Skip to content

Sync kubex charts from automation-controller main @ 71b5a52 #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gasarekubex merged 1 commit into from
May 15, 2026
Merged

Sync kubex charts from automation-controller main @ 71b5a52 #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions charts/kubex-automation-engine/docs/Configuration-Reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ This document maps the current Helm chart values to the resources created by the
| Key | Description |
| --- | --- |
| `kubex.url.host` | Kubex hostname, for example `example.kubex.ai` |
| `kubex.url.scheme` | Scheme used when deriving `DENSIFY_BASE_URL` from `kubex.url.host` |
Copy link
Copy Markdown
Contributor Author

@kubexautomation kubexautomation Bot May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CONTENT OF THIS REVIEW IS AI GENERATED

[Severity: Minor] [Confidence: Medium]

Location: charts/kubex-automation-engine/docs/Configuration-Reference.md:49

Issue: The kubex.url.scheme table row does not document the default value (https) or the allowed values (http | https), unlike the inline comment in kubex-automation-values.yaml which does mention http.

Why it matters: Users consulting only the Configuration Reference will not know what values are valid or what the default is, increasing the chance of misconfiguration.

Suggested fix: Expand the description to include default and valid values, for example:

| `kubex.url.scheme` | Scheme used when deriving `DENSIFY_BASE_URL` from `kubex.url.host`. Allowed values: `http`, `https`. Default: `https`. |

| `kubex.clusterName` | Cluster identifier presented to Kubex |
| `kubexCredentials.username` | Required when `createSecrets=true` |
| `kubexCredentials.epassword` | Required when `createSecrets=true` |
Expand Down Expand Up @@ -88,6 +89,8 @@ stringData:

Keep `kubex.url.host` set in your values file so the release configuration still documents the target Kubex instance, even when the secret is managed outside Helm.

For non-TLS upstream endpoints, set `kubex.url.scheme` to `http`.

Note: `kubexCredentials.userSecretName` is currently not consumed by this chart. When `createSecrets=false`, set `gateway.configSecretName` instead.

## Core Operational Values
Expand Down
1 change: 1 addition & 0 deletions charts/kubex-automation-engine/kubex-automation-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ kubexCredentials:
kubex:
url:
host: <customerName>.kubex.ai # mandatory: <instance>.kubex.ai
scheme: https # set to http for non-TLS local endpoints
# REQUIRED: Your cluster identifier in Kubex
clusterName: "<clusterName>" # mandatory: <clusterName>

Expand Down
2 changes: 1 addition & 1 deletion charts/kubex-automation-engine/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Validate kubexCredentials.epassword is provided if createSecrets is true
{{- define "kubex-automation-engine.kubexEpassword" -}}
{{- if .Values.createSecrets }}
{{- .Values.kubexCredentials.epassword | required "An epassword must be provided in values.yaml under kubexCredentials.epassword" -}}
{{- end }}
{{- end -}}
{{- end }}

{{/*
Expand Down
2 changes: 1 addition & 1 deletion charts/kubex-automation-engine/templates/gateway-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,5 @@ data:
username: {{ .Values.kubexCredentials.username | b64enc | quote }}
epassword: {{ .Values.kubexCredentials.epassword | b64enc | quote }}
url: {{ .Values.kubex.url.host | b64enc | quote }}
DENSIFY_BASE_URL: {{ printf "https://%s" .Values.kubex.url.host | b64enc | quote }}
DENSIFY_BASE_URL: {{ printf "%s://%s" .Values.kubex.url.scheme .Values.kubex.url.host | b64enc | quote }}
{{- end }}
Copy link
Copy Markdown
Contributor Author

@kubexautomation kubexautomation Bot May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CONTENT OF THIS REVIEW IS AI GENERATED

[Severity: Major] [Confidence: High]

Location: charts/kubex-automation-engine/templates/gateway-secret.yaml:19

Issue: kubex.url.scheme is used directly in printf without a nil/empty guard, so if an existing values override omits this key the rendered URL will be "://<host>".

Why it matters: The values.yaml default provides scheme: "https" for fresh installs, but any user whose override file predates this PR will not have scheme set. Helm deep-merges values files; a key absent from an override is inherited from values.yaml, so most users are protected. However, if a user explicitly sets kubex.url: {host: "..."} as a map in their override (omitting scheme entirely at the map level), the default can be clobbered in some Helm versions. A default "https" call makes the template self-defending regardless:

DENSIFY_BASE_URL: {{ printf "%s://%s" (default "https" .Values.kubex.url.scheme) .Values.kubex.url.host | b64enc | quote }}

Suggested fix: Add a default "https" fallback in the template expression as shown above.

22 changes: 8 additions & 14 deletions charts/kubex-automation-engine/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@
"properties": {
"host": {
"type": "string"
},
"scheme": {
"type": "string",
"enum": ["http", "https"]
}
}
},
Copy link
Copy Markdown
Contributor Author

@kubexautomation kubexautomation Bot May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CONTENT OF THIS REVIEW IS AI GENERATED

[Severity: Minor] [Confidence: High]

Location: charts/kubex-automation-engine/values.schema.json:333 (the url object's required list inside the if/then block)

Issue: The if/then conditional validation block (triggered when createSecrets=true) requires kubex.url.host but does not require kubex.url.scheme. This means schema validation will pass even when scheme is absent, which in turn allows the broken-URL scenario in the template to go undetected at helm install / helm upgrade validation time.

Why it matters: Schema validation is the first line of defence. If scheme must be present when the secret is created, adding it to the required list here (or relying on the default fix above) closes the gap. Given the template-level default fix is the stronger protection, this is a minor layered-defence gap rather than a blocker.

Suggested fix: Either (a) add "scheme" to the required array inside the url object in the then block, or (b) rely on the default "https" in the template and document that scheme is optional with a documented default — which is the current intent. If the latter, a JSON Schema default annotation on the scheme property would make the default machine-readable:

"scheme": {
  "type": "string",
  "enum": ["http", "https"],
  "default": "https"
}

Expand Down Expand Up @@ -158,10 +162,7 @@
"type": "boolean"
},
"fsGroup": {
"type": [
"integer",
"null"
]
"type": ["integer", "null"]
},
"fsGroupChangePolicy": {
"type": "string"
Expand Down Expand Up @@ -320,20 +321,13 @@
}
},
"then": {
"required": [
"kubex",
"kubexCredentials"
],
"required": ["kubex", "kubexCredentials"],
"properties": {
"kubex": {
"required": [
"url"
],
"required": ["url"],
"properties": {
"url": {
"required": [
"host"
],
"required": ["host"],
"properties": {
"host": {
"minLength": 1
Expand Down
3 changes: 2 additions & 1 deletion charts/kubex-automation-engine/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ kubex:
url:
# -- Kubex instance hostname (e.g., <customerName>.kubex.ai)
host: ""

# -- URL scheme used when deriving DENSIFY_BASE_URL from host
scheme: "https"
# -- Cluster name to identify this cluster in Kubex (required)
clusterName: ""

Expand Down