migration to 2.0: replace SURREAL_AUTH env var with SURREAL_UNAUTHENT…

…ICATED (#9) Co-authored-by: Gerard Guillemas Martos <[email protected]> Co-authored-by: Gerard Guillemas Martos <[email protected]> Co-authored-by: Yusuke Kuoka <[email protected]>
surrealdb · Nov 12, 2024 · 3064fe9 · 3064fe9
1 parent ba85538
commit 3064fe9
Show file tree

Hide file tree

Showing 10 changed files with 296 additions and 7 deletions.
diff --git a/charts/surrealdb/Chart.yaml b/charts/surrealdb/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: surrealdb
 type: application
-version: 0.3.4
+version: 0.3.5
 appVersion: 1.0.0
 description: SurrealDB is the ultimate cloud database for tomorrow's applications.
 keywords:

diff --git a/charts/surrealdb/README.md b/charts/surrealdb/README.md
@@ -1,6 +1,6 @@
 # SurrealDB Helm Chart
 
-![Version: 0.3.4](https://img.shields.io/badge/Version-0.3.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 0.3.5](https://img.shields.io/badge/Version-0.3.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
 
 SurrealDB is the ultimate cloud database for tomorrow's applications.
 

diff --git a/charts/surrealdb/templates/deployment.yaml b/charts/surrealdb/templates/deployment.yaml
@@ -56,8 +56,20 @@ spec:
             - name: SURREAL_PASS
               value: {{ . }}
             {{- end }}
+            {{- $auth := "uninitialized" }}
+            {{- if hasKey .Values.surrealdb "auth" }}
+            {{- if hasKey .Values.surrealdb "unauthenticated" }}
+            {{ fail "surrealdb.auth and surrealdb.unauthenticated are mutually exclusive" }}
+            {{- else }}
+            {{- $auth = .Values.surrealdb.auth }}
+            {{- end }}
+            {{- else }}
+            {{- $auth = not .Values.surrealdb.unauthenticated }}
+            {{- end }}
             - name: SURREAL_AUTH
-              value: "{{ .Values.surrealdb.auth }}"
+              value: "{{ $auth }}"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "{{ not $auth }}"
             {{- with .Values.surrealdb.object_cache }}
             - name: SURREAL_OBJECT_CACHE
               value: {{ . }}

diff --git a/charts/surrealdb/values.yaml b/charts/surrealdb/values.yaml
@@ -33,12 +33,19 @@ surrealdb:
   path: memory
   # -- Log configuration
   log: info
-  # -- Authentication enabled
-  auth: "true"
-  # If you want to bootstrap the datastore with an initial user, use these values the first time you install the chart
+  # -- Initial user credentials
+  # Set these values to bootstrap the datastore with an initial root user the first time you install the chart.
   # Remember to remove them after the first install, as they are no longer used:
   # initial_user: ""
   # initial_pass: ""
+  # -- Enable unauthenticated access
+  # Warning: Enabling it will allow any unauthenticated user to access SurrealDB!
+  # Authentication is enabled by default in 2.x. This value replaces the depreacted "auth" value.
+  # unauthenticated: false
+  # -- DEPRECATED: Enable authentication
+  # This value has been deprecated in 2.x but is kept for backward compatibility.
+  # The "unauthenticated" value should now be used instead, which will be converted in 1.x deployments.
+  # auth: true
 
   # -- SurrealDB container port
   port: 8000

diff --git a/tests/surrealdb_test.go b/tests/surrealdb_test.go
@@ -4,4 +4,24 @@ import "testing"
 
 func TestDeployment(t *testing.T) {
 	testTemplate(t, "deployment.yaml", "default", map[string]interface{}{})
+	testTemplate(t, "deployment.yaml", "release deployed using pre v0.3.5 chart with the default surrealdb.auth", map[string]interface{}{
+		"surrealdb": map[string]interface{}{
+			"auth": true,
+		},
+	})
+	testTemplate(t, "deployment.yaml", "disable auth using deprecated surrealdb.auth", map[string]interface{}{
+		"surrealdb": map[string]interface{}{
+			"auth": false,
+		},
+	})
+	testTemplate(t, "deployment.yaml", "surrealdb.unauthenticated=false has no effect", map[string]interface{}{
+		"surrealdb": map[string]interface{}{
+			"unauthenticated": false,
+		},
+	})
+	testTemplate(t, "deployment.yaml", "disable auth using surrealdb.unauhenticated", map[string]interface{}{
+		"surrealdb": map[string]interface{}{
+			"unauthenticated": true,
+		},
+	})
 }
diff --git a/tests/testdata/snapshots/deployment.yaml/default b/tests/testdata/snapshots/deployment.yaml/default
@@ -5,7 +5,7 @@ kind: Deployment
 metadata:
   name: testrelease-surrealdb
   labels:
-    helm.sh/chart: surrealdb-0.3.4
+    helm.sh/chart: surrealdb-0.3.5
     app.kubernetes.io/name: surrealdb
     app.kubernetes.io/instance: testrelease
     app.kubernetes.io/version: "1.0.0"
@@ -44,6 +44,8 @@ spec:
               value: 0.0.0.0:8000
             - name: SURREAL_AUTH
               value: "true"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "false"
           ports:
             - name: http
               containerPort: 8000

