Move copilotStorageSecretRef to configuration.co-pilot.storageSecretRef

The value configures co-pilot, not the deployment's object store, so it sat
under the wrong section and had to carry a copilot prefix to say so. Under the
co-pilot section it is just storageSecretRef, the same way the Go field became
StorageConfigSecretName once it lived in FlyteCoPilotConfig.

The section name has a hyphen, so reads go through a helper rather than
repeating the index dance at four call sites.

Renders are byte-identical for every valid combination, and the gate matrix
is unchanged: a supplied ref still suppresses the chart's own Secret, and the
install still fails when combined with external configuration.

Signed-off-by: Kevin Su <pingsutw@apache.org>

Author: pingsutw

charts/flyte-binary/README.md

@@ -19,6 +19,7 @@ Chart for basic single Flyte executable deployment
 | configuration.annotations | object | `{}` |  |
 | configuration.co-pilot.image.repository | string | `"cr.flyte.org/flyteorg/flyte-binary-v2"` |  |
 | configuration.co-pilot.image.tag | string | `"latest"` |  |
+| configuration.co-pilot.storageSecretRef | string | `""` |  |
 | configuration.connectorService.defaultConnector.defaultTimeout | string | `"10s"` |  |
 | configuration.connectorService.defaultConnector.endpoint | string | `"k8s://flyteconnector.flyte:8000"` |  |
 | configuration.connectorService.defaultConnector.insecure | bool | `true` |  |
@@ -51,7 +52,6 @@ Chart for basic single Flyte executable deployment
 | configuration.logging.plugins.kubernetes.templateUri | string | `""` |  |
 | configuration.logging.plugins.stackdriver.enabled | bool | `false` |  |
 | configuration.logging.plugins.stackdriver.templateUri | string | `""` |  |
-| configuration.storage.copilotStorageSecretRef | string | `""` |  |
 | configuration.storage.metadataContainer | string | `"my-organization-flyte-container"` |  |
 | configuration.storage.provider | string | `"s3"` |  |
 | configuration.storage.providerConfig.azure.account | string | `"storage-account-name"` |  |

charts/flyte-binary/templates/_helpers.tpl

@@ -110,13 +110,22 @@ Flag to use external configuration.
 {{- or .Values.configuration.externalConfigMap .Values.configuration.externalSecretRef -}}
 {{- end -}}
 
+{{/*
+The Secret an operator supplied for co-pilot, if any. Its own key rather than a field on
+configuration.storage, since it configures co-pilot rather than the deployment's storage,
+and the section name means it needs the index dance.
+*/}}
+{{- define "flyte-binary.configuration.copilotStorageSecretRef" -}}
+{{- (index .Values.configuration "co-pilot").storageSecretRef -}}
+{{- end -}}
+
 {{/*
 Fail on value combinations the chart would otherwise ignore in silence. Called from
 deployment.yaml, which renders whatever else is switched off.
 */}}
 {{- define "flyte-binary.validateValues" -}}
-{{- if and .Values.configuration.storage.copilotStorageSecretRef (include "flyte-binary.configuration.externalConfiguration" .) -}}
-{{- fail "configuration.storage.copilotStorageSecretRef has no effect while configuration.externalConfigMap or configuration.externalSecretRef is set: the chart renders no ConfigMap, and that is what would carry plugins.k8s.co-pilot.storage-config-secret-name. Set that key in your own configuration instead, then unset copilotStorageSecretRef." -}}
+{{- if and (include "flyte-binary.configuration.copilotStorageSecretRef" .) (include "flyte-binary.configuration.externalConfiguration" .) -}}
+{{- fail "configuration.co-pilot.storageSecretRef has no effect while configuration.externalConfigMap or configuration.externalSecretRef is set: the chart renders no ConfigMap, and that is what would carry plugins.k8s.co-pilot.storage-config-secret-name. Set that key in your own configuration instead, then unset storageSecretRef." -}}
 {{- end -}}
 {{- end -}}
 
