|
| 1 | +{{- /* |
| 2 | + Environment variables consumed by the Integrations Hub backend |
| 3 | + (Python/FastAPI on the `development` branch of OpenHands/integrations-hub). |
| 4 | + |
| 5 | + The backend reads its config in backend/app/config.py using the prefix |
| 6 | + `INTHUB_*`, with legacy unprefixed fallbacks for backwards compatibility: |
| 7 | + |
| 8 | + INTHUB_POSTGRES_URL fallback: POSTGRES_URL, DATABASE_URL |
| 9 | + INTHUB_DISABLE_AUTH (bool, defaults to false) |
| 10 | + INTHUB_OPENHANDS_BASE_URL fallback: OPENHANDS_BASE_URL |
| 11 | + INTHUB_OPENHANDS_AUTH_COOKIE_NAME fallback: OPENHANDS_AUTH_COOKIE_NAME |
| 12 | + INTHUB_INTERNAL_AUTH_SECRET fallback: INTERNAL_AUTH_SECRET, AUTH_SECRET, NEXTAUTH_SECRET |
| 13 | + INTHUB_CRON_SECRET fallback: CRON_SECRET |
| 14 | + APP_ADMIN_EMAILS (use the unprefixed name; the prefixed |
| 15 | + form is JSON-decoded by the SDK env |
| 16 | + parser and would require list syntax) |
| 17 | + INTHUB_CREDENTIAL_ENCRYPTION_KEY fallback: CREDENTIAL_ENCRYPTION_KEY |
| 18 | + INTHUB_STATIC_DIR set in the Dockerfile to /app/out |
| 19 | + INTHUB_ROOT_PATH sub-path mount; defaulted by the |
| 20 | + Dockerfile to /integrations-hub and |
| 21 | + overridable via .Values.rootPath |
| 22 | + |
| 23 | + In addition, backend/app/oauth_flow.py reads: |
| 24 | + AUTH_REDIRECT_PROXY_URL stable origin for OAuth callback proxy |
| 25 | + AUTH_URL / NEXTAUTH_URL preview-deployment callback target |
| 26 | +*/}} |
| 27 | +{{- define "integrations-hub.env.defaults" }} |
| 28 | +# Database connection -- backend reads INTHUB_POSTGRES_URL first; we build |
| 29 | +# it from the configured host/port/user/db plus the password secret using |
| 30 | +# Kubernetes $(VAR_NAME) expansion. If .Values.database.url is set it wins. |
| 31 | +{{- if .Values.database.url }} |
| 32 | +- name: INTHUB_POSTGRES_URL |
| 33 | + value: {{ .Values.database.url | quote }} |
| 34 | +{{- else }} |
| 35 | +- name: INTHUB_DB_HOST |
| 36 | + value: {{ .Values.database.host | quote }} |
| 37 | +- name: INTHUB_DB_PORT |
| 38 | + value: {{ .Values.database.port | quote }} |
| 39 | +- name: INTHUB_DB_USER |
| 40 | + value: {{ .Values.database.user | quote }} |
| 41 | +- name: INTHUB_DB_NAME |
| 42 | + value: {{ .Values.database.name | quote }} |
| 43 | +- name: INTHUB_DB_PASS |
| 44 | + valueFrom: |
| 45 | + secretKeyRef: |
| 46 | + name: {{ .Values.database.secretName }} |
| 47 | + key: {{ .Values.database.secretKey }} |
| 48 | +- name: INTHUB_POSTGRES_URL |
| 49 | + value: "postgresql://$(INTHUB_DB_USER):$(INTHUB_DB_PASS)@$(INTHUB_DB_HOST):$(INTHUB_DB_PORT)/$(INTHUB_DB_NAME)" |
| 50 | +{{- end }} |
| 51 | + |
| 52 | +# OpenHands identity provider used to validate session cookies / API keys. |
| 53 | +{{- $openhandsBaseUrl := .Values.openhands.baseUrl }} |
| 54 | +{{- if and (not $openhandsBaseUrl) .Values.global }} |
| 55 | +{{- if .Values.global.ingress }} |
| 56 | +{{- if .Values.global.ingress.host }} |
| 57 | +{{- $host := .Values.global.ingress.host }} |
| 58 | +{{- if and .Values.global.ingress.prefixWithBranch .Values.global.branchSanitized }} |
| 59 | +{{- $host = printf "%s.%s" .Values.global.branchSanitized .Values.global.ingress.host }} |
| 60 | +{{- end }} |
| 61 | +{{- $openhandsBaseUrl = printf "https://%s" $host }} |
| 62 | +{{- end }} |
| 63 | +{{- end }} |
| 64 | +{{- end }} |
| 65 | +{{- if $openhandsBaseUrl }} |
| 66 | +- name: INTHUB_OPENHANDS_BASE_URL |
| 67 | + value: {{ $openhandsBaseUrl | quote }} |
| 68 | +{{- end }} |
| 69 | +{{- if .Values.openhands.authCookieName }} |
| 70 | +- name: INTHUB_OPENHANDS_AUTH_COOKIE_NAME |
| 71 | + value: {{ .Values.openhands.authCookieName | quote }} |
| 72 | +{{- end }} |
| 73 | + |
| 74 | +# Local-dev auth bypass. Defaults to false; the FastAPI app will reject |
| 75 | +# non-loopback requests when this is true, so it should never be enabled |
| 76 | +# in staging/production. |
| 77 | +- name: INTHUB_DISABLE_AUTH |
| 78 | + value: {{ .Values.disableAuth | default false | quote }} |
| 79 | + |
| 80 | +# Sub-path mount for the FastAPI app. The Dockerfile already defaults |
| 81 | +# INTHUB_ROOT_PATH to /integrations-hub so the image works behind the |
| 82 | +# default ingress out of the box; this block re-emits the value so chart |
| 83 | +# overrides flow through. Rendered unconditionally (including when |
| 84 | +# .Values.rootPath is "") so that an empty override actually clears the |
| 85 | +# image default instead of silently inheriting it. |
| 86 | +- name: INTHUB_ROOT_PATH |
| 87 | + value: {{ .Values.rootPath | default "" | quote }} |
| 88 | + |
| 89 | +# Credential encryption key (required: signs/encrypts stored OAuth tokens |
| 90 | +# and other provider secrets at rest). |
| 91 | +- name: INTHUB_CREDENTIAL_ENCRYPTION_KEY |
| 92 | + valueFrom: |
| 93 | + secretKeyRef: |
| 94 | + name: {{ .Values.credentialEncryption.secretName }} |
| 95 | + key: {{ .Values.credentialEncryption.secretKey }} |
| 96 | + |
| 97 | +# Internal service-to-service secret. Optional in SPA-only K8s deployments |
| 98 | +# (the backend validates the OpenHands session cookie directly when no |
| 99 | +# Next.js proxy is in front of it) but required if any internal caller |
| 100 | +# attaches the X-Integrations-Hub-Internal-Secret header. |
| 101 | +{{- if and .Values.auth .Values.auth.internalSecretName }} |
| 102 | +- name: INTHUB_INTERNAL_AUTH_SECRET |
| 103 | + valueFrom: |
| 104 | + secretKeyRef: |
| 105 | + name: {{ .Values.auth.internalSecretName }} |
| 106 | + key: {{ .Values.auth.internalSecretKey | default "internal-auth-secret" }} |
| 107 | +{{- end }} |
| 108 | + |
| 109 | +# Admin allowlist for /api/admin/* routes. Use the unprefixed name -- |
| 110 | +# INTHUB_APP_ADMIN_EMAILS goes through the SDK env parser which expects |
| 111 | +# JSON list syntax. |
| 112 | +{{- if .Values.admin.emails }} |
| 113 | +- name: APP_ADMIN_EMAILS |
| 114 | + value: {{ .Values.admin.emails | quote }} |
| 115 | +{{- end }} |
| 116 | + |
| 117 | +# Cron secret -- required by /api/cron/expire-grants. |
| 118 | +- name: INTHUB_CRON_SECRET |
| 119 | + valueFrom: |
| 120 | + secretKeyRef: |
| 121 | + name: {{ .Values.cron.secretName }} |
| 122 | + key: {{ .Values.cron.secretKey }} |
| 123 | + |
| 124 | +# OAuth preview-deployment proxy (optional). When set, service OAuth |
| 125 | +# callbacks register/exchange against the stable origin and then forward |
| 126 | +# back to the preview deployment captured in OAuth state. |
| 127 | +{{- if .Values.openhands.redirectProxyUrl }} |
| 128 | +- name: AUTH_REDIRECT_PROXY_URL |
| 129 | + value: {{ .Values.openhands.redirectProxyUrl | quote }} |
| 130 | +{{- end }} |
| 131 | +{{- if .Values.openhands.authUrl }} |
| 132 | +- name: AUTH_URL |
| 133 | + value: {{ .Values.openhands.authUrl | quote }} |
| 134 | +{{- end }} |
| 135 | + |
| 136 | +{{- if .Values.datadog.enabled }} |
| 137 | +# Datadog APM |
| 138 | +- name: DD_AGENT_HOST |
| 139 | + value: "datadog-agent.all-hands-system.svc.cluster.local" |
| 140 | +- name: DD_TRACE_AGENT_PORT |
| 141 | + value: "8126" |
| 142 | +- name: DD_SERVICE |
| 143 | + value: {{ .Values.datadog.serviceName | quote }} |
| 144 | +- name: DD_ENV |
| 145 | + value: {{ .Values.datadog.env | quote }} |
| 146 | +- name: DD_TRACE_ENABLED |
| 147 | + value: "true" |
| 148 | +{{- end }} |
| 149 | +{{- end }} |
| 150 | + |
| 151 | +{{/* |
| 152 | + integrations-hub.env — Deduplicated environment variable list. |
| 153 | + |
| 154 | + This wrapper renders the default env vars from "integrations-hub.env.defaults", |
| 155 | + then removes any entries whose name conflicts with a key in .Values.env, |
| 156 | + and finally appends the .Values.env overrides. The result is a clean list |
| 157 | + with no duplicate names, which prevents: |
| 158 | + - Helm warnings about duplicate env vars |
| 159 | + - Strategic Merge Patch conflicts during helm upgrade |
| 160 | + ("The order in patch list doesn't match $setElementOrder list") |
| 161 | + |
| 162 | + How it works: |
| 163 | + 1. Render "integrations-hub.env.defaults" via include (evaluates all conditionals) |
| 164 | + 2. Parse the rendered YAML list into Go objects with fromYamlArray |
| 165 | + 3. Filter out any default entries whose name appears in .Values.env |
| 166 | + 4. Append .Values.env entries (user overrides always win) |
| 167 | + 5. Re-render the deduplicated list with toYaml |
| 168 | +*/}} |
| 169 | +{{- define "integrations-hub.env" }} |
| 170 | +{{- $defaults := include "integrations-hub.env.defaults" . | fromYamlArray }} |
| 171 | +{{- /* Build a lookup dict of override keys for O(1) membership checks */}} |
| 172 | +{{- $overrideKeys := dict }} |
| 173 | +{{- if .Values.env }} |
| 174 | +{{- range $key, $_ := .Values.env }} |
| 175 | +{{- $_ := set $overrideKeys $key true }} |
| 176 | +{{- end }} |
| 177 | +{{- end }} |
| 178 | +{{- /* Keep only default entries that are NOT overridden by .Values.env */}} |
| 179 | +{{- $filtered := list }} |
| 180 | +{{- range $entry := $defaults }} |
| 181 | +{{- if not (hasKey $overrideKeys (get $entry "name")) }} |
| 182 | +{{- $filtered = append $filtered $entry }} |
| 183 | +{{- end }} |
| 184 | +{{- end }} |
| 185 | +{{- /* Append user overrides from .Values.env (these take precedence) */}} |
| 186 | +{{- if .Values.env }} |
| 187 | +{{- range $key, $value := .Values.env }} |
| 188 | +{{- $filtered = append $filtered (dict "name" $key "value" ($value | toString)) }} |
| 189 | +{{- end }} |
| 190 | +{{- end }} |
| 191 | +{{- $filtered | toYaml }} |
| 192 | +{{- end }} |
0 commit comments