Adjustments, Manuel findings #310

Closed
opened 2026-08-25 07:46:31 +00:00 by hyrsh · 5 comments
Collaborator

Im Helm Chart fehlen:

  • HTTPRoute (für GatewayAPI), sollte mit "enabled: true/false" wählbar sein
  • Ingress Objekt (für Ingress Controller), sollte mit "enabled: true/false" wählbar sein
  • NodeSelector (für Deployment auf tagged Nodes)

Eventuell sollte eine Default "cairn-config" mit User "admin" und Passwort "admin" im Image schon vorhanden sein, damit man einen einfacheren Einstieg hat, ohne Erstellung einer eigenen config.json.

Die config.json kann auch komplett "automatisiert" werden, wenn die veränderbaren Felder ebenfalls als ENV Variablen gesetzt werden können.

z.B.:

  • CAIRN_ADMIN_USERNAME="admin" (gleicher Inhalt ==> config.json/auth/users/username)
  • CAIRN_ADMIN_PASSWORD="admin" (gleicher Inhalt ==> config.json/auth/users/passwordHash)

Als Präzedenz würde ich die Environment Variablen höher setzen als die config.json, da man diese direkt am Deployment später ablesen kann (das Secret mit der Config muss vorher dekodiert werden mit B64).

Im Helm Chart fehlen: - HTTPRoute (für GatewayAPI), sollte mit "enabled: true/false" wählbar sein - Ingress Objekt (für Ingress Controller), sollte mit "enabled: true/false" wählbar sein - NodeSelector (für Deployment auf tagged Nodes) Eventuell sollte eine Default "cairn-config" mit User "admin" und Passwort "admin" im Image schon vorhanden sein, damit man einen einfacheren Einstieg hat, ohne Erstellung einer eigenen config.json. Die config.json kann auch komplett "automatisiert" werden, wenn die veränderbaren Felder ebenfalls als ENV Variablen gesetzt werden können. z.B.: - CAIRN_ADMIN_USERNAME="admin" (gleicher Inhalt ==> config.json/auth/users/username) - CAIRN_ADMIN_PASSWORD="admin" (gleicher Inhalt ==> config.json/auth/users/passwordHash) Als Präzedenz würde ich die Environment Variablen höher setzen als die config.json, da man diese direkt am Deployment später ablesen kann (das Secret mit der Config muss vorher dekodiert werden mit B64).
Cordy changed title from Adjustments, v0.6.63 to Adjustments, Manuel findings 2026-08-25 19:22:00 +00:00
Owner

[10:57, 8/26/2026] Manuel Novak: Habs mal deployed aber die Helm Chart is noch buggy.
[10:58, 8/26/2026] Manuel Novak: Der ARM64 build funktioniert mit dem "make release" von dir und das Image kann man auch easy damit bauen (da zieh ich noch eine Image Bakery hoch für mich).
[10:59, 8/26/2026] Manuel Novak: Ich werd meinen Harbor evtl. public machen mit Credentials, damit man die neuesten Cairn Releases direkt mit Helm in k8s starten kann
[11:03, 8/26/2026] Manuel Novak: Der listen Port ist auch noch falsch konfiguriert.

Er kommt in der config.json und im Helm Chart bei dem SVC vor, was unschön ist.

Eine ENV sollte reichen, z.b. "CAIRN_LISTEN_PORT=7420"
Und diese sollt mer dann mit dem values.yaml steuern können.
[11:03, 8/26/2026] Manuel Novak: Ich bau an dem Helm Chart weiter sobald ich Zeit hab

[10:57, 8/26/2026] Manuel Novak: Habs mal deployed aber die Helm Chart is noch buggy. [10:58, 8/26/2026] Manuel Novak: Der ARM64 build funktioniert mit dem "make release" von dir und das Image kann man auch easy damit bauen (da zieh ich noch eine Image Bakery hoch für mich). [10:59, 8/26/2026] Manuel Novak: Ich werd meinen Harbor evtl. public machen mit Credentials, damit man die neuesten Cairn Releases direkt mit Helm in k8s starten kann [11:03, 8/26/2026] Manuel Novak: Der listen Port ist auch noch falsch konfiguriert. Er kommt in der config.json und im Helm Chart bei dem SVC vor, was unschön ist. Eine ENV sollte reichen, z.b. "CAIRN_LISTEN_PORT=7420" Und diese sollt mer dann mit dem values.yaml steuern können. [11:03, 8/26/2026] Manuel Novak: Ich bau an dem Helm Chart weiter sobald ich Zeit hab
Owner

