Skip to content

feat(plugin-access-manager): add auth-backend initDataFile + ALLOW_INSECURE_TLS #1718

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guimoreirar wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(plugin-access-manager): add auth-backend initDataFile + ALLOW_INSECURE_TLS #1718

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion charts/plugin-access-manager/templates/auth-backend/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,14 @@ data:
enableGzip: "true"
quota: '{"organization": -1, "user": -1, "application": -1, "provider": -1}'
logConfig: '{"filename": "logs/casdoor.log", "maxdays": 99999, "perm": "0770"}'
initDataFile: {{ .Values.auth.backend.initDataFile | default "./init_data.json" | quote }}
initDataFile: {{ .Values.auth.backend.initDataFile | default "./init_data.json" | quote }}
# Allows the backend's outbox Postgres client to connect without a valid
# certificate. Same default and rationale as auth.configmap.ALLOW_INSECURE_TLS
# and identity.configmap.ALLOW_INSECURE_TLS. Casdoor ignores this key; only
# caradhras' outbox client reads it, and it fails closed without it.
ALLOW_INSECURE_TLS: {{ .Values.auth.backend.allowInsecureTLS | default "true" | quote }}
Comment on lines +23 to +27

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rendered="$(helm template review charts/plugin-access-manager \
  --set auth.backend.allowInsecureTLS=false)"

grep -q 'ALLOW_INSECURE_TLS: "false"' <<<"$rendered"

Repository: LerianStudio/helm

Length of output: 197

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '\n== target template ==\n'
cat -n charts/plugin-access-manager/templates/auth-backend/configmap.yaml | sed -n '1,120p'

printf '\n== values occurrences ==\n'
rg -n "allowInsecureTLS|ALLOW_INSECURE_TLS" charts/plugin-access-manager -S

printf '\n== values file snippets ==\n'
for f in \
  charts/plugin-access-manager/values.yaml \
  charts/plugin-access-manager/values*.yaml \
  charts/plugin-access-manager/templates/auth-backend/*.yaml \
  charts/plugin-access-manager/templates/auth-backend/**/*.yaml
do
  [ -f "$f" ] && { printf '\n-- %s --\n' "$f"; cat -n "$f" | sed -n '1,220p'; }
done

Repository: LerianStudio/helm

Length of output: 40071

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '1,120p' charts/plugin-access-manager/templates/auth-backend/configmap.yaml
printf '\n---\n'
rg -n "allowInsecureTLS|ALLOW_INSECURE_TLS" charts/plugin-access-manager -S
printf '\n--- values.yaml ---\n'
sed -n '1,220p' charts/plugin-access-manager/values.yaml

Repository: LerianStudio/helm

Length of output: 11359

charts/plugin-access-manager/templates/auth-backend/configmap.yaml:27 — Preserve false for the TLS toggle. default treats an explicit boolean false as empty, so this renders "true" and blocks disabling insecure TLS via a boolean override. Use hasKey to distinguish an omitted value from false, or make this setting a string.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/plugin-access-manager/templates/auth-backend/configmap.yaml` around
lines 23 - 27, Update the ALLOW_INSECURE_TLS template expression in the auth
backend ConfigMap so an explicitly configured boolean false is preserved instead
of being replaced by the true default. Use hasKey to apply the default only when
auth.backend.allowInsecureTLS is omitted, while continuing to quote the rendered
value.


# Extra Env Vars
{{- with .Values.auth.backend.extraEnvVars }}
{{- toYaml . | nindent 2 }}
{{- end }}
32 changes: 32 additions & 0 deletions charts/plugin-access-manager/templates/auth-backend/migrations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,4 +68,36 @@ spec:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_SSLMODE
# POSTGRES_* mirrors of the DB_* vars above, mapped from the same
# ConfigMap/Secret keys. The caradhras migration runner
# (cmd/postgres-migrations) reads POSTGRES_HOST/PORT/USER/PASSWORD/DB/SSLMODE
# instead of Casdoor's DB_* contract; keeping both sets lets this single
# Job template run either migrations image via auth.backend.migrations.image,
# with no functional effect on casdoor-migrations (which ignores POSTGRES_*).
- name: POSTGRES_HOST
valueFrom:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_HOST
- name: POSTGRES_PORT
valueFrom:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_PORT
- name: POSTGRES_DB
valueFrom:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_NAME
- name: POSTGRES_USER
valueFrom:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_USER
{{- include "plugin-auth.dbPasswordEnv" (dict "context" $ "envName" "POSTGRES_PASSWORD") | nindent 12 }}
- name: POSTGRES_SSLMODE
valueFrom:
configMapKeyRef:
name: {{ include "plugin-auth.fullname" . }}
key: DB_SSLMODE
restartPolicy: OnFailure
Loading