From e86f36cced2e37413625897814f98467ae43b2fc Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sat, 4 Jul 2026 19:47:45 +0000 Subject: [PATCH] Add complete environment variable configuration to OpenCloud deployment Updated deployment manifest with all 50+ environment variables mapping to sealed secrets, including service-specific overrides for each OpenCloud microservice. ## Changes - Added service account ID/secret for all services - Added storage mount ID and graph application ID - Added LDAP bind passwords for all LDAP-using services - Added IDM service user passwords (admin, idm, reva, idp) - Added collaboration WOPI secret and thumbnails transfer secret - Added service-specific environment variables (GRAPH_, IDM_, PROXY_, etc.) ## Status Deployment configured and applied, but OpenCloud search service failing with: "error parsing mapping JSON: unexpected end of JSON input" This appears to be a missing search engine mapping configuration that is not documented in OpenCloud's standard deployment docs. May require OpenCloud enterprise support or switching to an alternative solution. All infrastructure (namespace, storage, secrets, DNS, TLS, OIDC) is 100% complete and working. Co-Authored-By: Paperclip --- apps/opencloud/opencloud-deployment.yaml | 207 +++++++++++++++++++++-- 1 file changed, 195 insertions(+), 12 deletions(-) diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index efb687d..9ac0471 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -176,19 +176,202 @@ spec: - name: NOTIFICATIONS_SMTP_ENCRYPTION value: "ssl" - # Storage configuration - - name: GATEWAY_STORAGE_USERS_MOUNT_ID - value: "/users" - - name: STORAGE_USERS_MOUNT_ID - value: "/users" - - name: STORAGE_USERS_SERVICE_ACCOUNT_ID - value: "599fd884-c9bb-45fa-b347-cf2c910d546a" - - name: STORAGE_USERS_SERVICE_ACCOUNT_SECRET - value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc=" + # Service account (shared across all services) + - name: OC_SERVICE_ACCOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-id + - name: OC_SERVICE_ACCOUNT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-secret - # IDM service user - - name: IDM_SERVICE_USER_PASSWORD - value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc=" + # Storage configuration + - name: OC_STORAGE_MOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: storage-mount-id + - name: OC_GRAPH_APPLICATION_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: graph-application-id + + # LDAP bind passwords + - name: OC_GRAPH_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: graph-ldap-bind-password + - name: OC_IDP_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idp-ldap-bind-password + - name: OC_AUTH_BASIC_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + - name: OC_USERS_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + - name: OC_GROUPS_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + + # IDM service user passwords + - name: OC_IDM_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-admin-password + - name: OC_IDM_IDM_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-idm-password + - name: OC_IDM_REVA_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-reva-password + - name: OC_IDM_IDP_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-idp-password + + # Other service secrets + - name: OC_COLLABORATION_WOPI_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: collaboration-wopi-secret + - name: OC_THUMBNAILS_TRANSFER_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: thumbnails-transfer-secret + + # Service-specific environment variables (for direct override) + - name: GRAPH_APPLICATION_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: graph-application-id + - name: GRAPH_IDENTITY_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: graph-ldap-bind-password + - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-id + - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-secret + - name: IDP_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idp-ldap-bind-password + - name: IDM_SERVICE_USER_PASSWORDS_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-admin-password + - name: IDM_SERVICE_USER_PASSWORDS_IDM_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-idm-password + - name: IDM_SERVICE_USER_PASSWORDS_REVA_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-reva-password + - name: IDM_SERVICE_USER_PASSWORDS_IDP_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: idm-idp-password + - name: COLLABORATION_WOPI_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: collaboration-wopi-secret + - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-id + - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-secret + - name: STORAGE_USERS_MOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: storage-mount-id + - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-id + - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-secret + - name: GATEWAY_STORAGE_REGISTRY_STORAGE_USERS_MOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: storage-mount-id + - name: AUTH_BASIC_AUTH_PROVIDERS_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + - name: USERS_DRIVERS_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + - name: GROUPS_DRIVERS_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: ldap-bind-password + - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-id + - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: service-account-secret + - name: THUMBNAILS_THUMBNAIL_TRANSFER_SECRET + valueFrom: + secretKeyRef: + name: opencloud-config-secrets + key: thumbnails-transfer-secret # Demo users disabled (use OIDC only) - name: IDM_CREATE_DEMO_USERS