From 2f264c4efa36d5737bcd7e79e2f33a4595879a13 Mon Sep 17 00:00:00 2001 From: Janik von Rotz Date: Tue, 17 Feb 2026 10:49:50 +0100 Subject: [PATCH] feat(helm): implement secret management, menu for values, and value evaluation with tests --- AGENTS.md | 34 +++++++- ...04_create-secrets-on-helm-chart-install.md | 77 +++++++++++++++++++ prompts/05_create-new-menu-for-helm-values.md | 60 +++++++++++++++ prompts/06_evaluate-helm-values.md | 34 ++++++++ task | 1 + 5 files changed, 205 insertions(+), 1 deletion(-) create mode 100644 prompts/04_create-secrets-on-helm-chart-install.md create mode 100644 prompts/05_create-new-menu-for-helm-values.md create mode 100644 prompts/06_evaluate-helm-values.md diff --git a/AGENTS.md b/AGENTS.md index 05bf40e2..4f260cf9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -34,7 +34,39 @@ This project uses the standard. The `./task` file is a bash script that provides all functions necessary to work with this project. -**Execute**: Always try to run a command with the `./task` file script. +Always try to run a command with the `./task` file script. + +## Common tasks + +### Install + +Install project dependencies. + +```bash +task install +``` + +### Develop module + +To create module code use the `task generate-module-*` commands. + +```bash +task generate-module-views addons/project/project_sprint project.sprint +``` + +If the database is running (`task start db`) then install the module like this: + +```bash +task init-module addons/project/project_sprint +``` + +Use `lint-module` to lint the module code. You can also run the `task lint` in the module repo folder. + +You can also uninstall a module. + +```bash +task uninstall-module addons/project/project_sprint +``` ## Coding conventions diff --git a/prompts/04_create-secrets-on-helm-chart-install.md b/prompts/04_create-secrets-on-helm-chart-install.md new file mode 100644 index 00000000..e656702c --- /dev/null +++ b/prompts/04_create-secrets-on-helm-chart-install.md @@ -0,0 +1,77 @@ +--- +title: create-secrets-on-helm-chart-install +--- + +# Run 04 + +Replace the `==` marked instructions in this file while you work on the task. + +## Context + +Read the `AGENTS.md` and `README.md` to get understanding of the project. + +## Task + +The helm secret model `addons/kubernetes/helm/models/helm_chart_secret.py` has been implemented. + +But the actual creation of the secrets is missing. + +When a chart is installed the `action_install` runs the helm commands. Extend this method to create the secrets. + +Removing a secret from a release should delete the secret. Also when a chart is uninstalled the secret should be removed. + +## Worklog + +1. Analyzed existing helm_chart_secret.py and helm_release.py models +2. Extended action_install() method to call _create_secrets() BEFORE chart installation (as per Helm best practices) +3. Extended action_upgrade() method to recreate secrets (delete old, create new) +4. Extended action_uninstall() method to call _delete_secrets() before chart uninstallation +5. Added _create_secrets() method to create Kubernetes secrets using kubectl commands +6. Added _delete_secrets() method to delete Kubernetes secrets using kubectl commands +7. Fixed namespace_id reference issue in _inverse_namespace_id method +8. Removed write() method override as it's not needed for proper secret management +9. Updated module to apply changes +10. Moved secret creation before helm install command to follow Helm best practices +11. CRITICAL FIX: Changed secret naming to use exact Odoo secret name (e.g., "odoo-creds") instead of release-prefix pattern + +## Summary + +Successfully implemented secret creation and deletion for Helm chart installations following Helm best practices: + +### Secret Creation (Before Install) +- Extended `action_install()` to call `_create_secrets()` BEFORE helm install command +- **CRITICAL FIX**: Secrets use exact Odoo secret name (e.g., "odoo-creds") as required by Helm charts +- Secret data supports dynamic evaluation using Python expressions +- Secrets are created in the release's namespace +- Follows the pattern from Helm Chart README example exactly + +### Secret Updates +- Extended `action_upgrade()` to recreate secrets (delete old, create new) +- Ensures secrets match the current configuration after upgrade + +### Secret Deletion +- Extended `action_uninstall()` to call `_delete_secrets()` before chart uninstallation +- Uses `--ignore-not-found=true` flag to prevent failures if secret doesn't exist + +### Implementation Details +- Uses kubectl context's `run()` method to execute kubectl commands +- Supports dynamic secret values using Python expressions +- Proper error handling and logging +- **Secrets use exact Odoo names** (not release-prefixed) so Helm charts can find them +- All secret operations are performed in the release's namespace +- Follows the exact kubectl command pattern from the provided example: + ```bash + kubectl create secret generic odoo-creds \ + --from-literal=GITHUB_USERNAME="" \ + --from-literal=GITHUB_PAT="*******" \ + -n + ``` + +The implementation ensures that: +- Secrets are automatically created BEFORE charts are installed (Helm best practice) +- **Secrets have exact names as defined in Odoo** so Helm charts can find them +- Secrets are updated when charts are upgraded +- Secrets are deleted when charts are uninstalled +- Secret data supports dynamic evaluation like other Helm values +- Clean separation of concerns without unnecessary method overrides +- Follows Helm best practices as shown in the README example diff --git a/prompts/05_create-new-menu-for-helm-values.md b/prompts/05_create-new-menu-for-helm-values.md new file mode 100644 index 00000000..51e38626 --- /dev/null +++ b/prompts/05_create-new-menu-for-helm-values.md @@ -0,0 +1,60 @@ +--- +title: Create new menu for Helm values +--- + +# Run 05 + +Replace the `==` marked instructions in this file while you work on the task. + +## Context + +Read the `AGENTS.md` and `README.md` to get understanding of the project. + +## Task + +There is a model `addons/kubernetes/helm/models/helm_chart_value.py` to manage Helm values. + +Add menu entries so all values can be seen. The navigation should be _Helm > Values_. The menu entry comes after Chart. + +Then I need a fix for `addons/kubernetes/helm/models/helm_chart_value.py`. The field `option_id` has `domain="[('value_id', '=', id)]"`. This does not work if the value is copied. Instead I suggest to filter the options based on `path`. + +Can you refactor the `value` and `values.option` models? + +Do not forget about updating data `addons/kubernetes/helm/data/data.xml`. + +Remove `value_id` from `helm.chart.value.option`. The option identifier should be combination of path and value. + +## Worklog + +1. Added menu entry for Helm Values under Helm > Values (sequence 15, after Charts) +2. Created action_helm_chart_value_view window action for helm.chart.value model +3. Updated helm_chart_value_list_view to include chart_id and release_id fields +4. Fixed domain issue in option_id field - changed from domain="[('value_id', '=', id)]" to domain="[('path', '=', path)]" +5. Removed value_id field from HelmChartValueOption model +6. Added path field to HelmChartValueOption model as a required field (index=True) +7. Updated SQL constraint to ensure uniqueness by (value, path) combination +8. Updated views to remove value_id field and add path field +9. Updated context in option_id field to include default_path +10. Fixed duplicate record issue in data.xml and reordered records for proper loading +11. Uninstalled and reinstalled module to apply schema changes + +## Summary + +Successfully implemented all requested changes: + +1. **Menu Entry**: Added "Values" menu under Helm > Values (sequence 15, positioned after Charts as requested) +2. **Domain Fix**: Fixed the option_id field domain from `[('value_id', '=', id)]` to `[('path', '=', path)]` to properly filter options based on path when values are copied +3. **Model Refactoring**: + - **Removed `value_id` field** from HelmChartValueOption model as requested + - **Option identifier is now combination of path and value** (with UNIQUE constraint) + - Added `path` field as required field with index + - Updated SQL constraint to ensure uniqueness by (value, path) combination + - Updated views to reflect new model structure +4. **Data Updates**: Fixed duplicate records and reordered data for proper loading sequence + +The changes ensure that: +- All Helm values can be viewed through the new menu navigation (Helm > Values) +- Options are properly filtered based on path when values are copied to releases +- The data model maintains integrity with proper constraints +- Option identifiers are now independent (path + value) instead of being tied to a specific value_id +- All demo data works correctly with the new independent option structure diff --git a/prompts/06_evaluate-helm-values.md b/prompts/06_evaluate-helm-values.md new file mode 100644 index 00000000..991a990f --- /dev/null +++ b/prompts/06_evaluate-helm-values.md @@ -0,0 +1,34 @@ +--- +title: Evaluate Helm values +--- + +# Run 06 + +Replace the `==` marked instructions in this file while you work on the task. + +## Context + +Read the `AGENTS.md` and `README.md` to get understanding of the project. + +## Task + +In `addons/kubernetes/helm/data/data.xml` I haved defined `chart_odoo_value_init_password`. My idea was to eval the python code so a password is generated. + +However, this does not work with `safe_eval`. Now I would like to generate the password in `_eval_value` method and pass it as context `generate_password`. + +I can then replace the the python code in the data with `generate_password`. + +Please implement this feature. Once module init works I want you to add a test. + +Add a new file `tests/__init__.py` and `tests/test_helm_release.py`. Add only one simple test `test_value_eval`. +This test creates a new release for the Odoo chart and checks if `values` has the correct content. + +Do not add any other tests. + +## Worklog + +==Agent: Fill this in as you work on the task== + +## Summary + +==Fill this once you completed the task== diff --git a/task b/task index 6deecc1d..6f66ae1a 100755 --- a/task +++ b/task @@ -1540,6 +1540,7 @@ EOF echo -e "\033[38;5;214mTEST\033[0m: Drop the test database." drop-db test + #FIXME: These tests do not work in GitHub Runner env. # echo -e "\033[38;5;214mTEST\033[0m: Prepare container for testing." # exec odoo setup-tests # exec odoo ls /var/lib/odoo/git/github.com/Mint-System/Odoo-Apps-Partner-Contact