diff --git a/tests/testdata/snapshots/deployment.yaml/disable auth using deprecated surrealdb.auth b/tests/testdata/snapshots/deployment.yaml/disable auth using deprecated surrealdb.auth
@@ -0,0 +1,62 @@
+---
+# Source: surrealdb/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testrelease-surrealdb
+  labels:
+    helm.sh/chart: surrealdb-0.3.5
+    app.kubernetes.io/name: surrealdb
+    app.kubernetes.io/instance: testrelease
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: surrealdb
+      app.kubernetes.io/instance: testrelease
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: surrealdb
+        app.kubernetes.io/instance: testrelease
+    spec:
+      serviceAccountName: testrelease-surrealdb
+      securityContext:
+        {}
+      containers:
+        - name: surrealdb
+          securityContext:
+            {}
+          image: "surrealdb/surrealdb:1.0.0"
+          imagePullPolicy: IfNotPresent
+          args:
+            - start
+          env:
+            - name: SURREAL_NO_BANNER
+              value: "true"
+            - name: SURREAL_PATH
+              value: memory
+            - name: SURREAL_LOG
+              value: info
+            - name: SURREAL_BIND
+              value: 0.0.0.0:8000
+            - name: SURREAL_AUTH
+              value: "false"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "true"
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+          resources:
+            {}
diff --git a/tests/testdata/snapshots/deployment.yaml/disable auth using surrealdb.unauhenticated b/tests/testdata/snapshots/deployment.yaml/disable auth using surrealdb.unauhenticated
@@ -0,0 +1,62 @@
+---
+# Source: surrealdb/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testrelease-surrealdb
+  labels:
+    helm.sh/chart: surrealdb-0.3.5
+    app.kubernetes.io/name: surrealdb
+    app.kubernetes.io/instance: testrelease
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: surrealdb
+      app.kubernetes.io/instance: testrelease
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: surrealdb
+        app.kubernetes.io/instance: testrelease
+    spec:
+      serviceAccountName: testrelease-surrealdb
+      securityContext:
+        {}
+      containers:
+        - name: surrealdb
+          securityContext:
+            {}
+          image: "surrealdb/surrealdb:1.0.0"
+          imagePullPolicy: IfNotPresent
+          args:
+            - start
+          env:
+            - name: SURREAL_NO_BANNER
+              value: "true"
+            - name: SURREAL_PATH
+              value: memory
+            - name: SURREAL_LOG
+              value: info
+            - name: SURREAL_BIND
+              value: 0.0.0.0:8000
+            - name: SURREAL_AUTH
+              value: "false"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "true"
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+          resources:
+            {}
diff --git a/...s/deployment.yaml/release deployed using pre v0.3.5 chart with the default surrealdb.auth b/...s/deployment.yaml/release deployed using pre v0.3.5 chart with the default surrealdb.auth
@@ -0,0 +1,62 @@
+---
+# Source: surrealdb/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testrelease-surrealdb
+  labels:
+    helm.sh/chart: surrealdb-0.3.5
+    app.kubernetes.io/name: surrealdb
+    app.kubernetes.io/instance: testrelease
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: surrealdb
+      app.kubernetes.io/instance: testrelease
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: surrealdb
+        app.kubernetes.io/instance: testrelease
+    spec:
+      serviceAccountName: testrelease-surrealdb
+      securityContext:
+        {}
+      containers:
+        - name: surrealdb
+          securityContext:
+            {}
+          image: "surrealdb/surrealdb:1.0.0"
+          imagePullPolicy: IfNotPresent
+          args:
+            - start
+          env:
+            - name: SURREAL_NO_BANNER
+              value: "true"
+            - name: SURREAL_PATH
+              value: memory
+            - name: SURREAL_LOG
+              value: info
+            - name: SURREAL_BIND
+              value: 0.0.0.0:8000
+            - name: SURREAL_AUTH
+              value: "true"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "false"
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+          resources:
+            {}
diff --git a/tests/testdata/snapshots/deployment.yaml/surrealdb.unauthenticated=false has no effect b/tests/testdata/snapshots/deployment.yaml/surrealdb.unauthenticated=false has no effect
@@ -0,0 +1,62 @@
+---
+# Source: surrealdb/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testrelease-surrealdb
+  labels:
+    helm.sh/chart: surrealdb-0.3.5
+    app.kubernetes.io/name: surrealdb
+    app.kubernetes.io/instance: testrelease
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: surrealdb
+      app.kubernetes.io/instance: testrelease
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: surrealdb
+        app.kubernetes.io/instance: testrelease
+    spec:
+      serviceAccountName: testrelease-surrealdb
+      securityContext:
+        {}
+      containers:
+        - name: surrealdb
+          securityContext:
+            {}
+          image: "surrealdb/surrealdb:1.0.0"
+          imagePullPolicy: IfNotPresent
+          args:
+            - start
+          env:
+            - name: SURREAL_NO_BANNER
+              value: "true"
+            - name: SURREAL_PATH
+              value: memory
+            - name: SURREAL_LOG
+              value: info
+            - name: SURREAL_BIND
+              value: 0.0.0.0:8000
+            - name: SURREAL_AUTH
+              value: "true"
+            - name: SURREAL_UNAUTHENTICATED
+              value: "false"
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+          resources:
+            {}