fix: dont template oathkeeper config by default (#709)

hacks/values/oathkeeper.yaml

@@ -23,9 +23,7 @@ ingress:
         name: myservice
         port:
           number: 80
-    annotations:
-      kubernetes.io/ingress.class: nginx
-      kubernetes.io/tls-acme: "true"
+    annotations: {}
   api:
     enabled: true
 priorityClassName: "system-cluster-critical"

helm/charts/oathkeeper/README.md

@@ -83,6 +83,7 @@ A Helm chart for deploying ORY Oathkeeper in Kubernetes
 | nameOverride | string | `""` | Chart name override |
 | oathkeeper.accessRules | string | `""` | If set, uses the given access rules. |
 | oathkeeper.config | object | `{"access_rules":{"repositories":["file:///etc/rules/access-rules.json"]},"serve":{"api":{"port":4456},"prometheus":{"port":9000},"proxy":{"port":4455}}}` | The ORY Oathkeeper configuration. For a full list of available settings, check:   https://github.com/ory/oathkeeper/blob/master/docs/config.yaml |
+| oathkeeper.helmTemplatedConfigEnabled | bool | `false` | Runs the `tpl` function on the config object. Warrning! This may break configuration settings that use go templates, like https://github.com/ory/k8s/issues/707 |
 | oathkeeper.managedAccessRules | bool | `true` | If you enable maester, the following value should be set to "false" to avoid overwriting the rules generated by the CDRs. Additionally, the value "accessRules" shouldn't be used as it will have no effect once "managedAccessRules" is disabled. |
 | oathkeeper.mutatorIdTokenJWKs | string | `""` | If set, uses the given JSON Web Key Set as the signing key for the ID Token Mutator. Requires secret.enabled to be set `true`. |
 | pdb.enabled | bool | `false` |  |

helm/charts/oathkeeper/templates/_helpers.tpl

@@ -30,7 +30,11 @@ Generate the configmap data, redacting secrets
 */}}
 {{- define "oathkeeper.configmap" -}}
 {{- $config := .Values.oathkeeper.config -}}
+{{-  if .Values.oathkeeper.helmTemplatedConfigEnabled -}}
 {{- tpl (toYaml $config) . -}}
+{{- else -}}
+{{- toYaml $config -}}
+{{- end -}}
 {{- end -}}
 
 {{/*

helm/charts/oathkeeper/values.yaml

@@ -182,6 +182,9 @@ ingress:
 
 ## -- Configure ORY Oathkeeper itself
 oathkeeper:
+  # -- Runs the `tpl` function on the config object.
+  # Warrning! This may break configuration settings that use go templates, like https://github.com/ory/k8s/issues/707
+  helmTemplatedConfigEnabled: false
   # -- The ORY Oathkeeper configuration. For a full list of available settings, check:
   #   https://github.com/ory/oathkeeper/blob/master/docs/config.yaml
   config: