PWB: Support defining sensitive config values via k8s secrets

[pat-s]

Applies to

• launcherPem
• secureCookieKey
• userPassword
• database.conf

When doing so, the rstudio-secret is skipped and individual mounts containing the above-mentioned secret values are injected.

This PR is breaking as the items listed are now maps and existing deployments would need to migrate from launcherPem: <value> to launcherPem.value: <value>.

I've tested this in a deployment of mine and it works as expected so far.

secureCookieKey:
  existingSecret: secure-cookie-key
launcherPem:
  existingSecret: launcher-pem
config:
  database:
    conf:
      existingSecret: database-conf
userPassword:
  existingSecret: workbench-user-password

The advantage of this approach is that it gives power to the users and makes use of "simple" k8s secrets instead of relying on some chart magic which puts together a bundled secret from plain config values.

related #520 #493

[damienleger-cure51]

Hello, I would love to see this merged! 🙏

On my setup, helm chart is deployed through ArgoCD and it doesn't support helm lookup function. This lookup function is the one responsible for checking that launcher.pem+secureCookieKey exists, resulting of those secret values regenerated on every ArgoCD sync. Having those to be set only directly on values.yaml currently to fix this situation is a problem for sensitive value.

[bschwedler]

@jforest We will probably want this to be a new minor version

Suggested change

	version: 1.0.0
	version: 0.9.0

[jforest]

hi @pat-s can you please merge a recent main into this? There have been a lot of changes since july, including the addition of helm unittests to run!