Make platform cron mount OIDC private key, required from platform v26.1

Author: bebosudo

charts/platform/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this chart will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.30.0] - 2026-04-08
+
+### Added
+
+- Mount OIDC private key secret (`connect-cert-volume` at `/data/certs`) on the cron deployment, matching the backend deployment
+
+### Changed
+
+- `TOWER_OIDC_PEM_PATH` moved to the shared backend/cron configmap and is now always set (previously backend-only and only when `studios.enabled=true`); required from Platform v26.1 onwards
+- `connect-cert-volume` and `TOWER_OIDC_REGISTRATION_INITIAL_ACCESS_TOKEN` are now always present on the backend deployment (previously only when `studios.enabled=true`); required from Platform v26.1 onwards
+
 ## [0.29.8] - 2026-04-08
 
 ### Added

charts/platform/Chart.yaml

@@ -37,7 +37,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.29.8
+version: 0.30.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/platform/README.md

@@ -2,7 +2,7 @@
 
 A Helm chart to deploy Seqera Platform (also referred to as Tower) on Kubernetes.
 
-![Version: 0.29.7](https://img.shields.io/badge/Version-0.29.7-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v25.3.4](https://img.shields.io/badge/AppVersion-v25.3.4-informational?style=flat-square)
+![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v25.3.4](https://img.shields.io/badge/AppVersion-v25.3.4-informational?style=flat-square)
 
 > [!WARNING]
 > This chart is currently still in development and breaking changes are expected.
@@ -41,7 +41,7 @@ To install the chart with the release name `my-release`:
 
 ```console
 helm install my-release oci://public.cr.seqera.io/charts/platform \
-  --version 0.29.7 \
+  --version 0.30.0 \
   --namespace my-namespace \
   --create-namespace
 ```

charts/platform/templates/configmap.yaml

@@ -38,7 +38,6 @@ data:
 {{- end }}
 {{- if .Values.studios.enabled }}
   TOWER_DATA_STUDIO_CONNECT_URL: {{ tpl .Values.global.studiosConnectionUrl . | quote }}
-  TOWER_OIDC_PEM_PATH: /data/certs/oidc.pem
   TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REGISTRY: {{ .Values.platform.studios.customImageRegistry | quote }}
   TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REPOSITORY: {{ .Values.platform.studios.customImageRepository | quote }}
 {{- include "platform.studios.toolsEnvVars" . | nindent 2 }}
@@ -81,6 +80,8 @@ data:
   TOWER_DB_MAX_POOL_SIZE: {{ .Values.platformDatabase.maxPoolSize | toString | quote }}
   TOWER_DB_MIN_POOL_SIZE: {{ .Values.platformDatabase.minPoolSize | toString | quote }}
 
+  TOWER_OIDC_PEM_PATH: /data/certs/oidc.pem
+
 {{- if .Values.platform.smtp.host }}
   TOWER_SMTP_HOST: {{ .Values.platform.smtp.host | quote }}
   TOWER_SMTP_PORT: {{ .Values.platform.smtp.port | quote }}

charts/platform/templates/deployment-backend.yaml

@@ -134,13 +134,11 @@ spec:
                   name: {{ include "platform.smtp.secretName" . }}
                   key: {{ include "platform.smtp.secretKey" . }}
 {{- end }}
-{{- if .Values.studios.enabled }}
             - name: TOWER_OIDC_REGISTRATION_INITIAL_ACCESS_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: {{ include "platform.oidcToken.secretName" . }}
                   key: {{ include "platform.oidcToken.secretKey" . }}
-{{- end }}
             - name: NXF_HOME
               value: "/var/cache/tower/"
             - name: NXF_PLUGINS_DIR
@@ -164,10 +162,8 @@ spec:
               mountPath: /.nextflow/
             - name: plugin-volume
               mountPath: /?/.nextflow/
-{{- if .Values.studios.enabled }}
             - name: connect-cert-volume
               mountPath: /data/certs
-{{- end }}
 {{- with .Values.backend.extraVolumeMounts }}
             {{- include "seqera.tplvalues.render" (dict "value" . "context" $) | nindent 12 }}
 {{- end }}
@@ -193,11 +189,9 @@ spec:
         - name: plugin-volume
           emptyDir:
             sizeLimit: "1Gi"
-{{- if .Values.studios.enabled }}
         - name: connect-cert-volume
           secret:
             secretName: {{ include "studios.oidcPrivateKeySecretName" . }}
-{{- end }}
 {{- with .Values.backend.extraVolumes }}
         {{- include "seqera.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
 {{- end }}

charts/platform/templates/deployment-cron.yaml

@@ -207,6 +207,8 @@ spec:
               mountPath: /.nextflow/
             - name: plugin-volume
               mountPath: /?/.nextflow/
+            - name: connect-cert-volume
+              mountPath: /data/certs
 
 {{- if .Values.cron.containerSecurityContext.enabled }}
           securityContext: {{- omit .Values.cron.containerSecurityContext "enabled" | toYaml | nindent 12 }}
@@ -232,5 +234,8 @@ spec:
         - name: plugin-volume
           emptyDir:
             sizeLimit: "1Gi"
+        - name: connect-cert-volume
+          secret:
+            secretName: {{ include "studios.oidcPrivateKeySecretName" . }}
 
