From b52f964734dc19b0dda382eb27e054bfcc38e201 Mon Sep 17 00:00:00 2001
From: Folke Behrens <folke@neon.tech>
Date: Mon, 19 Aug 2024 16:24:30 +0200
Subject: [PATCH] proxy: Pass controlplane token as secret

Fixes: neondatabase/cloud#16400
---
 charts/neon-proxy/Chart.yaml                | 2 +-
 charts/neon-proxy/README.md                 | 2 +-
 charts/neon-proxy/templates/deployment.yaml | 9 +++++----
 charts/neon-proxy/templates/secrets.yaml    | 9 +++++++++
 4 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 charts/neon-proxy/templates/secrets.yaml

diff --git a/charts/neon-proxy/Chart.yaml b/charts/neon-proxy/Chart.yaml
index c74f7cf..bb03bba 100644
--- a/charts/neon-proxy/Chart.yaml
+++ b/charts/neon-proxy/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: neon-proxy
 description: Neon Proxy
 type: application
-version: 1.7.27
+version: 1.7.28
 appVersion: "0.1.0"
 kubeVersion: "^1.18.x-x"
 home: https://neon.tech
diff --git a/charts/neon-proxy/README.md b/charts/neon-proxy/README.md
index 0a9daf9..dd453fa 100644
--- a/charts/neon-proxy/README.md
+++ b/charts/neon-proxy/README.md
@@ -1,6 +1,6 @@
 # neon-proxy
 
-![Version: 1.7.27](https://img.shields.io/badge/Version-1.7.27-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![Lint and Test Charts](https://github.com/neondatabase/helm-charts/actions/workflows/lint-test.yaml/badge.svg)](https://github.com/neondatabase/helm-charts/actions/workflows/lint-test.yaml)
+![Version: 1.7.28](https://img.shields.io/badge/Version-1.7.28-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![Lint and Test Charts](https://github.com/neondatabase/helm-charts/actions/workflows/lint-test.yaml/badge.svg)](https://github.com/neondatabase/helm-charts/actions/workflows/lint-test.yaml)
 
 Neon Proxy
 
diff --git a/charts/neon-proxy/templates/deployment.yaml b/charts/neon-proxy/templates/deployment.yaml
index 5eaf875..7215318 100644
--- a/charts/neon-proxy/templates/deployment.yaml
+++ b/charts/neon-proxy/templates/deployment.yaml
@@ -187,7 +187,7 @@ spec:
             {{- with .Values.settings.awsRegion }}
             - --aws-region={{ . }}
             {{ end }}
-            
+
 
           {{- if .Values.settings }}
           env:
@@ -211,10 +211,11 @@ spec:
             - name: SENTRY_ENVIRONMENT
               value: {{ . }}
             {{- end }}
-            {{- with .Values.settings.controlplane_token }}
             - name: NEON_PROXY_TO_CONTROLPLANE_TOKEN
-              value: {{ . }}
-            {{- end }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "neon-proxy.fullname" . }}-controlplane-token
+                  key: controlplane_token
             {{- with .Values.settings.awsAccessKeyId }}
             - name: AWS_ACCESS_KEY_ID
               value: {{ . }}
diff --git a/charts/neon-proxy/templates/secrets.yaml b/charts/neon-proxy/templates/secrets.yaml
new file mode 100644
index 0000000..23f1a36
--- /dev/null
+++ b/charts/neon-proxy/templates/secrets.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "neon-proxy.fullname" . }}-cplane-token
+  labels:
+    {{- include "neon-proxy.labels" . | nindent 4 }}
+type: Opaque
+data:
+  controlplane_token: {{ .Values.settings.controlplane_token | b64enc | quote }}