Add license support to helm chart

charts/lakefs/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: lakefs
 description: A Helm chart for running LakeFS on Kubernetes
 type: application
-version: 1.5.0
+version: 1.6.0
 appVersion: 1.63.0
 
 home: https://lakefs.io

charts/lakefs/templates/_env.tpl

@@ -30,6 +30,10 @@ env:
     value: asdjfhjaskdhuioaweyuiorasdsjbaskcbkj
   {{- end }}
   {{- if (.Values.enterprise).enabled}}
+  {{- if or (and .Values.secrets .Values.secrets.licenseContents) (and .Values.existingSecret .Values.secretKeys.licenseContentsKey) }}
+  - name: LAKEFS_LICENSE_PATH
+    value: '/etc/lakefs/license.tkn'
+  {{- end }}
   - name: LAKEFS_USAGE_REPORT_ENABLED
     value: "true"
   - name: LAKEFS_FEATURES_LOCAL_RBAC
@@ -137,8 +141,25 @@ envFrom:
       - key: config.yaml
         path: config.yaml
 {{- end }}
+{{- if (.Values.enterprise).enabled }}
+{{- if and .Values.existingSecret .Values.secretKeys.licenseContentsKey }}
+- name: secret-volume-license-token
+  secret:
+    secretName: {{ .Values.existingSecret }}
+    items:
+      - key: {{ .Values.secretKeys.licenseContentsKey }}
+        path: license.tkn
+{{- else if and .Values.secrets .Values.secrets.licenseContents }}
+- name: secret-volume-license-token
+  secret:
+    secretName: {{ include "lakefs.fullname" . }}
+    items:
+      - key: license_contents
+        path: license.tkn
+{{- end }}
+{{- end }}
 {{- if (((.Values.enterprise).auth).saml).enabled }}
-- name: secret-volume
+- name: secret-volume-license-token
   secret:
     secretName: saml-certificates
 {{- end }}

charts/lakefs/templates/deployment.yaml

@@ -99,10 +99,18 @@ spec:
               mountPath: "/lakefs/data"
           {{- end }}
           {{- if (((.Values.enterprise).auth).saml).enabled }}
-            - name: secret-volume
+            - name: secret-volume-license-token
               readOnly: true
               mountPath: /etc/saml_certs/
           {{- end }}
+          {{- if (.Values.enterprise).enabled }}
+          {{- if or (and .Values.secrets .Values.secrets.licenseContents) (and .Values.existingSecret .Values.secretKeys.licenseContentsKey) }}
+            - name: secret-volume-license-token
+              mountPath: /etc/lakefs/license.tkn
+              subPath: "license.tkn"
+              readOnly: true
+          {{- end }}
+          {{- end }}
           {{- include "lakefs.env" . | nindent 10 }}
         {{- include "lakefs.s3proxyContainer" . | nindent 8}}
         {{- include "lakefs.gcpProxyContainer" . | nindent 8}}

charts/lakefs/templates/secret.yaml

@@ -13,7 +13,13 @@ data:
 {{- if (.Values.secrets).authEncryptSecretKey }}
   auth_encrypt_secret_key: {{ .Values.secrets.authEncryptSecretKey | default "" | b64enc }}
 {{- end }}
+
 {{- if (.Values.enterprise).enabled }}
+
+{{- if .Values.secrets.licenseContents }}
+  license_contents: {{ .Values.secrets.licenseContents | default "" | b64enc }}
+{{- end }}
+
 {{- if (((.Values.enterprise).auth).ldap).enabled }}
 {{- if (((.Values.enterprise).auth).ldap).bindPassword }}
   # LDAP bind password secret, used for LDAP authentication

charts/lakefs/values.yaml

@@ -121,6 +121,8 @@ secretKeys:
   authEncryptSecretKey: auth_encrypt_secret_key
   # Use the following to fetch PostgreSQL connection string from an existing secret:
   databaseConnectionString: null
+  # Use to fetch license token from an existing secret:
+  licenseContentsKey: null
   # Use the following to fetch LDAP bind password from an existing secret:
   ldapBindPassword: null
   # Use the following to fetch OIDC client secret from an existing secret:
@@ -150,3 +152,6 @@ enterprise:
         # certificates for AD FS IDP (e.g Azure AD)
         samlRsaPublicCert: null
         samlRsaPrivateKey: null
+
+secrets:
+  licenseContents: null