work in progress improving cronjob call

templates/cronjob.yaml

-{{- if .Values.mu_cron.enabled }}
+{{- if .Values.wordpress.mu_cron.enabled }}
 apiVersion: batch/v1beta1
 kind: CronJob
 metadata:
@@ -9,14 +9,14 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
   annotations:
-{{ toYaml .Values.mu_cron.cronjob.annotations | indent 4 }}
+{{ toYaml .Values.wordpress.mu_cron.cronjob.annotations | indent 4 }}
 spec:
-  schedule: "{{ .Values.mu_cron.cronjob.schedule }}"
+  schedule: "{{ .Values.wordpress.mu_cron.cronjob.schedule }}"
   concurrencyPolicy: Forbid
-  {{- with .Values.mu_cron.cronjob.failedJobsHistoryLimit }}
+  {{- with .Values.wordpress.mu_cron.cronjob.failedJobsHistoryLimit }}
   failedJobsHistoryLimit: {{ . }}
   {{- end }}
-  {{- with .Values.mu_cron.cronjob.successfulJobsHistoryLimit }}
+  {{- with .Values.wordpress.mu_cron.cronjob.successfulJobsHistoryLimit }}
   successfulJobsHistoryLimit: {{ . }}
   {{- end }}
   jobTemplate:
@@ -32,36 +32,35 @@ spec:
             app.kubernetes.io/managed-by: {{ .Release.Service }}
         spec:
           restartPolicy: Never
-          {{- if (default .Values.image.pullSecrets .Values.mu_cron.cronjob.image.pullSecrets) }}
+          {{- if (default .Values.image.pullSecrets .Values.wordpress.mu_cron.cronjob.image.pullSecrets) }}
           imagePullSecrets:
-          {{- range (default .Values.image.pullSecrets .Values.mu_cron.cronjob.image.pullSecrets) }}
+          {{- range (default .Values.image.pullSecrets .Values.wordpress.mu_cron.cronjob.image.pullSecrets) }}
             - name: {{ . }}
           {{- end }}
           {{- end }}
           containers:
             - name: {{ .Chart.Name }}
-              image: "{{ default .Values.image.repository .Values.mu_cron.cronjob.image.repository }}:{{ default .Values.image.tag .Values.mu_cron.cronjob.image.tag }}"
-              imagePullPolicy: {{ default .Values.image.pullPolicy .Values.mu_cron.cronjob.image.pullPolicy }}
+              image: "{{ default .Values.image.repository .Values.wordpress.mu_cron.cronjob.image.repository }}:{{ default .Values.image.tag .Values.wordpress.mu_cron.cronjob.image.tag }}"
+              imagePullPolicy: {{ default .Values.image.pullPolicy .Values.wordpress.mu_cron.cronjob.image.pullPolicy }}
               command: [ "curl" ]
               args:
-              {{- if .Values.mu_cron.cronjob.curlInsecure }}
+              {{- if .Values.wordpress.mu_cron.cronjob.curlInsecure }}
                 - "-k"
               {{- end }}
                 - "--fail"
                 - "-L"
-                # TODO: How do I send the secret?
-                - "http://{{ .Release.Service }}/{{ .Values.mu_cron.cronjob.path }}"
+                - "http://{{ .Release.Service }}/{{ .Values.wordpress.mu_cron.cronjob.path }}?doing_wp_cron&{{ .Values.wordpress.mu_cron.cronjob.static_key }}"
               resources:
-{{ toYaml (default .Values.resources .Values.mu_cron.cronjob.resources) | indent 16 }}
-    {{- with (default .Values.nodeSelector .Values.mu_cron.cronjob.nodeSelector) }}
+{{ toYaml (default .Values.resources .Values.wordpress.mu_cron.cronjob.resources) | indent 16 }}
+    {{- with (default .Values.nodeSelector .Values.wordpress.mu_cron.cronjob.nodeSelector) }}
           nodeSelector:
 {{ toYaml . | indent 12 }}
     {{- end }}
-    {{- with (default .Values.affinity .Values.mu_cron.cronjob.affinity) }}
+    {{- with (default .Values.affinity .Values.wordpress.mu_cron.cronjob.affinity) }}
           affinity:
 {{ toYaml . | indent 12 }}
     {{- end }}
-    {{- with (default .Values.tolerations .Values.mu_cron.cronjob.tolerations) }}
+    {{- with (default .Values.tolerations .Values.wordpress.mu_cron.cronjob.tolerations) }}
           tolerations:
 {{ toYaml . | indent 12 }}:
     {{- end }}