Verdict per item, checked against the chart as of v0.6.126 / chart 0.3.0 (2026-09-05):

  1. Ingress object, gated by enabled — confirmed missing. The chart only renders a LoadBalancer Service (dogfood-shaped, MetalLB). Will add: standard ingress.* values block (className, annotations, hosts/paths, tls), default off.
  2. HTTPRoute (Gateway API), gated by enabled — confirmed missing. Will add: httpRoute.* values block (parentRefs, hostnames), default off.
  3. nodeSelector for tagged nodes — confirmed missing; neither the Cairn deployment nor the (new) converter deployment exposes scheduling knobs. Will add: nodeSelector / tolerations / affinity values for both.
  4. Default cairn-config with admin/admin in the imagesuperseded since this was filed, proposing to decline as written. A no-config boot in local mode now enters setup mode: a one-time token is printed to the logs and /setup creates the first admin; storage.driver: "setup" additionally connects storage from the browser wizard. That is the easy start without writing config.json — without shipping default credentials that every scanner and attacker tries first. Baked-in admin/admin in a public image is CVE-feed material.
  5. CAIRN_ADMIN_USERNAME / CAIRN_ADMIN_PASSWORD env — does not exist today; will add, with one refinement: CAIRN_ADMIN_PASSWORD_HASH (PHC argon2id, safe to read off the deployment spec — the exact benefit Manuel names) as the documented path, plus plaintext CAIRN_ADMIN_PASSWORD hashed at boot with a loud not-for-production log warning. Env-over-config precedence as requested — that is already the standing rule for every other CAIRN_* env.

Listen port (comment): half-exists. CAIRN_LISTEN env is already implemented and wins over config (address form, ":7420"). What is missing is the chart wiring: today the port lives in config.json and hard-coded in the chart. Will add: one listen.port value that sets CAIRN_LISTEN on the pod and drives the containerPort — values.yaml becomes the single source, the config Secret needs no listen at all.

Implementation starting now; results will be posted here.

**Verdict per item, checked against the chart as of v0.6.126 / chart 0.3.0 (2026-09-05):** 1. **Ingress object, gated by `enabled`** — confirmed missing. The chart only renders a `LoadBalancer` Service (dogfood-shaped, MetalLB). **Will add**: standard `ingress.*` values block (className, annotations, hosts/paths, tls), default off. 2. **HTTPRoute (Gateway API), gated by `enabled`** — confirmed missing. **Will add**: `httpRoute.*` values block (parentRefs, hostnames), default off. 3. **`nodeSelector` for tagged nodes** — confirmed missing; neither the Cairn deployment nor the (new) converter deployment exposes scheduling knobs. **Will add**: `nodeSelector` / `tolerations` / `affinity` values for both. 4. **Default `cairn-config` with admin/admin in the image** — **superseded since this was filed, proposing to decline as written.** A no-config boot in local mode now enters setup mode: a one-time token is printed to the logs and `/setup` creates the first admin; `storage.driver: "setup"` additionally connects storage from the browser wizard. That is the easy start without writing config.json — without shipping default credentials that every scanner and attacker tries first. Baked-in admin/admin in a public image is CVE-feed material. 5. **`CAIRN_ADMIN_USERNAME` / `CAIRN_ADMIN_PASSWORD` env** — does not exist today; **will add**, with one refinement: `CAIRN_ADMIN_PASSWORD_HASH` (PHC argon2id, safe to read off the deployment spec — the exact benefit Manuel names) as the documented path, plus plaintext `CAIRN_ADMIN_PASSWORD` hashed at boot with a loud not-for-production log warning. Env-over-config precedence as requested — that is already the standing rule for every other CAIRN_* env. **Listen port (comment):** half-exists. `CAIRN_LISTEN` env is already implemented and wins over config (address form, `":7420"`). What is missing is the chart wiring: today the port lives in config.json *and* hard-coded in the chart. **Will add**: one `listen.port` value that sets `CAIRN_LISTEN` on the pod and drives the containerPort — values.yaml becomes the single source, the config Secret needs no `listen` at all. Implementation starting now; results will be posted here.
Owner

Shipped — v0.6.127, chart 0.4.0 (PR #425, merged; both dogfoods rolled at 00:12 UTC).

  1. Ingress templates/ingress.yaml, gated by ingress.enabled (default false): className, annotations, hosts/paths, tls. Routes only to Cairn — never to the converter, which stays internal by design.
  2. HTTPRoute templates/httproute.yaml, gated by httpRoute.enabled (default false): parentRefs, hostnames, annotations. Needs the Gateway API CRDs + a Gateway to attach to.
  3. nodeSelector nodeSelector/tolerations/affinity values for the Cairn pod AND a separate set under converter.* (the converter being the resource-heavy one, pinning it to tagged nodes is the common case).
  4. admin/admin in the image — declined as written, superseded (see verdict above): setup mode already gives a zero-config start via one-time token + /setup + storage wizard, without shipping guessable credentials. Recorded in the CHANGELOG.
  5. Env-driven admin CAIRN_ADMIN_USERNAME + CAIRN_ADMIN_PASSWORD_HASH (PHC argon2id, generate with cairnd hash-password; safe to read off a deployment spec) upserts the user and grants admin at boot — a deployment carrying these envs never enters the first-run flow. Plaintext CAIRN_ADMIN_PASSWORD also accepted, hashed at boot with a loud not-for-production log warning. Env wins over config; half-configured env (or plaintext passed into _HASH — prefix-validated) refuses boot with a precise error. Tested: upsert, verify, replace-in-place, no admin-list duplicates, all three refusals.
  6. Listen port — chart value listen.port (default 7420) sets CAIRN_LISTEN on the pod and drives the containerPort; probes and Service target the named port so everything follows. values.yaml is the single source; the config Secret needs no listen at all.

Docs: deployment.md Kubernetes section + Secrets section updated. @hyrsh — chart 0.4.0 on main; when you rebase your chart work, these should cover the list. The "noch buggy" remark from 8/26 predates the 0.2.0→0.4.0 rework (converter component, env injection, this batch) — if anything still misbehaves on your cluster, name it here and it gets the same treatment.

**Shipped — v0.6.127, chart 0.4.0** (PR #425, merged; both dogfoods rolled at 00:12 UTC). 1. **Ingress** ✅ — `templates/ingress.yaml`, gated by `ingress.enabled` (default false): `className`, `annotations`, `hosts`/`paths`, `tls`. Routes only to Cairn — never to the converter, which stays internal by design. 2. **HTTPRoute** ✅ — `templates/httproute.yaml`, gated by `httpRoute.enabled` (default false): `parentRefs`, `hostnames`, `annotations`. Needs the Gateway API CRDs + a Gateway to attach to. 3. **nodeSelector** ✅ — `nodeSelector`/`tolerations`/`affinity` values for the Cairn pod AND a separate set under `converter.*` (the converter being the resource-heavy one, pinning it to tagged nodes is the common case). 4. **admin/admin in the image** — declined as written, superseded (see verdict above): setup mode already gives a zero-config start via one-time token + `/setup` + storage wizard, without shipping guessable credentials. Recorded in the CHANGELOG. 5. **Env-driven admin** ✅ — `CAIRN_ADMIN_USERNAME` + `CAIRN_ADMIN_PASSWORD_HASH` (PHC argon2id, generate with `cairnd hash-password`; safe to read off a deployment spec) upserts the user and grants admin at boot — a deployment carrying these envs never enters the first-run flow. Plaintext `CAIRN_ADMIN_PASSWORD` also accepted, hashed at boot with a loud not-for-production log warning. Env wins over config; half-configured env (or plaintext passed into `_HASH` — prefix-validated) refuses boot with a precise error. Tested: upsert, verify, replace-in-place, no admin-list duplicates, all three refusals. 6. **Listen port** ✅ — chart value `listen.port` (default 7420) sets `CAIRN_LISTEN` on the pod and drives the containerPort; probes and Service target the named port so everything follows. values.yaml is the single source; the config Secret needs no `listen` at all. Docs: deployment.md Kubernetes section + Secrets section updated. @hyrsh — chart 0.4.0 on main; when you rebase your chart work, these should cover the list. The "noch buggy" remark from 8/26 predates the 0.2.0→0.4.0 rework (converter component, env injection, this batch) — if anything still misbehaves on your cluster, name it here and it gets the same treatment.
Author
Collaborator

Junge die Agents schaffen schon schwer was weg :D

Junge die Agents schaffen schon schwer was weg :D
Owner

can be closed

can be closed
Cordy closed this issue 2026-09-13 17:35:04 +00:00
Sign in to join this conversation.
No labels
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#310
No description provided.