From c0a3615cd051eaa5e7f3e373c02db365c24ec2d4 Mon Sep 17 00:00:00 2001 From: KrutikaPhirangi <138781661+KrutikaPhirangi@users.noreply.github.com> Date: Wed, 28 Oct 2026 13:02:29 +0530 Subject: [PATCH 1/3] fix: call the real Agmarknet with its token login again [OpenAgriNet/network-adapter#60] --- charts/adapter-service/CHANGELOG.md | 12 +++++ charts/adapter-service/Chart.yaml | 2 +- .../config/multi-adapter/provider-config.yaml | 52 +++++-------------- .../network-adapter-config.yaml | 13 ++++- 4 files changed, 37 insertions(+), 42 deletions(-) diff --git a/charts/adapter-service/CHANGELOG.md b/charts/adapter-service/CHANGELOG.md index 21e588a3..bd905524 100644 --- a/charts/adapter-service/CHANGELOG.md +++ b/charts/adapter-service/CHANGELOG.md @@ -5,6 +5,18 @@ All notable changes to this chart are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this chart adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.8.0] - 2026-10-28 + +### Changed +- **BREAKING.** Mandi prices call the real Agmarknet again: `agmarknet` is back + on `authScheme: tokenQuery` in both modes, in place of the no-auth setting + the benchmark mock needed. A release must now supply + `__AGMARKNET_TOKEN_URL__` (`adapterKeys.extraSubstitutions` in single mode, + `keys.existingSecret.extraSubstitutions` in multi), and the provider tier's + environment must carry `AGMARKNET_ACCESS_NAME` and `AGMARKNET_PASSWORD`. + Without the substitution the init container stops on the unfilled + placeholder. Point the registry's `agmarknet` upstream at the real API too. + ## [0.7.0] - 2026-10-26 ### Added diff --git a/charts/adapter-service/Chart.yaml b/charts/adapter-service/Chart.yaml index 5c97e6b8..7a30a914 100644 --- a/charts/adapter-service/Chart.yaml +++ b/charts/adapter-service/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: adapter-service description: OAN Beckn adapter; role network-adapter runs all three tiers in single-adapter mode (default), or the network tier in multi-adapter. type: application -version: 0.7.0 +version: 0.8.0 # The adapter binary, not this chart. `/health` reports the build it is # actually running, which is the number to trust over this one. appVersion: "v1.9.0" diff --git a/charts/adapter-service/config/multi-adapter/provider-config.yaml b/charts/adapter-service/config/multi-adapter/provider-config.yaml index 2e9c0886..7d8ecb57 100644 --- a/charts/adapter-service/config/multi-adapter/provider-config.yaml +++ b/charts/adapter-service/config/multi-adapter/provider-config.yaml @@ -175,47 +175,19 @@ modules: - id: MandiPrice config: bindingKeys: "agmarknet|openagrinet:MandiPrice" - # NO CREDENTIAL, because this environment's agmarknet upstream is - # the benchmark mock rather than Agmarknet -- a static nginx with - # nothing to authenticate against. See the upstream block in - # infra-automation's registry-seed values. - # - # WHAT THIS REPLACED, and what to put back when the real upstream - # returns: - # - # authScheme: tokenQuery - # tokenUrl: the AGMARKNET token-url placeholder <- see below - # tokenUserField: access_name - # tokenUserEnv: AGMARKNET_ACCESS_NAME - # tokenSecretField: password - # tokenSecretEnv: AGMARKNET_PASSWORD - # tokenResponseField: token - # queryName: token - # tokenTtl: 10m - # - # Agmarknet issues short-lived tokens, so the provider exchanges a - # name and password for one and hangs it on the query. tokenTtl is - # an estimate -- the response carries no expiry -- and a 401 drops - # the held token. - # - # The placeholder is spelled out rather than written literally - # above, because the init container substitutes that marker - # ANYWHERE it appears -- including inside a comment. Left intact it - # would write the real token URL into a comment in the deployed - # ConfigMap, where nobody would think to look for it. - # - # DROPPED RATHER THAN REPRODUCED. tokenUrl is substituted from the - # provider-adapter-keys Secret, which is synced from OpenBao; - # pointing it at a mock would mean editing a - # shared secret store to run a benchmark. Serving a token endpoint - # from the mock instead would measure an exchange that answers the - # same string every time. - # - # IT ALSO KEEPS THE MEASUREMENT HONEST: a real token is cached for - # its TTL, so the exchange happens roughly once per ten minutes and - # contributes nothing to a per-request figure either way. agmarknet: - authScheme: none + authScheme: tokenQuery + # Substituted from the provider Secret (agmarknetTokenUrl) via + # keys.existingSecret.extraSubstitutions; the login is read from + # AGMARKNET_ACCESS_NAME and AGMARKNET_PASSWORD. + tokenUrl: "__AGMARKNET_TOKEN_URL__" + tokenUserField: access_name + tokenUserEnv: AGMARKNET_ACCESS_NAME + tokenSecretField: password + tokenSecretEnv: AGMARKNET_PASSWORD + tokenResponseField: token + queryName: token + tokenTtl: 10m - id: KnowledgeAdvisory config: diff --git a/charts/adapter-service/config/single-adapter/network-adapter-config.yaml b/charts/adapter-service/config/single-adapter/network-adapter-config.yaml index dfd31f05..109e7a55 100644 --- a/charts/adapter-service/config/single-adapter/network-adapter-config.yaml +++ b/charts/adapter-service/config/single-adapter/network-adapter-config.yaml @@ -243,7 +243,18 @@ modules: config: bindingKeys: "agmarknet|openagrinet:MandiPrice" agmarknet: - authScheme: none + authScheme: tokenQuery + # Substituted from the provider Secret (agmarknetTokenUrl) via + # adapterKeys.extraSubstitutions; the login is read from + # AGMARKNET_ACCESS_NAME and AGMARKNET_PASSWORD. + tokenUrl: "__AGMARKNET_TOKEN_URL__" + tokenUserField: access_name + tokenUserEnv: AGMARKNET_ACCESS_NAME + tokenSecretField: password + tokenSecretEnv: AGMARKNET_PASSWORD + tokenResponseField: token + queryName: token + tokenTtl: 10m - id: KnowledgeAdvisory config: From afd87dab52a715bbeae3c90e346aa6471c438768 Mon Sep 17 00:00:00 2001 From: KrutikaPhirangi <138781661+KrutikaPhirangi@users.noreply.github.com> Date: Wed, 28 Oct 2026 14:48:35 +0530 Subject: [PATCH 2/3] feat(clickstack): read the ClickHouse passwords from an existing Secret --- charts/clickstack/CHANGELOG.md | 14 ++++++++++++++ charts/clickstack/Chart.yaml | 2 +- charts/clickstack/README.md | 6 ++++-- charts/clickstack/data/users.xml | 8 ++++++++ charts/clickstack/templates/_helpers.tpl | 16 +++++++++++++++- .../templates/clickhouse-deployment.yaml | 13 +++++++++++++ .../clickstack/templates/hyperdx-deployment.yaml | 9 +++++++++ .../templates/otel-collector-deployment.yaml | 7 +++++++ charts/clickstack/templates/secrets.yaml | 2 +- charts/clickstack/values.yaml | 7 ++++++- 10 files changed, 78 insertions(+), 6 deletions(-) diff --git a/charts/clickstack/CHANGELOG.md b/charts/clickstack/CHANGELOG.md index 5d31e046..5ec498f5 100644 --- a/charts/clickstack/CHANGELOG.md +++ b/charts/clickstack/CHANGELOG.md @@ -10,6 +10,20 @@ else. The moment an OAN modification lands, this chart's version has to fork fro upstream's and follow [`CONVENTIONS.md`](../../CONVENTIONS.md) instead — record that switch in this file when it happens. +## [1.2.0] - 2026-10-28 + +The first OAN modification. From here this chart's `version` follows +[`CONVENTIONS.md`](../../CONVENTIONS.md) rather than upstream's; it is based on +upstream `hyperdx/clickstack` 1.1.1. + +### Added +- `clickhouse.config.users.existingSecret`: the name of a Secret with keys + `appUserPassword` and `otelUserPassword`. When set, ClickHouse reads both + users' passwords from the environment (`from_env` in `users.xml`), the OTel + collector's `CLICKHOUSE_PASSWORD` and HyperDX's default connection come from + the same Secret, and the chart renders no `-clickhouse-secrets` of + its own. Unset, the chart renders exactly as before. + ## [1.1.1] - 2026-09-09 Initial import [#4]. Upstream `hyperdx/clickstack` 1.1.1 (appVersion 2.8.0), diff --git a/charts/clickstack/Chart.yaml b/charts/clickstack/Chart.yaml index b705a21f..cdc45077 100644 --- a/charts/clickstack/Chart.yaml +++ b/charts/clickstack/Chart.yaml @@ -15,4 +15,4 @@ sources: - https://github.com/hyperdxio/hyperdx - https://github.com/hyperdxio/helm-charts type: application -version: 1.1.1 +version: 1.2.0 diff --git a/charts/clickstack/README.md b/charts/clickstack/README.md index 061c74e2..348a5644 100644 --- a/charts/clickstack/README.md +++ b/charts/clickstack/README.md @@ -81,8 +81,10 @@ hiding them: `clickhouse.config.users.appUserPassword: hyperdx`, `otelUserPassword: otelcollectorpass`, and a placeholder `hyperdx.apiKey`. Every one of those must be overridden per environment. No repo chart is - supposed to render a Secret at all; closing this properly means moving to - `hyperdx.useExistingConfigSecret` and externally created Secrets. + supposed to render a Secret at all. The ClickHouse passwords are closed: + set `clickhouse.config.users.existingSecret` to a Secret holding + `appUserPassword` and `otelUserPassword` and the chart reads them from it + and renders no ClickHouse Secret. The API key is still open. - **No `common` dependency**, so no `app.kubernetes.io/part-of: oan` label and none of the shared helpers. - **No resource requests or limits by default.** `clickhouse.resources`, diff --git a/charts/clickstack/data/users.xml b/charts/clickstack/data/users.xml index 0beb0bcd..9062ab66 100644 --- a/charts/clickstack/data/users.xml +++ b/charts/clickstack/data/users.xml @@ -23,7 +23,11 @@ default + {{- if .Values.clickhouse.config.users.existingSecret }} + + {{- else }} {{ .Values.clickhouse.config.users.appUserPassword }} + {{- end }} {{- if .Values.clickhouse.config.clusterCidrs }} {{- range .Values.clickhouse.config.clusterCidrs }} @@ -43,7 +47,11 @@ <{{ .Values.otel.clickhouseUser | default .Values.clickhouse.config.users.otelUserName }}> + {{- if .Values.clickhouse.config.users.existingSecret }} + + {{- else }} {{ .Values.otel.clickhousePassword | default .Values.clickhouse.config.users.otelUserPassword }} + {{- end }} {{- if .Values.clickhouse.config.clusterCidrs }} {{- range .Values.clickhouse.config.clusterCidrs }} diff --git a/charts/clickstack/templates/_helpers.tpl b/charts/clickstack/templates/_helpers.tpl index 82537dcd..a9672d0c 100644 --- a/charts/clickstack/templates/_helpers.tpl +++ b/charts/clickstack/templates/_helpers.tpl @@ -46,4 +46,18 @@ Selector labels {{- define "clickstack.selectorLabels" -}} app.kubernetes.io/name: {{ include "clickstack.