@@ -221,12 +230,12 @@ it into the Secret, so err towards the Secret rather than towards the command li
 S3 with only secretKeyPath is the one credential-bearing case that stays on the command
 line: the path names a file living solely in this deployment's container, so the chart
 cannot read it to render a Secret. Those deployments supply their own via
-storage.copilotStorageSecretRef.
+co-pilot.storageSecretRef.
 */}}
 {{- define "flyte-binary.configuration.copilotStorageFromSecret" -}}
 {{- $root := . -}}
 {{- with .Values.configuration.storage -}}
-{{- if .copilotStorageSecretRef -}}
+{{- if include "flyte-binary.configuration.copilotStorageSecretRef" $root -}}
 true
 {{- else if and (eq "s3" .provider) (eq "accesskey" .providerConfig.s3.authType) .providerConfig.s3.secretKey -}}
 true

charts/flyte-binary/templates/config-secret.yaml

@@ -43,7 +43,7 @@ stringData:
           {{- end }}
   {{- end }}
   {{- end }}
-{{- if and (include "flyte-binary.configuration.copilotStorageFromSecret" .) (not .Values.configuration.storage.copilotStorageSecretRef) }}
+{{- if and (include "flyte-binary.configuration.copilotStorageFromSecret" .) (not (include "flyte-binary.configuration.copilotStorageSecretRef" .)) }}
 ---
 {{/*
 Co-pilot's storage configuration. Separate from the configuration Secret above because that

charts/flyte-binary/templates/configmap.yaml

@@ -50,7 +50,7 @@ data:
           # Co-pilot reads its storage configuration from this Secret instead of its command
           # line, keeping the credentials out of every task's pod spec. Omitted for the
           # deployments that cannot use it; see copilotStorageFromSecret.
-          storage-config-secret-name: {{ .Values.configuration.storage.copilotStorageSecretRef | default (include "flyte-binary.configuration.copilotStorageSecretName" .) | quote }}
+          storage-config-secret-name: {{ include "flyte-binary.configuration.copilotStorageSecretRef" . | default (include "flyte-binary.configuration.copilotStorageSecretName" .) | quote }}
           {{- end }}
         # Env vars injected into every task pod, so it can reach the control plane
         # to enqueue child actions and watch their state.

charts/flyte-binary/values.yaml

@@ -91,16 +91,6 @@ configuration:
   storage:
     # metadataContainer Bucket to store Flyte metadata
     metadataContainer: "my-organization-flyte-container"
-    # copilotStorageSecretRef Name of an existing Secret holding co-pilot's complete storage
-    # configuration — stow settings and credentials — in one or more .yaml keys. The whole
-    # Secret is mounted into the co-pilot containers and every .yaml key in it is read, so
-    # it must hold nothing else. Leave empty to have the chart render that Secret itself;
-    # set it when using s3.secretKeyPath, which names a file that exists only in this
-    # deployment's container and so cannot be read from a task pod.
-    # Cannot be combined with externalConfigMap or externalSecretRef: the chart renders no
-    # ConfigMap to carry the co-pilot key then, so set that key in your own configuration
-    # instead. The chart fails the install rather than ignoring this value in silence.
-    copilotStorageSecretRef: ""
     # provider Object store provider (Supported values: s3, gcs)
     provider: s3
     # providerConfig Additional object store provider-specific configuration
@@ -170,6 +160,16 @@ configuration:
       repository: cr.flyte.org/flyteorg/flyte-binary-v2  # FLYTE_IMAGE
       # tag CoPilot sidecar image tag
       tag: latest  # FLYTE_TAG
+    # storageSecretRef Name of an existing Secret holding co-pilot's complete storage
+    # configuration — stow settings and credentials — in one or more .yaml keys. The whole
+    # Secret is mounted into the co-pilot containers and every .yaml key in it is read, so
+    # it must hold nothing else. Leave empty to have the chart render that Secret itself;
+    # set it when using storage.providerConfig.s3.secretKeyPath, which names a file that
+    # exists only in this deployment's container and so cannot be read from a task pod.
+    # Cannot be combined with externalConfigMap or externalSecretRef: the chart renders no
+    # ConfigMap to carry the co-pilot key then, so set that key in your own configuration
+    # instead. The chart fails the install rather than ignoring this value in silence.
+    storageSecretRef: ""
   # connectorService Flyte Connector configuration
   connectorService:
     defaultConnector: