hub: optionally create the hub-audit S3 credentials Secret (0.171.0) (#222)

credentialsSecret.create: true makes the chart render the Secret from
credentialsSecret.accessKeyId / secretAccessKey, so the audit S3 keys can
live in values like the chart's other credentials. The default stays
"bring your own Secret".

Inline keys without create: true now fail instead of being ignored, two
destinations creating the same Secret fail, and the docs spell out that
accessKeyIdKey / secretAccessKeyKey name keys inside the Secret.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.170.1
+version: 0.171.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -901,7 +901,7 @@ kerberospipeline:
 | `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
 | `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
 | `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
-| `kerberoshub.audit.destinations` | Audit destinations. Every entry supports `id`, `type` (`webhook` by default, or `s3`), `enabled`, delivery limits and filters. Webhooks add `url`, public `headers`, `bearerTokenSecret` and arbitrary `secretHeaders`. S3 destinations add `s3.bucket`, `s3.region`, optional `s3.prefix`, `s3.endpoint` and `s3.forcePathStyle` for S3-compatible stores, and an optional `credentialsSecret` (`name`, `accessKeyIdKey`, `secretAccessKeyKey`); without it the pod's AWS identity is used. The bucket must have Object Lock with a `COMPLIANCE` default retention unless `s3.allowUnlockedBucket` is `true` (stores without Object Lock such as Garage; the archive is then deletable). Every field, the delivery semantics and per-provider S3 settings are documented at https://learn.uug.ai/docs/hub/audit-events/#export-audit-events. Destination IDs retain independent checkpoints. | `[]` |
+| `kerberoshub.audit.destinations` | Audit destinations. Every entry supports `id`, `type` (`webhook` by default, or `s3`), `enabled`, delivery limits and filters. Webhooks add `url`, public `headers`, `bearerTokenSecret` and arbitrary `secretHeaders`. S3 destinations add `s3.bucket`, `s3.region`, optional `s3.prefix`, `s3.endpoint` and `s3.forcePathStyle` for S3-compatible stores, and an optional `credentialsSecret`; without it the pod's AWS identity is used. `credentialsSecret.name` names the Kubernetes Secret holding the S3 keys, and `accessKeyIdKey` / `secretAccessKeyKey` name the keys inside it (defaults `access-key-id` / `secret-access-key`), not the credentials themselves. By default you create that Secret yourself; with `credentialsSecret.create: true` the chart creates it from `credentialsSecret.accessKeyId` and `credentialsSecret.secretAccessKey`. Switching an existing hand-made Secret to `create: true` needs that Secret deleted first, because Helm does not adopt resources it did not create. The bucket must have Object Lock with a `COMPLIANCE` default retention unless `s3.allowUnlockedBucket` is `true` (stores without Object Lock such as Garage; the archive is then deletable). Every field, the delivery semantics and per-provider S3 settings are documented at https://learn.uug.ai/docs/hub/audit-events/#export-audit-events. Destination IDs retain independent checkpoints. | `[]` |
 | `kerberoshub.audit.serviceAccount.create` | Create a ServiceAccount used only by hub-audit, for example for S3 access through IRSA. | `false` |
 | `kerberoshub.audit.serviceAccount.name` | Name of the hub-audit ServiceAccount; with `create: false`, an existing ServiceAccount to use. Defaults to `hub-audit` when created; when empty and not created, `kerberoshub.serviceAccount` applies. | `""` |
 | `kerberoshub.audit.serviceAccount.annotations` | Annotations for the hub-audit ServiceAccount, such as `eks.amazonaws.com/role-arn`. | `{}` |

charts/hub/templates/configMaps/configmap-hub-audit.yaml

@@ -58,6 +58,9 @@
     {{- $credentials := default dict $destination.credentialsSecret -}}
     {{- if gt (len $credentials) 0 -}}
       {{- $secretName := required (printf "credentialsSecret.name is required for destination %s" $id) $credentials.name -}}
+      {{- if and (not $credentials.create) (or $credentials.accessKeyId $credentials.secretAccessKey) -}}
+        {{- fail (printf "audit destination %s sets credentialsSecret.accessKeyId/secretAccessKey without create: true; set create: true to let the chart create Secret %s from them, or remove them and create the Secret yourself" $id $secretName) -}}
+      {{- end -}}
       {{- $_ := set $settings "accessKeyIdFile" (printf "%s/access-key-id-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "access-key-id" $credentials.accessKeyIdKey)) | trunc 12)) -}}
       {{- $_ := set $settings "secretAccessKeyFile" (printf "%s/secret-access-key-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "secret-access-key" $credentials.secretAccessKeyKey)) | trunc 12)) -}}
     {{- end -}}

charts/hub/templates/kerberos-hub/hub-audit-credentials-secret.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.audit.enabled }}
+{{- $created := dict }}
+{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+{{- $credentials := default dict $destination.credentialsSecret }}
+{{- if $credentials.create }}
+{{- $name := required (printf "credentialsSecret.name is required for destination %s" $destination.id) $credentials.name }}
+{{- if hasKey $created $name }}
+{{- fail (printf "audit destinations %s and %s both create Secret %q; give each its own credentialsSecret.name, or set create: false on one and reuse the Secret" (get $created $name) $destination.id $name) }}
+{{- end }}
+{{- $_ := set $created $name $destination.id }}
+{{- $accessKeyIdKey := default "access-key-id" $credentials.accessKeyIdKey }}
+{{- $secretAccessKeyKey := default "secret-access-key" $credentials.secretAccessKeyKey }}
+{{- if eq $accessKeyIdKey $secretAccessKeyKey }}
+{{- fail (printf "credentialsSecret.accessKeyIdKey and secretAccessKeyKey must differ for destination %s" $destination.id) }}
+{{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app: hub-audit
+    audit-destination: {{ $destination.id }}
+type: Opaque
+stringData:
+  {{ $accessKeyIdKey | quote }}: {{ required (printf "credentialsSecret.accessKeyId is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.accessKeyId | quote }}
+  {{ $secretAccessKeyKey | quote }}: {{ required (printf "credentialsSecret.secretAccessKey is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.secretAccessKey | quote }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/hub/values.yaml

@@ -936,7 +936,15 @@ kerberoshub:
     #   # kerberoshub.audit.serviceAccount, or an instance profile). That only
     #   # works for AWS S3; every other store needs credentialsSecret.
     #   credentialsSecret:
-    #     name: audit-immutable-archive
+    #     name: audit-immutable-archive # Kubernetes Secret holding the S3 keys
+    #     # create: false (default) reads an existing Secret you create yourself:
+    #     #   kubectl create secret generic audit-immutable-archive \
+    #     #     --from-literal=access-key-id=<key> --from-literal=secret-access-key=<secret>
+    #     # create: true lets the chart create that Secret from the two values below.
+    #     create: false
+    #     accessKeyId: "" # only with create: true
+    #     secretAccessKey: "" # only with create: true
+    #     # Names of the keys inside the Secret, not the credentials themselves.
     #     accessKeyIdKey: access-key-id
     #     secretAccessKeyKey: secret-access-key
     # resources: