Adjustments, Manuel findings #310
Labels
No labels
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: Cordy/Cairn#310
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Im Helm Chart fehlen:
Eventuell sollte eine Default "cairn-config" mit User "admin" und Passwort "admin" im Image schon vorhanden sein, damit man einen einfacheren Einstieg hat, ohne Erstellung einer eigenen config.json.
Die config.json kann auch komplett "automatisiert" werden, wenn die veränderbaren Felder ebenfalls als ENV Variablen gesetzt werden können.
z.B.:
Als Präzedenz würde ich die Environment Variablen höher setzen als die config.json, da man diese direkt am Deployment später ablesen kann (das Secret mit der Config muss vorher dekodiert werden mit B64).
Adjustments, v0.6.63to Adjustments, Manuel findings[10:57, 8/26/2026] Manuel Novak: Habs mal deployed aber die Helm Chart is noch buggy.
[10:58, 8/26/2026] Manuel Novak: Der ARM64 build funktioniert mit dem "make release" von dir und das Image kann man auch easy damit bauen (da zieh ich noch eine Image Bakery hoch für mich).
[10:59, 8/26/2026] Manuel Novak: Ich werd meinen Harbor evtl. public machen mit Credentials, damit man die neuesten Cairn Releases direkt mit Helm in k8s starten kann
[11:03, 8/26/2026] Manuel Novak: Der listen Port ist auch noch falsch konfiguriert.
Er kommt in der config.json und im Helm Chart bei dem SVC vor, was unschön ist.
Eine ENV sollte reichen, z.b. "CAIRN_LISTEN_PORT=7420"
Und diese sollt mer dann mit dem values.yaml steuern können.
[11:03, 8/26/2026] Manuel Novak: Ich bau an dem Helm Chart weiter sobald ich Zeit hab
Verdict per item, checked against the chart as of v0.6.126 / chart 0.3.0 (2026-09-05):
enabled— confirmed missing. The chart only renders aLoadBalancerService (dogfood-shaped, MetalLB). Will add: standardingress.*values block (className, annotations, hosts/paths, tls), default off.enabled— confirmed missing. Will add:httpRoute.*values block (parentRefs, hostnames), default off.nodeSelectorfor tagged nodes — confirmed missing; neither the Cairn deployment nor the (new) converter deployment exposes scheduling knobs. Will add:nodeSelector/tolerations/affinityvalues for both.cairn-configwith admin/admin in the image — superseded since this was filed, proposing to decline as written. A no-config boot in local mode now enters setup mode: a one-time token is printed to the logs and/setupcreates the first admin;storage.driver: "setup"additionally connects storage from the browser wizard. That is the easy start without writing config.json — without shipping default credentials that every scanner and attacker tries first. Baked-in admin/admin in a public image is CVE-feed material.CAIRN_ADMIN_USERNAME/CAIRN_ADMIN_PASSWORDenv — does not exist today; will add, with one refinement:CAIRN_ADMIN_PASSWORD_HASH(PHC argon2id, safe to read off the deployment spec — the exact benefit Manuel names) as the documented path, plus plaintextCAIRN_ADMIN_PASSWORDhashed at boot with a loud not-for-production log warning. Env-over-config precedence as requested — that is already the standing rule for every other CAIRN_* env.Listen port (comment): half-exists.
CAIRN_LISTENenv is already implemented and wins over config (address form,":7420"). What is missing is the chart wiring: today the port lives in config.json and hard-coded in the chart. Will add: onelisten.portvalue that setsCAIRN_LISTENon the pod and drives the containerPort — values.yaml becomes the single source, the config Secret needs nolistenat all.Implementation starting now; results will be posted here.
Shipped — v0.6.127, chart 0.4.0 (PR #425, merged; both dogfoods rolled at 00:12 UTC).
templates/ingress.yaml, gated byingress.enabled(default false):className,annotations,hosts/paths,tls. Routes only to Cairn — never to the converter, which stays internal by design.templates/httproute.yaml, gated byhttpRoute.enabled(default false):parentRefs,hostnames,annotations. Needs the Gateway API CRDs + a Gateway to attach to.nodeSelector/tolerations/affinityvalues for the Cairn pod AND a separate set underconverter.*(the converter being the resource-heavy one, pinning it to tagged nodes is the common case)./setup+ storage wizard, without shipping guessable credentials. Recorded in the CHANGELOG.CAIRN_ADMIN_USERNAME+CAIRN_ADMIN_PASSWORD_HASH(PHC argon2id, generate withcairnd hash-password; safe to read off a deployment spec) upserts the user and grants admin at boot — a deployment carrying these envs never enters the first-run flow. PlaintextCAIRN_ADMIN_PASSWORDalso accepted, hashed at boot with a loud not-for-production log warning. Env wins over config; half-configured env (or plaintext passed into_HASH— prefix-validated) refuses boot with a precise error. Tested: upsert, verify, replace-in-place, no admin-list duplicates, all three refusals.listen.port(default 7420) setsCAIRN_LISTENon the pod and drives the containerPort; probes and Service target the named port so everything follows. values.yaml is the single source; the config Secret needs nolistenat all.Docs: deployment.md Kubernetes section + Secrets section updated. @hyrsh — chart 0.4.0 on main; when you rebase your chart work, these should cover the list. The "noch buggy" remark from 8/26 predates the 0.2.0→0.4.0 rework (converter component, env injection, this batch) — if anything still misbehaves on your cluster, name it here and it gets the same treatment.
Junge die Agents schaffen schon schwer was weg :D
can be closed