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} \ No newline at end of file +{{- end }} + +{{/* +The ClickHouse app user's password as it appears in HyperDX's connection list: +the plain value, or, with clickhouse.config.users.existingSecret, a reference +Kubernetes expands from the CLICKHOUSE_APP_PASSWORD env var the HyperDX +container defines first. +*/}} +{{- define "clickstack.clickhouseAppPassword" -}} +{{- if .Values.clickhouse.config.users.existingSecret -}} +$(CLICKHOUSE_APP_PASSWORD) +{{- else -}} +{{ .Values.clickhouse.config.users.appUserPassword }} +{{- end -}} +{{- end }} diff --git a/charts/clickstack/templates/clickhouse-deployment.yaml b/charts/clickstack/templates/clickhouse-deployment.yaml index 75403040..3068e0a6 100644 --- a/charts/clickstack/templates/clickhouse-deployment.yaml +++ b/charts/clickstack/templates/clickhouse-deployment.yaml @@ -43,6 +43,19 @@ spec: env: - name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT value: "1" + {{- with .Values.clickhouse.config.users.existingSecret }} + # users.xml reads both passwords with from_env. + - name: CLICKHOUSE_APP_PASSWORD + valueFrom: + secretKeyRef: + name: {{ . }} + key: appUserPassword + - name: CLICKHOUSE_OTEL_PASSWORD + valueFrom: + secretKeyRef: + name: {{ . }} + key: otelUserPassword + {{- end }} {{- if .Values.clickhouse.resources }} resources: {{- toYaml .Values.clickhouse.resources | nindent 12 }} diff --git a/charts/clickstack/templates/hyperdx-deployment.yaml b/charts/clickstack/templates/hyperdx-deployment.yaml index caafd3dd..4620cac6 100644 --- a/charts/clickstack/templates/hyperdx-deployment.yaml +++ b/charts/clickstack/templates/hyperdx-deployment.yaml @@ -98,6 +98,15 @@ spec: secretKeyRef: name: {{ include "clickstack.fullname" . }}-app-secrets key: api-key + {{- with .Values.clickhouse.config.users.existingSecret }} + # Before DEFAULT_CONNECTIONS: Kubernetes expands $(CLICKHOUSE_APP_PASSWORD) + # there only from variables defined earlier in this list. + - name: CLICKHOUSE_APP_PASSWORD + valueFrom: + secretKeyRef: + name: {{ . }} + key: appUserPassword + {{- end }} {{- if .Values.hyperdx.useExistingConfigSecret }} - name: DEFAULT_CONNECTIONS valueFrom: diff --git a/charts/clickstack/templates/otel-collector-deployment.yaml b/charts/clickstack/templates/otel-collector-deployment.yaml index 95b066f2..6ef4a558 100644 --- a/charts/clickstack/templates/otel-collector-deployment.yaml +++ b/charts/clickstack/templates/otel-collector-deployment.yaml @@ -99,7 +99,14 @@ spec: - name: CLICKHOUSE_USER value: {{ .Values.otel.clickhouseUser | default .Values.clickhouse.config.users.otelUserName }} - name: CLICKHOUSE_PASSWORD + {{- if .Values.clickhouse.config.users.existingSecret }} + valueFrom: + secretKeyRef: + name: {{ .Values.clickhouse.config.users.existingSecret }} + key: otelUserPassword + {{- else }} value: {{ .Values.otel.clickhousePassword | default .Values.clickhouse.config.users.otelUserPassword }} + {{- end }} {{- if .Values.otel.customConfig }} - name: CUSTOM_OTELCOL_CONFIG_FILE value: /etc/otelcol-contrib/custom.config.yaml diff --git a/charts/clickstack/templates/secrets.yaml b/charts/clickstack/templates/secrets.yaml index 6550b594..1a9589eb 100644 --- a/charts/clickstack/templates/secrets.yaml +++ b/charts/clickstack/templates/secrets.yaml @@ -7,7 +7,7 @@ metadata: type: Opaque data: api-key: {{ .Values.hyperdx.apiKey | b64enc }} -{{- if .Values.clickhouse.enabled }} +{{- if and .Values.clickhouse.enabled (not .Values.clickhouse.config.users.existingSecret) }} --- apiVersion: v1 kind: Secret diff --git a/charts/clickstack/values.yaml b/charts/clickstack/values.yaml index 1d62db71..aeb316c6 100644 --- a/charts/clickstack/values.yaml +++ b/charts/clickstack/values.yaml @@ -96,7 +96,7 @@ hyperdx: "host": "http://{{ include "clickstack.fullname" . }}-clickhouse:8123", "port": 8123, "username": "app", - "password": "{{ .Values.clickhouse.config.users.appUserPassword }}" + "password": "{{ include "clickstack.clickhouseAppPassword" . }}" } ] @@ -355,6 +355,11 @@ clickhouse: users: appUserPassword: "hyperdx" otelUserPassword: "otelcollectorpass" + # Name of an existing Secret with keys `appUserPassword` and + # `otelUserPassword`. When set, both values above are ignored: ClickHouse, + # the OTel collector and HyperDX read the passwords from the Secret, and + # the chart renders no -clickhouse-secrets of its own. + existingSecret: "" otelUserName: "otelcollector" # Network CIDRs for Kubernetes cluster access control # These CIDRs ensure ClickHouse connections are locked down to intra-cluster only From 0e87bcd98d132c421664683b65fcf126f399d862 Mon Sep 17 00:00:00 2001 From: KrutikaPhirangi <138781661+KrutikaPhirangi@users.noreply.github.com> Date: Wed, 28 Oct 2026 16:21:20 +0530 Subject: [PATCH 3/3] feat(adapter-service): opt-in public /publish in single-adapter mode --- charts/adapter-service/CHANGELOG.md | 6 ++++++ charts/adapter-service/templates/ingress.yaml | 4 ++-- charts/adapter-service/values.yaml | 5 +++++ 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/charts/adapter-service/CHANGELOG.md b/charts/adapter-service/CHANGELOG.md index bd905524..817eaba0 100644 --- a/charts/adapter-service/CHANGELOG.md +++ b/charts/adapter-service/CHANGELOG.md @@ -7,6 +7,12 @@ and this chart adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.h ## [0.8.0] - 2026-10-28 +### Added +- `ingress.allowPublicPublish` (default `false`): in single-adapter mode, lets + `/publish` be an ingress path. The publish module signs as the provider + without authenticating its caller, so this is for throwaway environments + only. `/` and `/_internal*` stay refused. + ### Changed - **BREAKING.** Mandi prices call the real Agmarknet again: `agmarknet` is back on `authScheme: tokenQuery` in both modes, in place of the no-auth setting diff --git a/charts/adapter-service/templates/ingress.yaml b/charts/adapter-service/templates/ingress.yaml index 18339e1a..31686223 100644 --- a/charts/adapter-service/templates/ingress.yaml +++ b/charts/adapter-service/templates/ingress.yaml @@ -16,8 +16,8 @@ {{- if not (has $pt (list "Prefix" "Exact")) }} {{- fail (printf "%s: ingress path %q has pathType %s, which is not allowed in the single deployment mode. Use Prefix or Exact." $.Chart.Name $p $pt) }} {{- end }} -{{- if or (not (regexMatch "^/[A-Za-z0-9_.-]+$" $p)) (hasPrefix "/_internal" $p) (eq $p "/publish") }} -{{- fail (printf "%s: ingress path %q is not allowed in the single deployment mode. Allowed: one literal segment, / (e.g. /discover, /select). /, /publish and /_internal* are never public." $.Chart.Name $p) }} +{{- if or (not (regexMatch "^/[A-Za-z0-9_.-]+$" $p)) (hasPrefix "/_internal" $p) (and (eq $p "/publish") (not $.Values.ingress.allowPublicPublish)) }} +{{- fail (printf "%s: ingress path %q is not allowed in the single deployment mode. Allowed: one literal segment, / (e.g. /discover, /select). / and /_internal* are never public; /publish only with ingress.allowPublicPublish." $.Chart.Name $p) }} {{- end }} {{- end }} {{- end }} diff --git a/charts/adapter-service/values.yaml b/charts/adapter-service/values.yaml index a00d2404..52571f4a 100644 --- a/charts/adapter-service/values.yaml +++ b/charts/adapter-service/values.yaml @@ -298,6 +298,11 @@ ingress: annotations: {} hosts: [] tls: [] + # Single-adapter mode only: lets /publish be an ingress path. Off by default, + # and for a throwaway environment only. The publish module signs as the + # provider without checking who calls it, so a public /publish lets anyone + # publish catalogues under the provider's name. + allowPublicPublish: false # --------------------------------------------------------------------------- # Wait for the upstreams before starting.