From b6f04fa4c9a8002ba383fa5bf55c564efcdaa2ee Mon Sep 17 00:00:00 2001
From: Alfredo Matas <amatas@gmail.com>
Date: Mon, 8 Oct 2018 21:54:13 +0200
Subject: [PATCH] Add an option to disable anonymous requests to the 5984 port
 (#8266)

* Add an option to disable anonymous requests

Signed-off-by: Alfredo Matas <amatas@gmail.com>

* Bump version of the chart

Signed-off-by: Alfredo Matas <amatas@gmail.com>
---
 incubator/couchdb/Chart.yaml                 |  2 +-
 incubator/couchdb/templates/statefulset.yaml | 16 ++++++++++++++++
 incubator/couchdb/values.yaml                |  5 +++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/incubator/couchdb/Chart.yaml b/incubator/couchdb/Chart.yaml
index 37450cecbc..ab4db0a29b 100644
--- a/incubator/couchdb/Chart.yaml
+++ b/incubator/couchdb/Chart.yaml
@@ -1,5 +1,5 @@
 name: couchdb
-version: 0.2.1
+version: 0.2.2
 appVersion: 2.2.0
 description: A database featuring seamless multi-master sync, that scales from
   big data to mobile, with an intuitive HTTP/JSON API and designed for
diff --git a/incubator/couchdb/templates/statefulset.yaml b/incubator/couchdb/templates/statefulset.yaml
index 204ff75f52..35e1533632 100644
--- a/incubator/couchdb/templates/statefulset.yaml
+++ b/incubator/couchdb/templates/statefulset.yaml
@@ -61,13 +61,29 @@ spec:
             - name: ERL_FLAGS
               value: "{{ range $k, $v := .Values.erlangFlags }} -{{ $k }} {{ $v }} {{ end }}"
           livenessProbe:
+{{- if .Values.couchdbConfig.chttpd.require_valid_user }}
+            exec:
+              command:
+                - sh
+                - -c
+                - curl -G --silent --fail -u ${COUCHDB_USER}:${COUCHDB_PASSWORD} http://localhost:5984/
+{{- else }}
             httpGet:
               path: /
               port: 5984
+{{- end }}
           readinessProbe:
+{{- if .Values.couchdbConfig.chttpd.require_valid_user }}
+            exec:
+              command:
+                - sh
+                - -c
+                - curl -G --silent --fail -u ${COUCHDB_USER}:${COUCHDB_PASSWORD} http://localhost:5984/_up
+{{- else }}
             httpGet:
               path: /_up
               port: 5984
+{{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
           volumeMounts:
diff --git a/incubator/couchdb/values.yaml b/incubator/couchdb/values.yaml
index f486cb3121..ad2b36e1d2 100644
--- a/incubator/couchdb/values.yaml
+++ b/incubator/couchdb/values.yaml
@@ -116,5 +116,10 @@ erlangFlags:
 ## by a ConfigMap object.
 ## ref: http://docs.couchdb.org/en/latest/config/index.html
 couchdbConfig:
+  # cluster:
+  #   q: 8 # Create 8 shards for each database
   chttpd:
     bind_address: any
+    # chttpd.require_valid_user disables all the anonymous requests to the port
+    # 5984 when is set to true.
+    require_valid_user: false