Move the cookieSigningKey to a secret

charts/kellnr/templates/_helpers.tpl

@@ -80,10 +80,10 @@ Cookie signing key used by Kellnr.
 Note: Helm templates don't have a "bytes" unit here; we can only validate string length.
 */}}
 {{- define "kellnr.cookieSigningKey" -}}
-{{- $key := default "" .Values.kellnr.registry.cookieSigningKey -}}
+{{- $key := default "" .Values.kellnr.registry.cookieSecret.cookieSigningKey -}}
 {{- if ne $key "" -}}
   {{- if lt (len $key) 64 -}}
-    {{- fail "kellnr.registry.cookieSigningKey must be at least 64 characters" -}}
+    {{- fail "kellnr.registry.cookieSecret.cookieSigningKey must be at least 64 characters" -}}
   {{- end -}}
   {{- $key -}}
 {{- else -}}

charts/kellnr/templates/secret-cookie.yaml

@@ -0,0 +1,9 @@
+{{- $cookieKey := include "kellnr.cookieSigningKey" . -}}
+{{ if and .Values.kellnr.registry.cookieSecret.enabled (not (empty $cookieKey)) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.kellnr.registry.cookieSecret.cookieSecretRef.name }}
+stringData:
+  {{ .Values.kellnr.registry.cookieSecret.cookieSecretRef.key }}: {{ $cookieKey | quote }}
+{{- end }}

charts/kellnr/values.yaml

@@ -88,8 +88,13 @@ kellnr:
 
     # Used to sign the session cookie. Must be at least 64 bytes.
     # If empty, a random 64-byte value is generated by the chart (when `secret.enabled: true`).
-    # When `secret.enabled: false`, you should set this to a fixed value.
-    cookieSigningKey: ""
+    # When `secret.enabled: false`, set cookieSecret.enable to true and set cookieSecret.cookieSigningKey to a fixed value.
+    cookieSecret:
+      enabled: false
+      cookieSigningKey: ""
+      cookieSecretRef:
+        name: kellnr-cookie-secret
+        key: cookieSigningKey
 
   docs:
     enabled: null # false