feat(helmfile): Add template support for external secrets for mariadb

Signed-off-by: Axel Lender <lender@b1-systems.de>

CHANGELOG.md

@@ -1,16 +1,3 @@
-## [1.4.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.0...v1.4.1) (2025-06-02)
-
-
-### Bug Fixes
-
-* **nextcloud:** Update NC CE to 30.0.10 ([785be8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/785be8b6621305e79acca62250720028b9ca7a30))
-* **nextcloud:** Update Nextcloud incl. apps to 30.0.10 ([559fbf6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/559fbf6801fc785f26f9e6287e0730f86b459a01))
-* **nubus:** Use `.Values.theme.texts.productName` for Keycloak's `loginTitle` instead of static product name string ([d1a1e5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d1a1e5dc29ca21fd822abd127406f6859603b9c7))
-* **open-xchange:** Re-adding `com.openexchange.oauth.provider.*` to fix central contacts feature ([561e44f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/561e44fd4cc42089954868da60edbd210b9a2608))
-* **open-xchange:** Set `com.openexchange.hostname` to get working links in outgoing system mails (e.g. task assignments) ([0d61687](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0d616871e3f5114ec429714658500c09af842fe6))
-* **postfix:** Require TLSv1.3 ([3b3d8ac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3b3d8aca54bdaea055289c993e3f158d93864223))
-* **requirements.md:** Helm 3.18.x is not supported due to upstream bug ([1ea9cae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ea9cae1ce46f864dc03d94c1a72956c5f5ba9a9))
-
 # [1.4.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.2...v1.4.0) (2025-05-20)
 
 

docs/enhanced-configuration/idp-federation.md

@@ -22,7 +22,7 @@ SPDX-License-Identifier: Apache-2.0
 
 Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on (SSO) to internal or external web applications.
 
-This document helps in setting up your organization's IdP and openDesk to enable IdP federation.
+This document explains how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk SSO based on your organization's login.
 
 # References
 
@@ -33,7 +33,7 @@ We would like to list successful IdP federation scenarios:
 | [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
 | [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |
 
-> If you have successfully federated using another External IdP, please let us know so we can update the list above.
+>If you have successfully federated using another External IdP, please let us know so we can update the list above.
 
 # Prerequisites
 
@@ -70,23 +70,6 @@ This document focuses on the OIDC federation between an external IdP and the ope
 
 # Example configuration
 
-The following section explains how to configure the IdP federation manually in an example upstream IdP and in openDesk.
-
-With openDesk 1.4.0 IdP federation has to be enabled as part of the deployment using the `functional.authentication.ssoFederation` section, see [`functional.yaml.gotmpl`](../../helmfile/environments/default/functional.yaml.gotmpl) for reference.
-
-You can use the description below to configure and test the federation that can be exported and used as part of the deployment afterwards, e.g. with the following commands from within the Keycloak Pod:
-
-```shell
-# Set the variables according to your deployment first, below are just example values.
-export FEDERATION_IDP_ALIAS=sso-federation-idp
-export NAMESPACE=example_namespace
-export CLUSTER_NETWORKING_DOMAIN=svc.cluster.local
-# Authenticate with Keycloak
-/opt/keycloak/bin/kcadm.sh config credentials --server http://ums-keycloak.${NAMESPACE}.${CLUSTER_NETWORKING_DOMAIN}:8080 --realm master --user ${KEYCLOAK_ADMIN} --password ${KEYCLOAK_ADMIN_PASSWORD}
-# Request details of IdP configuration
-/opt/keycloak/bin/kcadm.sh get identity-provider/instances/${FEDERATION_IDP_ALIAS} -r opendesk
-```
-
 ## Versions
 
 The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version, but created a separate realm for proper configuration separation.

docs/migrations.md

@@ -11,7 +11,6 @@ SPDX-License-Identifier: Apache-2.0
 * [Manual checks/actions](#manual-checksactions)
   * [v1.4.0+](#v140)
     * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
-      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
       * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
   * [v1.2.0+](#v120)
     * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
@@ -105,12 +104,6 @@ If you would like more details about the automated migrations, please read secti
 
 ### Pre-upgrade to v1.4.0+
 
-#### Helmfile new feature: `functional.authentication.ssoFederation`
-
-**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
-
-Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
-
 #### Helmfile cleanup: `global.additionalMailDomains` as list
 
 **Target group:** Installations that have set `global.additionalMailDomains`.

docs/requirements.md

@@ -29,7 +29,7 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
-- [Helm](https://helm.sh/) >= v3.17.3 && < 3.18.x[^3]
+- [Helm](https://helm.sh/) >= v3.17.3
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
 - [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
 - Volume provisioner supporting RWO (read-write-once)[^1]
@@ -140,5 +140,3 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare
 [^1]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
 
 [^2]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
-
-[^3]: Due to a [bug in Helm 3.18.x](https://github.com/helm/helm/issues/30890), fixed versions are likely to be supported again.

