feat(plugin-access-manager): add auth-backend initDataFile + ALLOW_INSECURE_TLS

[guimoreirar]

feat(plugin-access-manager): add auth-backend initDataFile + ALLOW_INSECURE_TLS

Segregated from develop as its own PR to main (chart change only; Chart.yaml
version left to the release pipeline; docs/CHANGELOG handled separately).

[coderabbitai]

📝 Walkthrough

Walkthrough

The auth backend Helm templates add configurable insecure TLS and extra environment variables to the backend ConfigMap, while migration containers receive equivalent POSTGRES_* environment variables alongside existing DB_* variables.

Changes

Auth backend configuration

Layer / File(s)	Summary
ConfigMap settings charts/plugin-access-manager/templates/auth-backend/configmap.yaml	Adds the ALLOW_INSECURE_TLS setting with a "true" default and conditionally renders .Values.auth.backend.extraEnvVars.
Migration environment contract charts/plugin-access-manager/templates/auth-backend/migrations.yaml	Adds POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_SSLMODE using the existing ConfigMap and Secret values.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/plugin-access-manager-auth-backend

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

charts/plugin-access-manager/templates/auth-backend/configmap.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

charts/plugin-access-manager/templates/auth-backend/migrations.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/plugin-access-manager/templates/auth-backend/configmap.yaml`:
- Around line 23-27: Update the ALLOW_INSECURE_TLS template expression in the
auth backend ConfigMap so an explicitly configured boolean false is preserved
instead of being replaced by the true default. Use hasKey to apply the default
only when auth.backend.allowInsecureTLS is omitted, while continuing to quote
the rendered value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: efd74c1f-a5c6-4143-9fd9-d1c9b548cb59

📥 Commits

Reviewing files that changed from the base of the PR and between 0ec7a15 and 0cd7ece.

📒 Files selected for processing (2)

• charts/plugin-access-manager/templates/auth-backend/configmap.yaml
• charts/plugin-access-manager/templates/auth-backend/migrations.yaml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rendered="$(helm template review charts/plugin-access-manager \
  --set auth.backend.allowInsecureTLS=false)"

grep -q 'ALLOW_INSECURE_TLS: "false"' <<<"$rendered"

Repository: LerianStudio/helm

Length of output: 197

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '\n== target template ==\n'
cat -n charts/plugin-access-manager/templates/auth-backend/configmap.yaml | sed -n '1,120p'

printf '\n== values occurrences ==\n'
rg -n "allowInsecureTLS|ALLOW_INSECURE_TLS" charts/plugin-access-manager -S

printf '\n== values file snippets ==\n'
for f in \
  charts/plugin-access-manager/values.yaml \
  charts/plugin-access-manager/values*.yaml \
  charts/plugin-access-manager/templates/auth-backend/*.yaml \
  charts/plugin-access-manager/templates/auth-backend/**/*.yaml
do
  [ -f "$f" ] && { printf '\n-- %s --\n' "$f"; cat -n "$f" | sed -n '1,220p'; }
done

Repository: LerianStudio/helm

Length of output: 40071

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '1,120p' charts/plugin-access-manager/templates/auth-backend/configmap.yaml
printf '\n---\n'
rg -n "allowInsecureTLS|ALLOW_INSECURE_TLS" charts/plugin-access-manager -S
printf '\n--- values.yaml ---\n'
sed -n '1,220p' charts/plugin-access-manager/values.yaml

Repository: LerianStudio/helm

Length of output: 11359

---

charts/plugin-access-manager/templates/auth-backend/configmap.yaml:27 — Preserve false for the TLS toggle. default treats an explicit boolean false as empty, so this renders "true" and blocks disabling insecure TLS via a boolean override. Use hasKey to distinguish an omitted value from false, or make this setting a string.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/plugin-access-manager/templates/auth-backend/configmap.yaml` around
lines 23 - 27, Update the ALLOW_INSECURE_TLS template expression in the auth
backend ConfigMap so an explicitly configured boolean false is preserved instead
of being replaced by the true default. Use hasKey to apply the default only when
auth.backend.allowInsecureTLS is omitted, while continuing to quote the rendered
value.