fix(platform): DSPX-2933 align KAS root key env var with Viper config path#191
fix(platform): DSPX-2933 align KAS root key env var with Viper config path#191jp-ayyappan wants to merge 3 commits intomainfrom
Conversation
… path Update the deployment template to use DSP_SERVICES_KAS_ROOT_KEY instead of DSP_KAS_ROOT_KEY. The Viper config path is services.kas.root_key, so the correct environment variable override is DSP_SERVICES_KAS_ROOT_KEY. Also update the corresponding unit test assertion. Co-authored-by: CoopAgent <coopagent@users.noreply.github.com>
…nv var Co-authored-by: CoopAgent <coopagent@users.noreply.github.com>
📝 WalkthroughWalkthroughThe PR renames the KAS root key environment variable from ChangesKAS root key env rename
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request renames the KAS root key environment variable from _KAS_ROOT_KEY to _SERVICES_KAS_ROOT_KEY in the Helm chart deployment template and updates the corresponding test case to reflect this change. I have no feedback to provide.
Related PRThis chart fix is a companion to virtru-corp/data-security-platform#2826, which updated the admin guide documentation to reference The bug affects both upstream OpenTDF and DSP — the Viper config path |
…ecret
Update the root_key_secret comment to reference the correct injected env
var name {PREFIX}_SERVICES_KAS_ROOT_KEY and regenerate README via helm-docs.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/platform/values.yaml`:
- Line 482: The README table breaks because the comment line containing "openssl
rand 32 -hex | kubectl create secret generic kas-root-key
--from-file=root_key=/dev/stdin" includes an unescaped pipe; edit the comment in
charts/platform/values.yaml and escape the pipe by replacing "|" with "\|" so
helm-docs emits a literal pipe in the generated Markdown (preserving the rest of
the line exactly) to prevent the table column split.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: efea1f80-2cd5-4fbb-84a9-ff9146cf323b
📒 Files selected for processing (2)
charts/platform/README.mdcharts/platform/values.yaml
| alg: rsa:2048 | ||
| # -- Key needed when key_management feature is enabled (openssl rand 32 -hex) | ||
| # -- Key needed when key_management feature is enabled. Injected as `{PREFIX}_SERVICES_KAS_ROOT_KEY` env var (openssl rand 32 -hex) | ||
| # openssl rand 32 -hex | kubectl create secret generic kas-root-key --from-file=root_key=/dev/stdin |
There was a problem hiding this comment.
Unescaped | in the helm-docs continuation line breaks the generated README table.
helm-docs appends plain # lines to the preceding # -- description, so the shell pipe in openssl rand 32 -hex | kubectl ... lands verbatim inside the Markdown table cell and creates a spurious extra column (confirmed by markdownlint MD056 at README line 217 — the data after the | is silently truncated).
Escape the pipe so it renders as a literal character:
🐛 Proposed fix
-# openssl rand 32 -hex | kubectl create secret generic kas-root-key --from-file=root_key=/dev/stdin
+# openssl rand 32 -hex \| kubectl create secret generic kas-root-key --from-file=root_key=/dev/stdin📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # openssl rand 32 -hex | kubectl create secret generic kas-root-key --from-file=root_key=/dev/stdin | |
| # openssl rand 32 -hex \| kubectl create secret generic kas-root-key --from-file=root_key=/dev/stdin |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@charts/platform/values.yaml` at line 482, The README table breaks because the
comment line containing "openssl rand 32 -hex | kubectl create secret generic
kas-root-key --from-file=root_key=/dev/stdin" includes an unescaped pipe; edit
the comment in charts/platform/values.yaml and escape the pipe by replacing "|"
with "\|" so helm-docs emits a literal pipe in the generated Markdown
(preserving the rest of the line exactly) to prevent the table column split.
1 participant
Summary
The Helm deployment template currently injects the KAS root key secret as the environment variable
{PREFIX}_KAS_ROOT_KEY(e.g.DSP_KAS_ROOT_KEY). However, Viper maps the YAML config pathservices.kas.root_keyto the env var{PREFIX}_SERVICES_KAS_ROOT_KEY— theSERVICES_KAS_segment was missing.This PR updates:
charts/platform/templates/deployment.yaml— changes_KAS_ROOT_KEY→_SERVICES_KAS_ROOT_KEYtests/chart_platform_template_test.go— updates the unit test assertion fromOPENTDF_KAS_ROOT_KEY→OPENTDF_SERVICES_KAS_ROOT_KEYThis aligns the chart with the documentation updated in virtru-corp/data-security-platform#2826, which documents
DSP_SERVICES_KAS_ROOT_KEYas the correct env var.Deployments that rely on the chart's auto-injected
root_key_secretenv var will see the variable name change from{PREFIX}_KAS_ROOT_KEYto{PREFIX}_SERVICES_KAS_ROOT_KEY. ExistingextraEnvoverrides that already setDSP_SERVICES_KAS_ROOT_KEYare unaffected. Deployments using the old chart-injected variable should verify their KAS pods pick up the root key correctly after upgrading.Test plan
Test_KeyManagement_Enabled_With_RootKeySecret_Expect_EnvVar_Setpasses with the updated assertionSummary by CodeRabbit