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -200,9 +200,9 @@ keycloak:
     login:
       messages:
         de:
-          loginTitle: "Anmeldung bei {{ .Values.theme.texts.productName }}"
+          loginTitle: "Anmeldung bei opendesk"
         en:
-          loginTitle: "Sign in to {{ .Values.theme.texts.productName }}"
+          loginTitle: "Sign in to opendesk"
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak"
     {{- with .Values.annotations.nubusKeycloak.pod }}

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -291,12 +291,7 @@ appsuite:
         open-xchange-documents-backend: "disabled"
         open-xchange-documents-monitoring: "disabled"
         open-xchange-documents-templates: "disabled"
-        # Required for the central contacts integration
-        open-xchange-oauth-provider: "enabled"
-        # Needed to set com.openexchange.hostname
-        open-xchange-hostname-config-cascade: "enabled"
     properties:
-      com.openexchange.hostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
       com.openexchange.UIWebPath: "/appsuite/"
       com.openexchange.showAdmin: "false"
       # PDF Export
@@ -328,15 +323,6 @@ appsuite:
       com.openexchange.oidc.userLookupNamePart: "full"
       com.openexchange.oidc.enablePasswordGrant: "true"
       com.openexchange.oidc.passwordGrantUserNamePart: "local-part"
-      # OAUTH
-      com.openexchange.oauth.provider.enabled: "true"
-      com.openexchange.oauth.provider.allowedIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-      com.openexchange.oauth.provider.contextLookupClaim: "context"
-      com.openexchange.oauth.provider.contextLookupNamePart: "full"
-      com.openexchange.oauth.provider.jwt.jwksUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
-      com.openexchange.oauth.provider.mode: "expect_jwt"
-      com.openexchange.oauth.provider.userLookupNamePart: "full"
-      com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
       # MAIL
       com.openexchange.mail.authType: "xoauth2"
       com.openexchange.mail.loginSource: "mail"

helmfile/apps/services-external/values-mariadb.yaml.gotmpl

@@ -72,6 +72,9 @@ job:
 mariadb:
   rootPassword:
     value: {{ .Values.secrets.mariadb.rootPassword | quote }}
+    existingSecret:
+      name: {{ .Values.external_secrets.mariadb.rootPassword.name | quote }}
+      key: {{ .Values.external_secrets.mariadb.rootPassword.key | quote }}
 
 persistence:
   size: {{ .Values.persistence.storages.mariadb.size | quote }}

helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl

@@ -13,7 +13,7 @@ images:
   nextcloud:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "30.0.10@sha256:a63374dd44d3c6a8873da31fe0554b97fb29993a4cf18b9dd6a304b577f2f2b8"
+    tag: "1.2.0@sha256:ddd2bec74a22a713967f62fcdcf18fa8d53d730c1db296d570143754c93d20a5"
   openxchangeCoreMW:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/middleware-public-sector-pro"

helmfile/environments/default/external_secrets.yaml.gotmpl

@@ -0,0 +1,11 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+external_secrets:
+  mariadb:
+    rootPassword:
+      name: ~
+      key: ~
+...

helmfile/environments/default/global.generated.yaml.gotmpl

@@ -3,5 +3,5 @@
 ---
 global:
   systemInformation:
-    releaseVersion: "v1.4.1"
+    releaseVersion: "v1.4.0"
 ...

helmfile/environments/default/images.yaml.gotmpl

@@ -320,7 +320,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "30.0.10@sha256:a022c6279072eb45d14cab29296860a15ad0d5801f50a56928334eb99bae50d0"
+    tag: "2.6.0@sha256:47b9d01b70f72a717ce89a80bf36a2c01653c6a7335dd3287f7cab1555aa8864"
   nextcloudExporter:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"