fix: repair crash-looping CLI flags, close values.yaml coverage gaps#6
Open
lakhansamani wants to merge 1 commit into
Open
fix: repair crash-looping CLI flags, close values.yaml coverage gaps#6lakhansamani wants to merge 1 commit into
lakhansamani wants to merge 1 commit into
Conversation
--enable-totp-login/--enable-mfa/--enable-email-otp/--enable-sms-otp don't exist in the authorizer binary; cobra rejects unknown flags so every release from this chart crash-loops on boot. Renamed to the current --disable-totp-login/--disable-webauthn-mfa/--disable-email-otp/ --disable-sms-otp/--disable-mfa flags. Fixed COUCHBASE_RAM_QUOTA: the env var was defined as COUCHBASE_BUCKET_RAM_QUOTA while args read $COUCHBASE_RAM_QUOTA, so couchbase_bucket_ram_quota silently never reached the flag. Wired --url (CWE-640 host-header-injection mitigation): AUTHORIZER_URL was set as an env var but never passed as a flag, so authorizer_url in values.yaml was a no-op. Added --oauth2-1-strict and --enable-org-discovery. Exposed ~25 toggles in values.yaml that were previously hardcoded into the args template with no values.yaml key at all (enable_signup, enforce_mfa, app_cookie_secure, enable_basic_authentication, disable_admin_header_auth, and friends) — operators had no way to override them. Re-pinned appVersion to 2.4.0-rc.7: 2.3.0 predates the flag rename above, so it doesn't have the --disable-* flags either. Move to the stable 2.4.0 tag once it ships.
✅ Deploy Preview for authorizer-helm-chart ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--enable-totp-login/--enable-mfa/--enable-email-otp/--enable-sms-otpdon't exist in the authorizer binary; cobra rejects unknown flags and exits 1, so every release from this chart currently crash-loops on boot. Renamed to the current--disable-totp-login/--disable-webauthn-mfa/--disable-email-otp/--disable-sms-otp/--disable-mfaflags.COUCHBASE_RAM_QUOTA: the env var was defined asCOUCHBASE_BUCKET_RAM_QUOTAwhile the args template read$COUCHBASE_RAM_QUOTA, soauthorizer.couchbase_bucket_ram_quotain values.yaml silently never reached the flag.--url(CWE-640 host-header-injection mitigation):AUTHORIZER_URLwas set as a pod env var but never passed as a CLI flag, soauthorizer.authorizer_urlin values.yaml was a no-op. Added--oauth2-1-strictand--enable-org-discovery, both previously missing entirely.values.yamlthat were previously hardcoded into the args template with no values.yaml key at all —enable_signup,enforce_mfa,app_cookie_secure,enable_basic_authentication,disable_admin_header_auth, and others. Operators had no way to override them; defaults are unchanged.host,env,log_levelas values.yaml keys (previously only settable by editing the template).appVersionto2.4.0-rc.7and bumped chartversionto2.3.0:2.3.0predates the flag rename above, so it doesn't have the--disable-*flags either. Move to the stable2.4.0tag once it ships.Test plan
helm lint .passeshelm templaterenders valid YAML with all values set; verified all 130 flags fromcmd/root.goappear in the rendered argsquay.io/authorizer/authorizer:2.4.0-rc.7image — container boots and serves/healthz(previously exited 1 on the phantom flags)