From f1e6fb6332303890dc6ce76faa2af3fb98a22700 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Thu, 27 Aug 2026 17:13:35 +0530 Subject: [PATCH] feat(plane-ce): extraObjects, so an environment can ship its own ESO manifests (1.8.0) 1.7.0 gave this chart the externalized-secret contract but no way to deliver the objects that produce those Secrets. A SecretStore and the ExternalSecrets behind external_secrets.* belong to the operator, not to this chart -- but they have nowhere to live when a GitOps tool treats one directory as one unit. Without this they need a second Fleet bundle purely to exist, and a second bundle is a second thing to order correctly. Same shape as plane-enterprise's, including the part that is easy to get wrong: rendered with toYaml and NOT tpl. The objects people put here are usually ExternalSecrets whose target.template carries ESO's own {{ }} placeholders, and tpl would try to evaluate those as Helm expressions -- failing, or worse resolving them to empty. Verified: a target.template containing {{ .password }} comes out of the render byte-identical. Ordering is left to the standard Helm hook annotations, which is what an ExternalSecret wants: this chart's Secret references are optional: false, so a pod that starts before its Secret exists waits in CreateContainerConfigError rather than starting without a credential. Additive: with extraObjects empty -- the default -- the render is 0 lines different from published 1.7.0. helm lint clean. Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-ce/Chart.yaml | 2 +- charts/plane-ce/templates/extra-objects.yaml | 38 ++++++++++++++++++++ charts/plane-ce/values.yaml | 13 +++++++ 3 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 charts/plane-ce/templates/extra-objects.yaml diff --git a/charts/plane-ce/Chart.yaml b/charts/plane-ce/Chart.yaml index e8bc52bf..eedd48eb 100644 --- a/charts/plane-ce/Chart.yaml +++ b/charts/plane-ce/Chart.yaml @@ -5,7 +5,7 @@ description: Meet Plane. An open-source software development tool to manage issu type: application -version: 1.7.0 +version: 1.8.0 appVersion: "1.4.1" home: https://plane.so diff --git a/charts/plane-ce/templates/extra-objects.yaml b/charts/plane-ce/templates/extra-objects.yaml new file mode 100644 index 00000000..cde19d33 --- /dev/null +++ b/charts/plane-ce/templates/extra-objects.yaml @@ -0,0 +1,38 @@ +{{/* +Arbitrary extra objects, supplied by the operator through values. + +The reason this exists: everything a Plane environment needs to STOP holding credentials -- +an ESO SecretStore, the ExternalSecrets that produce the Secrets this chart reads by name -- +is not part of this chart and never should be, but it also has nowhere else to live when the +release is delivered by a GitOps tool that treats one directory as one unit. Without this, +those objects need a second bundle purely to exist, and a second bundle is a second thing to +order correctly. + +Rendered with toYaml and NOT tpl, deliberately. The objects people put here are usually +ExternalSecrets whose `target.template` contains ESO's own {{ }} placeholders; tpl would try +to evaluate those as Helm expressions and fail, or worse, silently resolve them to empty. +Values are not templated by Helm, so writing them here passes them through untouched. + +Ordering: give an object the standard Helm hook annotations to have it applied before the +workloads, which is what an ExternalSecret wants -- the chart's Secret references are +optional: false, so a pod that starts before its Secret exists sits in +CreateContainerConfigError until it appears. + + extraObjects: + - apiVersion: external-secrets.io/v1 + kind: SecretStore + metadata: + name: aws-secrets-manager + annotations: + helm.sh/hook: pre-install,pre-upgrade + helm.sh/hook-weight: "-10" + helm.sh/hook-delete-policy: before-hook-creation + spec: { ... } + +Namespace is left to the object: most callers want the release namespace, which is the +default when it is omitted, and a few legitimately want another. +*/}} +{{- range .Values.extraObjects }} +--- +{{ toYaml . }} +{{- end }} diff --git a/charts/plane-ce/values.yaml b/charts/plane-ce/values.yaml index 9437f1af..677bede4 100644 --- a/charts/plane-ce/values.yaml +++ b/charts/plane-ce/values.yaml @@ -347,3 +347,16 @@ env: default_cluster_domain: cluster.local api_key_rate_limit: "60/minute" + +# Arbitrary extra Kubernetes objects rendered as part of this release. Intended for the +# things that let an environment hold no credentials -- an ESO SecretStore and the +# ExternalSecrets producing the Secrets referenced by external_secrets.* above -- which +# belong to the operator rather than to this chart, but have nowhere to live when a GitOps +# tool treats one directory as one unit. +# +# Passed through verbatim (toYaml, not tpl) so that ESO's own {{ }} placeholders inside a +# target.template survive. Add the standard Helm hook annotations to have an object applied +# BEFORE the workloads; the Secret references in this chart are optional: false, so a pod +# that starts before its Secret exists waits in CreateContainerConfigError until it appears. +extraObjects: [] +