[WIP][1.1.0][BREAKING] Security Patches and General Improvements

[Haloghen]

• Bumped Chart version to 1.0.13 (since we both forgot it :P)
• Moved account data from ConfigMap to Secret, supporting an existing secret to provide username, password and token
• Moved server password from ConfigMap to Secret, supporting an existing secret to provide game_password
• Moved rcon password from ConfigMap to Secret, supporting an existing secret to provide rcon.password
• Moved account data from server_settings. to account. in values.yaml
• Moved server password from server_settings. to serverPassword. in values.yaml
• Added account.accountSecret field to values.yaml
• Added rcon.passwordSecret field to values.yaml
• Added serverPassword.passwordSecret field to values.yaml
• Set spec.template.spec.hostNetwork to false if the Service is different from a NodePort due to security best practices
• Added a check for annotations inside values.yaml to avoid creating an empty metadata.annotations inside the Factorio Service
• Removed rconpw from the ConfigMap and moved it to a dedicated Secret
• Removed account data and game password from server-settings.json, adding them to said JSON via the InitContainer
• Updated mod-downloader-configmap.yaml to fetch account data from Secrets

[SQLJames]

This looks good. Appreciate the changes :D

[SQLJames]

There are a few issues that came up during the linting and test.

[Haloghen]

Yeah I know, fixing one thing at a time, unfortunately CT won't tell you evrything that's wrong at the same time, but it stops at the first error it notices.

[Haloghen]

@SQLJames this issue is going to need a bit more reasearch, I'll keep going tomorrow. If you have any idea why it won't boot with default values, please feel free to share it.

The first error reported in the logs is here.

[Haloghen]

@SQLJames I can happily announce I finally fixed the testing error, it was due to a non-functional test pod. I changed it to test RCON functionality, which proves that the server itself is working too. Push incoming with various fixes

[Haloghen]

I must also add that this release is breaking for existing installations, should we ignore that and just release it as a major release or should we continue to support old installation by including the values I removed as 'deprecated' and to be definitively removed? Keep in mind that I had to move the account infos out of server_settings to avoid including them into the ConfigMap, since they're private information and should be stored only in a Secret

[Haloghen]

@SQLJames it is fully working now, let me know what you think about this and I will adjust the code accordingly. My suggestion is to release it as a new major release (e.g. version 1.1.0) since usually who uses FluxCD, ArgoCD or other CD solutions for helm (like me) doesn't use "latest" as chart version and will update manually once this release goes public.

[SQLJames]

@SQLJames it is fully working now, let me know what you think about this and I will adjust the code accordingly. My suggestion is to release it as a new major release (e.g. version 1.1.0) since usually who uses FluxCD, ArgoCD or other CD solutions for helm (like me) doesn't use "latest" as chart version and will update manually once this release goes public.

This is a valid point, I do think having the version being bumped from a patch to a new minor release would make sense with the breaking changes. I didn't think about that.
Would you mind updating the readme to reflect the changes to the chart, specifically the quick start and the mods section also?

[Haloghen]

Error on my side, deleted the wrong branch so the PR closed, I apoligize.

This is a valid point, I do think having the version being bumped from a patch to a new minor release would make sense with the breaking changes. I didn't think about that. Would you mind updating the readme to reflect the changes to the chart, specifically the quick start and the mods section also?

Working on it now. Since this has become a fully-fledged minor release, I'm going to add a couple more things that I think would improve this repository readability.

[Haloghen]

I thinks it is ready for merging now, before merging I want to write a proper changelog of what changed and then I will request approval again.

[Haloghen]

Changelog

Breaking Changes

• Moved account data from server_settings. to account. in values.yaml
• Moved server password from server_settings. to serverPassword. in values.yaml

Non-Breaking Changes

• Added account.accountSecret field to values.yaml
• Added rcon.passwordSecret field to values.yaml
• Added serverPassword.passwordSecret field to values.yaml
• Changed default rcon.password to CHANGEMECHANGEME, which should be changed anyway
• Changed default map_gen_settings.autoplace_controls from the standard values to {}, since by default map
  generation follows standard parameters if not overriden
• Changed default admin_list, white_list and ban_list to [] instead of nil

Technical Changes

• Fixed workflow not working in main branch
• Created test values for chart-tester install action
• Fixed non-working test pod, replaced wget with rcon, testing server rcon responsiveness, which in turn demonstrates server functionality
• Moved account data from ConfigMap to Secret, supporting an existing secret to provide username, password and token
• Moved server password from ConfigMap to Secret, supporting an existing secret to provide game_password
• Moved rcon password from ConfigMap to Secret, supporting an existing secret to provide rcon.password
• Set spec.template.spec.hostNetwork to false if the Service is different from a NodePort due to security best practices
• Added a check for annotations inside values.yaml to avoid creating an empty metadata.annotations inside the Factorio Service
• Removed rconpw from the ConfigMap and moved it to a dedicated Secret
• Removed account data and game password from server-settings.json, adding them to said JSON via the InitContainer
• Updated mod-downloader-configmap.yaml to fetch account data from Secrets
• Changed services' internal port to be fixed, and external port binding editable to have a consistent setup

[SQLJames]

Sorry for the delay in getting back to this, Busy week at work with some deployments. I appreciate the work you contributed back to the project. This goes a long way in securing the chart and making it more robust :)