Unable to mount secretVolume and configMapVolumes simultaneously about helm-charts

[tsigle]

@ilhaan, Thank you for the excellent posting of the issue.

Indeed, I've confirmed that this is a bug. I'll get a fix and new release out in the next few hours.

Thanks!

tls

[tsigle]

The issue will be resolved by having the workload only issue one volumes: in the yaml, as volumes contains an array, rather than a map. This caused only the last volumes: to be used which caused the issue observed.

Fix is being tested now, and a release should show up shortly.

[tsigle]

@ilhaan , Thanks for the comment back.

Yes, I did miss the volumeMounts fix. Will get that fixed and push out a new release in next couple of hours.

Thanks again,

tls

[tsigle]

Fix for both volumes: and volumeMounts: have been released in version 0.5.5

[ilhaan]

Adding helm template outputs to show the above described behavior. I used the ping-devops-0.5.3 tagged release of the repo for these.

• Custom values.yaml with both secretVolumes and configMapVolumes defined for pingfederate-admin:

➜  ping-devops git:(29821d0) ✗ cat values-both.yaml                                                                                              
pingfederate-admin:
  enabled: true

  secretVolumes:
    pingfederate-license:
      items:
        license: /opt/in/instance/server/default/conf/pingfederate.lic

  configMapVolumes:
    pingfederate-props:
      items:
        pf-props: /opt/in/etc/pingfederate.properties 

➜  ping-devops git:(29821d0) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-both.yaml | yq '.spec.template.spec.volumes'
[
  {
    "configMap": {
      "items": [
        {
          "key": "pf-props",
          "path": "pingfederate.properties"
        }
      ],
      "name": "pingfederate-props"
    },
    "name": "pingfederate-props"
  }
]

• Similar values file with only configMapVolumes defined:

➜  ping-devops git:(29821d0) ✗ cat values-cm.yaml                                                                                                  
pingfederate-admin:
  enabled: true

  configMapVolumes:
    pingfederate-props:
      items:
        pf-props: /opt/in/etc/pingfederate.properties 

➜  ping-devops git:(29821d0) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-cm.yaml | yq '.spec.template.spec.volumes'
[
  {
    "configMap": {
      "items": [
        {
          "key": "pf-props",
          "path": "pingfederate.properties"
        }
      ],
      "name": "pingfederate-props"
    },
    "name": "pingfederate-props"
  }
]

• Values file with only secretVolumes defined:

➜  ping-devops git:(29821d0) ✗ cat values-sec.yaml                                                                                               
pingfederate-admin:
  enabled: true

  secretVolumes:
    pingfederate-license:
      items:
        license: /opt/in/instance/server/default/conf/pingfederate.lic

➜  ping-devops git:(29821d0) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-sec.yaml | yq '.spec.template.spec.volumes'
[
  {
    "name": "pingfederate-license",
    "secret": {
      "items": [
        {
          "key": "license",
          "path": "pingfederate.lic"
        }
      ],
      "secretName": "pingfederate-license"
    }
  }
]

• As mentioned in my previous post, I tested the same reversing the order of configMapVolumes and secretVolumes in values.yaml. Output shown below:

➜  ping-devops git:(29821d0) ✗ cat values-reverse.yaml 
pingfederate-admin:
  enabled: true

  configMapVolumes:
    pingfederate-props:
      items:
        pf-props: /opt/in/etc/pingfederate.properties 

  secretVolumes:
    pingfederate-license:
      items:
        license: /opt/in/instance/server/default/conf/pingfederate.lic

➜  ping-devops git:(29821d0) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-reverse.yaml | yq '.spec.template.spec.volumes' 
[
  {
    "configMap": {
      "items": [
        {
          "key": "pf-props",
          "path": "pingfederate.properties"
        }
      ],
      "name": "pingfederate-props"
    },
    "name": "pingfederate-props"
  }
]

Seems to me that there is an issue here:

helm-charts/charts/ping-devops/templates/pinglib/_workload.tpl

Lines 291 to 312 in 29821d0

	{{- define "pinglib.workload.volumes" -}}
	{{ $v := . }}
	{{ range tuple "secretVolumes" "configMapVolumes" }}
	{{ $volType := . }}
	{{- range $volName, $volVal := (index $v .) }}
	volumes:
	- name: {{ $volName }}
	{{- if eq $volType "secretVolumes" }}
	secret:
	secretName: {{ $volName }}
	{{- else if eq $volType "configMapVolumes" }}
	configMap:
	name: {{ $volName }}
	{{- end }}
	items:
	{{- range $keyName, $keyVal := $volVal.items }}
	- key: {{ $keyName }}
	path: {{ base $keyVal }}
	{{- end }}
	{{- end }}
	{{- end }}
	{{- end -}}

[ilhaan]

@tsigle Thanks for the quick update! Your fix seems to have fixed volumes, but I'm seeing the same issue with volumeMount:

• volumes:

➜  ping-devops git:(3cfbc7d) ✗ cat values-both.yaml 
pingfederate-admin:
  enabled: true

  secretVolumes:
    pingfederate-license:
      items:
        license: /opt/in/instance/server/default/conf/pingfederate.lic

  configMapVolumes:
    pingfederate-props:
      items:
        pf-props: /opt/in/etc/pingfederate.properties 

➜  ping-devops git:(3cfbc7d) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-both.yaml | yq '.spec.template.spec.volumes'             
[
  {
    "name": "pingfederate-license",
    "secret": {
      "items": [
        {
          "key": "license",
          "path": "pingfederate.lic"
        }
      ],
      "secretName": "pingfederate-license"
    }
  },
  {
    "configMap": {
      "items": [
        {
          "key": "pf-props",
          "path": "pingfederate.properties"
        }
      ],
      "name": "pingfederate-props"
    },
    "name": "pingfederate-props"
  }
]

• But only one volumeMount:

➜  ping-devops git:(3cfbc7d) ✗ helm template -s templates/pingfederate-admin/workload.yaml . -f values-both.yaml | yq '.spec.template.spec.containers[].volumeMounts'
[
  {
    "mountPath": "/opt/in/etc/pingfederate.properties",
    "name": "pingfederate-props",
    "readOnly": true,
    "subPath": "pingfederate.properties"
  }
]