Skip to content

fix: create secret only when provided - #594

Open
cxdy wants to merge 6 commits into
linode:mainfrom
cxdy:fix/secretRef
Open

fix: create secret only when provided#594
cxdy wants to merge 6 commits into
linode:mainfrom
cxdy:fix/secretRef

Conversation

@cxdy

@cxdy cxdy commented Jul 22, 2026

Copy link
Copy Markdown

Noticed this bug when upgrading the linode-ccm today (and trying to hot-load the API token)
Related PR: #576
Copy-cat PR for CSI: linode/linode-blockstorage-csi-driver#592

When updating to v0.9.7, I looked at the diff in ArgoCD and it didn't show the new Secret object, but the CSI (which I'm also updating) did show the new Secret object. Thought that was strange so we dug a little and noticed this:

{{- if not .Values.secretRef }}
apiVersion: v1
kind: Secret
metadata:
name: ccm-linode
namespace: {{ required ".Values.namespace required" .Values.namespace }}
stringData:
apiToken: {{ required ".Values.apiToken required" .Values.apiToken }}
region: {{ required ".Values.region required" .Values.region }}
type: Opaque
{{- end }}

if not .Values.secretRef directly conflicts with what I'm trying to do. In the CSI PR, we did if not .Values.apiToken instead:
https://github.com/linode/linode-blockstorage-csi-driver/blob/main/helm-chart/csi-driver/templates/csi-secrets.yaml#L5-L15

Here's my valuesObject (same in both applications, only difference is csi-linode and ccm-linode for secretRef.name:

        valuesObject:
          region: {{ .Values.apiRegion }}
          apiToken: "<path:/vault/path/to/linode-api#token>"
          secretRef:
            name: "ccm-linode"
            apiTokenRef: "apiToken"
            regionRef: "region"
            mountSecret: true

General:

  • Have you removed all sensitive information, including but not limited to access keys and passwords?
  • Have you checked to ensure there aren't other open or closed Pull Requests for the same bug/feature/question?

Pull Request Guidelines:

  1. Does your submission pass tests?
  2. Have you added tests?
  3. Are you addressing a single feature in this PR?
  4. Are your commits atomic, addressing one change per commit?
  5. Are you following the conventions of the language?
  6. Have you saved your large formatting changes for a different PR, so we can focus on your work?
  7. Have you explained your rationale for why this feature is needed?
  8. Have you linked your PR to an open issue

@cxdy
cxdy temporarily deployed to prod-external July 22, 2026 21:53 — with GitHub Actions Inactive
@cxdy cxdy changed the title chore: create secret only when provided fix: create secret only when provided Jul 22, 2026
@AshleyDumaine AshleyDumaine added the bugfix for any bug fixes in the changelog. label Jul 23, 2026
@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.76%. Comparing base (8e51020) to head (c85f9c1).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #594   +/-   ##
=======================================
  Coverage   73.76%   73.76%           
=======================================
  Files          19       19           
  Lines        3045     3045           
=======================================
  Hits         2246     2246           
  Misses        538      538           
  Partials      261      261           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@cxdy
cxdy temporarily deployed to prod-external July 23, 2026 13:42 — with GitHub Actions Inactive
Match the CSI chart pattern: keep name/keys/path/mount defaults in
values.yaml and read them directly from templates instead of hardcoding
fallbacks when secretRef is unset.
@cxdy
cxdy deployed to prod-external July 27, 2026 15:01 — with GitHub Actions Active
@cxdy
cxdy temporarily deployed to prod-external July 27, 2026 15:01 — with GitHub Actions Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix for any bug fixes in the changelog.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants