Optional toggle to use k8s-wireguard-mgr for keygen hook #51
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What
When running through a system such as argo, which doesn't correctly handle the helm hook directives and always runs the install phase hook, more graceful handling of the case of the secret already existing is needed. This is also beneficial for cases where the release has been uninstalled and one wants to re-use the existing key on a new install.
This introduces a new boolean toggle to opt into using the k8s-wireguard-mgr image found here:
https://github.com/bryopsida/k8s-wireguard-mgr
This image generates the server key, if an error is returned from the kubernetes API it inspects the reason, if the reason is already exists, it exits with status code 0. The reason it always attempts to create the secret is to avoid giving the hook/job serviceaccount access to read secrets.
The toggle is enabled with the value
keygenJob.useWireguardManager, the image used can be customized withRelates to: #46