       {{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.cron.image .Values.cron.dbMigrationInitContainer.image) "context" $) | nindent 6 }}

charts/platform/tests/__snapshot__/configmap_test.yaml.snap

@@ -40,7 +40,6 @@ should render Studios tools environment variables when studios is enabled with d
       TOWER_DATA_STUDIO_TEMPLATES_XPRA_TOOL: xpra
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REGISTRY: ""
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REPOSITORY: ""
-      TOWER_OIDC_PEM_PATH: /data/certs/oidc.pem
     kind: ConfigMap
     metadata:
       annotations: {}
@@ -98,7 +97,6 @@ should render custom Studios tool when provided:
       TOWER_DATA_STUDIO_TEMPLATES_XPRA_TOOL: xpra
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REGISTRY: ""
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REPOSITORY: ""
-      TOWER_OIDC_PEM_PATH: /data/certs/oidc.pem
     kind: ConfigMap
     metadata:
       annotations: {}
@@ -164,7 +162,6 @@ should render custom Studios tool with deprecated and experimental versions when
       TOWER_DATA_STUDIO_TEMPLATES_XPRA_TOOL: xpra
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REGISTRY: ""
       TOWER_DATA_STUDIO_WAVE_CUSTOM_IMAGE_REPOSITORY: ""
-      TOWER_OIDC_PEM_PATH: /data/certs/oidc.pem
     kind: ConfigMap
     metadata:
       annotations: {}

charts/platform/tests/__snapshot__/deployment-backend_test.yaml.snap

@@ -225,7 +225,7 @@ should render the backend deployment with the correct checksums, labels and anno
       template:
         metadata:
           annotations:
-            checksum/configmap: d033ec97fa9bed7b2c101fadd02d9280d309f8cbef93d7fd08363c4050d55d58
+            checksum/configmap: e7c0ce8f1a70f6f66b6154ca92968c09dbf32a11e3a960143e9d2bd91e1525d7
             checksum/secret: d3b5ca20c437b2faa4af1b549c817ee78cc2a992f86741120f01bd93a30d4873
             common-annotation-key: common-annotation-value
             pod-annotation-key: pod-annotation-value

charts/platform/tests/__snapshot__/deployment-cron_test.yaml.snap

@@ -69,6 +69,8 @@ should produce a Deployment resource with minimal values:
             name: plugin-volume
           - mountPath: /?/.nextflow/
             name: plugin-volume
+          - mountPath: /data/certs
+            name: connect-cert-volume
     initContainers:
       - command:
           - sh
@@ -185,6 +187,9 @@ should produce a Deployment resource with minimal values:
       - emptyDir:
           sizeLimit: 1Gi
         name: plugin-volume
+      - name: connect-cert-volume
+        secret:
+          secretName: release-name-platform-backend
 should render the cron deployment with the correct checksums, labels and annotations:
   1: |
     apiVersion: apps/v1
@@ -216,7 +221,7 @@ should render the cron deployment with the correct checksums, labels and annotat
       template:
         metadata:
           annotations:
-            checksum/configmap: d033ec97fa9bed7b2c101fadd02d9280d309f8cbef93d7fd08363c4050d55d58
+            checksum/configmap: e7c0ce8f1a70f6f66b6154ca92968c09dbf32a11e3a960143e9d2bd91e1525d7
             checksum/secret: d3b5ca20c437b2faa4af1b549c817ee78cc2a992f86741120f01bd93a30d4873
             common-annotation-key: common-annotation-value
             pod-annotation-key: pod-annotation-value
@@ -301,6 +306,8 @@ should render the cron deployment with the correct checksums, labels and annotat
                   name: plugin-volume
                 - mountPath: /?/.nextflow/
                   name: plugin-volume
+                - mountPath: /data/certs
+                  name: connect-cert-volume
           initContainers:
             - command:
                 - sh
@@ -417,3 +424,6 @@ should render the cron deployment with the correct checksums, labels and annotat
             - emptyDir:
                 sizeLimit: 1Gi
               name: plugin-volume
+            - name: connect-cert-volume
+              secret:
+                secretName: release-name-platform-backend

charts/platform/tests/configmap_test.yaml

@@ -382,3 +382,21 @@ tests:
         GROUNDSWELL_SERVER_URL: http://RELEASE-NAME-pipeline-optimization:8090
         MICRONAUT_ENVIRONMENTS: prod,redis,ha,wave,groundswell
         TOWER_DATA_EXPLORER_ENABLED: 'false'
+- it: should render TOWER_OIDC_PEM_PATH in the shared-backend-cron configmap regardless of studios.enabled
+  documentSelector:
+    path: metadata.name
+    value: release-name-platform-shared-backend-cron
+  set:
+    studios:
+      enabled: false
+  asserts:
+  - equal:
+      path: data.TOWER_OIDC_PEM_PATH
+      value: /data/certs/oidc.pem
+- it: should not render TOWER_OIDC_PEM_PATH in the backend-only configmap
+  documentSelector:
+    path: metadata.name
+    value: release-name-platform-backend
+  asserts:
+  - notExists:
+      path: data.TOWER_OIDC_PEM_PATH