPATCHER_BASE_URL
-              value: {{ .Values.brokerDispatcherUrl }} 
+              value: {{ .Values.brokerDispatcherUrl }}
       # Mount Accept.json and Certs
       volumes:
       {{- if (include "snyk-broker.acceptJson" .)}}

charts/snyk-broker/templates/secrets.yaml

@@ -98,6 +98,26 @@ data:
   "snyk-token-key": {{ .Values.snykToken | b64enc | quote }}
 ---
 {{- end }}
+{{- if .Values.artifactoryUrl }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: artifactory-url{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
+type: Opaque
+stringData:
+  artifactory-url: {{ .Values.artifactoryUrl | quote }}
+---
+{{- end }}
+{{- if and (.Values.artifactoryUrl) (.Values.brokerClientValidationUrl) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: artifactory-broker-client-validation-url{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
+type: Opaque
+stringData:
+  artifactory-broker-client-validation-url: {{ .Values.brokerClientValidationUrl | quote }}
+---
+{{- end }}
 {{- if .Values.baseNexusUrl }}
 apiVersion: v1
 kind: Secret
@@ -116,7 +136,7 @@ metadata:
 type: Opaque
 data:
   "nexus-nexus-url": {{ .Values.nexusUrl | b64enc | quote }}
----  
+---
 {{- end}}
 {{- if and (.Values.httpsCert) (.Values.httpsKey) }}
 apiVersion: v1
@@ -127,5 +147,5 @@ type: kubernetes.io/tls
 data:
   tls.crt: {{ (.Files.Get .Values.httpsCert) | b64enc | quote }}
   tls.key: {{ (.Files.Get .Values.httpsKey) | b64enc | quote }}
----  
+---
 {{- end }}

charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_disablesuffixes_test.yaml.snap

@@ -7,7 +7,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: container-registry-agent-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -108,7 +108,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: container-registry-agent-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -135,6 +135,6 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE

charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_test.yaml.snap

@@ -7,7 +7,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: container-registry-agent-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -108,7 +108,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: container-registry-agent-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -135,6 +135,6 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE

charts/snyk-broker/tests/__snapshot__/broker_deployment_apprisk_test.yaml.snap

@@ -7,7 +7,7 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: github-com-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -107,7 +107,7 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: github-com-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -134,6 +134,6 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.3
+        helm.sh/chart: snyk-broker-2.6.4
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE

charts/snyk-broker/tests/__snapshot__/broker_deployment_artifactory_test.yaml.snap

@@ -0,0 +1,154 @@
+should render artifactoryUrl and brokerClientValidationUrl as secrets:
+  1: |
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      labels:
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+        helm.sh/chart: snyk-broker-2.6.4
+      name: artifactory-broker-RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          app.kubernetes.io/instance: RELEASE-NAME
+          app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+        spec:
+          containers:
+            - env:
+                - name: BROKER_SERVER_URL
+                  value: https://broker.test.snyk.io
+                - name: BROKER_HEALTHCHECK_PATH
+                  value: /healthcheck
+                - name: BROKER_SYSTEMCHECK_PATH
+                  value: /systemcheck
+                - name: BROKER_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      key: artifactory-broker-token-key
+                      name: artifactory-broker-token-RELEASE-NAME
+                - name: ARTIFACTORY_URL
+                  valueFrom:
+                    secretKeyRef:
+                      key: artifactory-url
+                      name: artifactory-url-RELEASE-NAME
+                - name: PORT
+                  value: "8000"
+                - name: BROKER_CLIENT_URL
+                  value: http://brokerclient
+                - name: BROKER_CLIENT_VALIDATION_URL
+                  valueFrom:
+                    secretKeyRef:
+                      key: artifactory-broker-client-validation-url
+                      name: artifactory-broker-client-validation-url-RELEASE-NAME
+                - name: LOG_LEVEL
+                  value: info
+                - name: LOG_ENABLE_BODY
+                  value: "false"
+                - name: BROKER_DISPATCHER_BASE_URL
+                  value: https://api.test.snyk.io
+              image: snyk/broker:artifactory
+              imagePullPolicy: Always
+              livenessProbe:
+                failureThreshold: 3
+                httpGet:
+                  path: /healthcheck
+                  port: 8000
+                  scheme: HTTP
+                initialDelaySeconds: 3
+                periodSeconds: 10
+                timeoutSeconds: 1
+              name: artifactory-broker-RELEASE-NAME
+              ports:
+                - containerPort: 8000
+                  name: http
+              readinessProbe:
+                failureThreshold: 3
+                httpGet:
+                  path: /healthcheck
+                  port: 8000
+                  scheme: HTTP
+                initialDelaySeconds: 3
+                periodSeconds: 10
+                timeoutSeconds: 1
+              resources:
+                limits:
+                  cpu: 1
+                  memory: 256Mi
+                requests:
+                  cpu: 1
+                  memory: 256Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                runAsUser: 1000
+              volumeMounts: null
+          securityContext: {}
+          serviceAccountName: snyk-broker-RELEASE-NAME
+          volumes: null
+  2: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      labels:
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+        helm.sh/chart: snyk-broker-2.6.4
+      name: artifactory-broker-service-RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      ports:
+        - port: 8000
+          targetPort: 8000
+      selector:
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+      type: ClusterIP
+  3: |
+    apiVersion: v1
+    data:
+      artifactory-broker-token-key: MTIz
+    kind: Secret
+    metadata:
+      name: artifactory-broker-token-RELEASE-NAME
+    type: Opaque
+  4: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: artifactory-url-RELEASE-NAME
+    stringData:
+      artifactory-url: username:[email protected]/artifactory
+    type: Opaque
+  5: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: artifactory-broker-client-validation-url-RELEASE-NAME
+    stringData:
+      artifactory-broker-client-validation-url: https://username:[email protected]/artifactory/api/system/ping
+    type: Opaque
+  6: |
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      labels:
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: snyk-broker-RELEASE-NAME
+        helm.sh/chart: snyk-broker-2.6.4
+      name: snyk-broker-RELEASE-NAME
+      namespace: NAMESPACE