templates/ingress.yaml

@@ -13,11 +13,11 @@ metadata:
 {{- with .Values.ingress.annotations }}
   annotations:
 {{ toYaml . | indent 4 }}
-{{- if .Values.mu_cron.enabled }}
+{{- if $.Values.wordpress.mu_cron.enabled }}
     # Deny any traffic to the cronjob path that goes through ingress
     # (i.e. external traffic)
     nginx.org/server-snippets: |-
-      location {{ .Values.mu_cron.cronjob.path }}{
+      location {{ $.Values.wordpress.mu_cron.cronjob.path }}{
           deny all;
       }
 {{- end }}

templates/statefulset.yaml

@@ -35,6 +35,7 @@ spec:
       imagePullSecrets:
         - name: {{ .Values.initImage.imagePullSecretName }}
       {{- end }}
+      enableServiceLinks: {{ .Values.enableServiceLinks }}
       initContainers:
         - name: init-{{ .Chart.Name }}
           image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag }}"

values.yaml

@@ -76,6 +76,12 @@ openid_connect_settings:
   role_key: "roles"
 
 
+# This disables information about other services to be pushed as environment
+# variables. We do this because these environment variables can be read through
+# the WordPress admin interface, so they can leak information about other things
+# running on the cluster to WordPress administrators
+enableServiceLinks: false
+
 wordpress:
   config:
     db:
@@ -92,11 +98,10 @@ wordpress:
     # NOTE: Use a theme *slug* here
     theme: twentytwenty
     theme_fallback: twentytwenty
-    # 
-    # NOTE: Languages are ALL available languages. en_US is always installed but it is shown explicitly 
+    # NOTE: Languages are ALL available languages. en_US is always installed but it is shown explicitly
     # EXAMPLE: `languages: "[en_US,fi_FI,wo]"` would install US English, Finnish and Wolof
     # EXAMPLE: `default_language: fi_FI` would set Finnish for the core language
-    languages: "[en_US]" 
+    languages: "[en_US]"
     default_language: en_US
     version: 5.4.2
     url: "http://localhost"
@@ -135,9 +140,9 @@ wordpress:
   # See values-local.yaml.example for an example value
   mu_plugins: {}
 
-  ## Enable externally triggered cron if a cron plugin is installed
-  # NOTE: mu_cron must be have the "enabled" value set as either true or false
-  # See values-local.yaml.example for an example value
+  ## Enable externally triggered cron with a cron plugin
+  # NOTE: mu_cron is disabled by default. Set `mu_cron: enabled: true` in your
+  # values-local to enable mu_cron.
   mu_cron:
     enabled: false
     name: Cron Control
@@ -167,8 +172,12 @@ wordpress:
       failedJobsHistoryLimit: 5
       successfulJobsHistoryLimit: 1
       # Path to the cronjob PHP file (gets appended to the wordpress URL)
-      # TODO: What should be the URL?
-      path: cron-control.php
+      path: wp-cron.php
+      # You can override this key for the cronjobs. If you don't change the
+      # ingress, the cronjob URL will be blocked from outside, so this variable
+      # should not be very important to you.
+      static_key: cronkey
+      image: {}
 
 persistence:
   ## Enable the use of a persistent volume
@@ -214,6 +223,7 @@ image:
   repository: open.greenhost.net:4567/openappstack/wordpress-helm/wordpress
   tag: 0.1.3
   pullPolicy: Always
+  pullSecrets: []
 
 initImage:
   repository: open.greenhost.net:4567/openappstack/wordpress-helm/wordpress-cli-ansible