From 54e499b2337d1db3bb729ea3ad9ca4b1cfb43f75 Mon Sep 17 00:00:00 2001 From: Anthony LC Date: Tue, 4 Aug 2026 18:27:13 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A5(helm)=20remove=20occurences=20of?= =?UTF-8?q?=20Y=5FPROVIDER=5FAPI=5FKEY?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Y_PROVIDER_API_KEY is no longer used in the codebase, so we can remove it from the helm chart and the documentation. We adapt the documentation to use the new JWT conversion mechanism instead. --- documentation/examples/helm/impress.values.yaml | 1 - documentation/format_conversion.md | 11 +++++++---- src/helm/env.d/dev/values.impress.yaml.gotmpl | 1 - src/helm/env.d/feature/values.impress.yaml.gotmpl | 1 - 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/documentation/examples/helm/impress.values.yaml b/documentation/examples/helm/impress.values.yaml index ba965ade5..05c8c2fed 100644 --- a/documentation/examples/helm/impress.values.yaml +++ b/documentation/examples/helm/impress.values.yaml @@ -135,7 +135,6 @@ yProvider: COLLABORATION_LOGGING: true COLLABORATION_SERVER_ORIGIN: https://docs.127.0.0.1.nip.io COLLABORATION_SERVER_SECRET: my-secret - Y_PROVIDER_API_KEY: my-secret ingress: enabled: true diff --git a/documentation/format_conversion.md b/documentation/format_conversion.md index 030e498e9..828b82b1e 100644 --- a/documentation/format_conversion.md +++ b/documentation/format_conversion.md @@ -8,21 +8,24 @@ To make it work, some configuration should be made and another service enabled i The first configuration to make is related to converting a docs in multiple format. This will be used by the `formatted-content` endpoint (`/api/v1.0/documents/{document_id}/formatted-content/?content_format=(json|html|markdown)`). This service is also used by the `create-for-owner` endpoint and in the import of markdown file. -To configure it, use this environment variables in the Django service: +To configure it, use this environment variable in the Django service: ```yaml Y_PROVIDER_API_BASE_URL: http://{y-provider-service}:443/api/ -Y_PROVIDER_API_KEY: a-shared-private-key-with-y-provider ``` For the `Y_PROVIDER_API_BASE_URL`, it can be the FQDN of your docs instance if you have configured a reverse proxy in front of the y-provider service and created a route to the `/api` for this service. It can also be the internal `y-provider` service url if Django can access it directly. In the case you deploy in a Kubernetes cluster, you can use the `y-provider` service url. We prefer the usage of internal url. -You also have to add an environment variable in your `y-provider` configuration, to share the same `Y_PROVIDER_API_KEY`: +Requests to the y-provider service are authenticated with a short-lived admin JWT that Django signs itself (see `core.services.jwt_services.JWTService`), instead of a shared secret. The y-provider service verifies the signature against the public key Django publishes on its JWKS endpoint (`/api/v1.0/jwks`), so there is nothing to configure on the Django side beyond `JWT_PRIVATE_KEY` (see the JWT section of [env.md](env.md)). + +On the `y-provider` side, point it at the Django backend so it can fetch the JWKS: ```yaml -Y_PROVIDER_API_KEY: a-shared-private-key-with-y-provider +COLLABORATION_BACKEND_BASE_URL: http://{django-service}:8000 ``` +The JWKS url defaults to `{COLLABORATION_BACKEND_BASE_URL}/api/v1.0/jwks`; override it with `JWKS_URL` if Django is not reachable at that base url from the y-provider service. + ### Splitting conversion service The conversion service is present in the `y-provider` server. The same server used to manage websockets. You can split in one side the websocket server and in an other side the converter service. diff --git a/src/helm/env.d/dev/values.impress.yaml.gotmpl b/src/helm/env.d/dev/values.impress.yaml.gotmpl index 85c319785..a35727a25 100644 --- a/src/helm/env.d/dev/values.impress.yaml.gotmpl +++ b/src/helm/env.d/dev/values.impress.yaml.gotmpl @@ -176,7 +176,6 @@ yProvider: COLLABORATION_LOGGING: true COLLABORATION_SERVER_ORIGIN: https://docs.127.0.0.1.nip.io COLLABORATION_SERVER_SECRET: my-secret - Y_PROVIDER_API_KEY: my-secret NODE_EXTRA_CA_CERTS: /cert/cacert.pem # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false diff --git a/src/helm/env.d/feature/values.impress.yaml.gotmpl b/src/helm/env.d/feature/values.impress.yaml.gotmpl index 3da426486..884fee093 100644 --- a/src/helm/env.d/feature/values.impress.yaml.gotmpl +++ b/src/helm/env.d/feature/values.impress.yaml.gotmpl @@ -154,7 +154,6 @@ yProvider: COLLABORATION_LOGGING: true COLLABORATION_SERVER_ORIGIN: https://{{ .Values.feature }}-docs.{{ .Values.domain }} COLLABORATION_SERVER_SECRET: my-secret - Y_PROVIDER_API_KEY: my-secret NODE_OPTIONS: "--max-old-space-size=1024" docSpec: