0.9.0 Chart Feedback

[james-d-elliott]

This is where users should discuss the chart feedback for the upcoming 0.9.0 release.

[mwinters-stuff]

I have had a try at using the 0.9.0 chart, and have come across a couple of problems.

Errors installing the cart, which are created by the naming of the attributes,
deployment.yaml, lines 48, 51, 54

Error: INSTALLATION FAILED: 1 error occurred:
        * Deployment.apps "aaa-authelia" is invalid: [spec.template.annotations: Invalid value: "authelia.com/checksum/config": a qualified name must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName'), spec.template.annotations: Invalid value: "authelia.com/checksum/secret": a qualified name must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')]

for example

authelia.com/checksum/config: {{ include (print $.Template.BasePath "/configMap.yaml") . | sha256sum }}

Creates an error - that authelia.com/checksum/config doesnt match the regex for naming
changing the last / to a - resolves the error

A second issue, is that it seems that authelia can not load the configuration.yaml, from the configmap. I didnt have time to look a tthat last night

[autarchprinceps]

Not that there isn't a value to change this, but I'd think one would want to keep the default config as close to working as possible without input, so:
Configuration: access_control: 'default_policy' option 'deny' is invalid: when no rules are specified it must be 'two_factor' or 'one_factor'

[autarchprinceps]

Hmm, setting configMap.access_control.default_policy to two_factor doesn't seem to fix this. I'm starting from a working, fairly basic config in 0.8.58 to 0.9, to then try to switch to OIDC instead, but for now I'm really just using a yaml file with users in it, with nothing fancy around it.

[autarchprinceps]

Ok, I got it to work. One needs to also set configMap.access_control.secret.enabled: true. I think this is at the very least non-intuitive and/or should default to true, if there is already a handling of the default policy with or without rules

[james-d-elliott]

Ah, it's because it was included in the wrong if/else block, fixed locally. Thanks!

[autarchprinceps]

The dependencies of mariadb, postgres & redis are all missing the configMap segment in the conditions of the Chart.yaml compared to the place those settings are in the values.yaml.

[james-d-elliott]

What do you mean by configMap segment?

[SIMULATAN]

Hi, setting ingress.traefikCRD.sticky=true causes the installation to fail.
The reason is that the field of the IngressRoute is indented to be interpreted as a services list entry rather than a property of the created service.
See ingressRoute.yaml and the traefik IngressRoute reference

Shall I create a PR targeting the master or v0.9.0-beta3 branch? It seems to be a problem on both branches.

[james-d-elliott]

Make one targeting master and bump the version appropriately to beta3. Thanks for this, must have mangled the indentation in reworking some of these elements.