Skip to content

fix(common): streaming.secret requires SASL username with the mechanism #1798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guimoreirar merged 2 commits into from
Jul 31, 2026
Merged

fix(common): streaming.secret requires SASL username with the mechanism #1798

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e002ff
fix(common): streaming.secret requires SASL username with the mechanism
guimoreirar Jul 31, 2026
2bbd552
docs(common): usage example resolves SASL mechanism/username with con…
guimoreirar Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions charts/lerian-common/templates/_streaming.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,19 +105,28 @@ on install AND upgrade (these values are operator/Vault-provided, never generate
matching `data:`/`stringData:` key:

# STREAMING SECRETS
# Resolve mechanism + username with the SAME configmap-over-global precedence the
# ConfigMap uses (streaming.env), so a ConfigMap-only mechanism is still validated and
# a ConfigMap-only username does not cause a false failure. An explicit empty ConfigMap
# value is preserved (hasKey) so validation still fails when it should.
{{- $saslMech := (((.Values.global | default dict).streaming | default dict).saslMechanism | default "") }}
{{- if hasKey .Values.ledger.configmap "STREAMING_SASL_MECHANISM" }}{{- $saslMech = index .Values.ledger.configmap "STREAMING_SASL_MECHANISM" }}{{- end }}
{{- $saslUser := (((.Values.global | default dict).streaming | default dict).saslUsername | default "") }}
{{- if hasKey .Values.ledger.configmap "STREAMING_SASL_USERNAME" }}{{- $saslUser = index .Values.ledger.configmap "STREAMING_SASL_USERNAME" }}{{- end }}
{{- with (include "lerian-common.streaming.secret" (dict
"context" . "secrets" .Values.ledger.secrets
"secretName" (include "midaz.ledger.fullname" .)
"valuesPrefix" "ledger.secrets." "mode" "data"
"enabled" true "useExistingSecret" .Values.ledger.useExistingSecret
"saslMechanism" (dig "streaming" "saslMechanism" "" (.Values.global | default dict)))) }}
"saslMechanism" $saslMech "saslUsername" $saslUser)) }}
{{- . | nindent 2 }}
{{- end }}

Inputs: context, secrets, secretName, valuesPrefix, mode,
enabled (bool — STREAMING_ENABLED),
useExistingSecret (bool — skip entirely when true),
saslMechanism (string — when non-empty, SASL_PASSWORD becomes required).
saslMechanism (string — when non-empty, both SASL_USERNAME and SASL_PASSWORD become required),
saslUsername (string — the resolved STREAMING_SASL_USERNAME; required when saslMechanism is set).
------------------------------------------------------------------------------
*/}}
{{- define "lerian-common.streaming.secret" -}}
Expand All @@ -126,6 +135,14 @@ Inputs: context, secrets, secretName, valuesPrefix, mode,
{{- $b64 := eq (.mode | default "stringData") "data" -}}
{{- $ns := .context.Release.Namespace -}}
{{- $lines := list -}}
{{- /* STREAMING_SASL_USERNAME — required (with the password) whenever a SASL mechanism
is set; lib-streaming rejects a mechanism without BOTH credentials. The username is a
ConfigMap value (not a secret), resolved by the caller with the same precedence
(configmap.STREAMING_SASL_USERNAME -> global.streaming.saslUsername) and passed here so
the render fails fast instead of shipping a boot-crashing config. */ -}}
{{- if and .saslMechanism (not .saslUsername) -}}
{{- fail (printf "\n[lerian-common] Value required but empty: STREAMING_SASL_USERNAME\n a SASL mechanism (%s) is set, which requires both a username and a password.\n set: configmap.STREAMING_SASL_USERNAME (or global.streaming.saslUsername)\n" .saslMechanism) -}}
{{- end -}}
{{- /* STREAMING_SASL_PASSWORD — required only when a SASL mechanism is set */ -}}
{{- $sasl := index $s "STREAMING_SASL_PASSWORD" -}}
{{- if and .saslMechanism (not $sasl) -}}
Expand Down
Loading