Option to create a secret when using the Google connector.

[vanneback]

When using the Google connector you have to set the serviceAccountFilePath in the config. When installing inside the cluster this will have to exists in a secret that we can mount. It would be great if there is an option in the helm chart for this instead of having to create it before using the helm chart.

Does this seem like a reasonable request? If so I could probably send in a PR for it.

[sagikazarmark]

Honestly, it feels like something that the user should do before installing the chart. You can have multiple google connectors configured in a single Dex instance, so there is no clean and generic way to do it in the chart (at least one that I see).

[TheRealNoob]

The primary reason I see for including the secret in the helm chart and not shipped separately is to be able to SOPS encrypt it. IE helm install -f values.yaml -f secrets://values.sops.yaml

@sagikazarmark What about an extraSecrets: [] approach? Alternatively you could do extraManifests: [] which is more generic and thus flexible, but requires users to handle the base64 encoding themselves, unless you pipe it through tpl and they define {{ base64enc ... }}.

Example extraSecrets and extraManifests implementations.

extraSecrets:
  - name: dex-google-serviceAccount-credentials
    type: Opaque
    data:
      project1.json: |
        SuperSecetJSONCredentials
      project2.json: |
        MoreSuperSecetJSONCredentials
  - name: dex-google-serviceAccount-credentials-differentSecret
    type: Opaque
    data:
      project3.json: |
        differentSuperSecetJSONCredentials

volumes:
  - name: google-serviceAccount-credentials
    secret:
      secretName: dex-google-serviceAccount-credentials
  - name: google-serviceAccount-credentials-differentSecret
    secret:
      secretName: dex-google-serviceAccount-credentials-differentSecret

volumeMounts:
  - name: google-serviceAccount-credentials
    readOnly: true
    mountPath: /tmp/google-serviceAccount-credentials
  - name: google-serviceAccount-credentials-differentSecret
    readOnly: true
    mountPath: /tmp/google-serviceAccount-credentials-differentCredentials

config:
  connectors:
    - type: google
      config:
        serviceAccountFilePath: /tmp/google-serviceAccount-credentials/project1.json
    - type: google
      config:
        serviceAccountFilePath: /tmp/google-serviceAccount-credentials/project2.json
    - type: google
      config:
        serviceAccountFilePath: /tmp/google-serviceAccount-credentials-differentSecret/project3.json