fix(calendar): remove hardcoded api key and inject via env var by TineoC · Pull Request #623 · kubernetes/contributor-site

TineoC · 2026-01-16T20:04:44Z

This PR addresses the security issue of having a hardcoded Google Calendar API key in the source code and improves the robustness of the implementation.

Changes

Removed Hardcoded Key: The API key has been removed from static/js/calendar.js.
Flexible Key Injection: The key is now injected into the calendar script with the following priority:
1. HUGO_GOOGLE_CALENDAR_API_KEY environment variable.
2. google_calendar_api_key site parameter in hugo.yaml.
Fixed Template Bug: Replaced the Hugo js filter with jsonify | safeJS to correctly handle empty strings (previously it rendered an empty object {}, which was truthy in JS and caused 400 errors).
Improved Debugging: Added masked logging (AIza...) in the browser console to verify which key is being used without exposing it entirely.
Graceful Degradation: The renderCalendar function now properly detects missing keys and displays a Bootstrap alert instead of attempting a failed API call.
Production Build Enforcement: For production builds, the build will fail if no API key is set, ensuring that we don't accidentally deploy a broken calendar.

Setup Instructions

1. Google Cloud Console (Obtain API Key)

Log in to the Google Cloud Console.
Select your project.
Navigate to APIs & Services > Credentials.
Click + CREATE CREDENTIALS and select API key.
Copy the generated key (should start with AIza).
(Recommended) Click Edit API key to add restrictions:
- API restrictions: Select "Google Calendar API".
- Website restrictions: Add kubernetes.dev and your Netlify preview domains.

2. Netlify Dashboard

Log in to your Netlify dashboard.
Select the kubernetes-contributor-site site.
Navigate to Site configuration > Environment variables.
Click Add a variable.
Key: HUGO_GOOGLE_CALENDAR_API_KEY
Value: Enter the valid Google API key (AIza...).
Click Create variable.
Trigger a new deploy for the changes to take effect.

Local Development

For local development, the calendar will show a placeholder message by default. To test functionality locally:

Obtain a valid API key.
Run the server with the environment variable:
```
export HUGO_GOOGLE_CALENDAR_API_KEY="AIza..."
hugo server
```
Alternatively, use netlify dev if you have the CLI linked.

Closes #45

k8s-ci-robot · 2026-01-16T20:04:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: TineoC
Once this PR has been reviewed and has the lgtm label, please assign stmcginnis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

TineoC · 2026-01-16T20:08:47Z

Before merging this changes. Please follow the steps mentioned in "Production Setup Instructions (Netlify)"

lmktfy

Partial feedback

lmktfy · 2026-01-18T09:24:39Z

hugo.yaml


 # Everything below this are Site Params
 params:
+  google_calendar_api_key: 'PLACEHOLDER_VALUE'


Why this addition?

for allowing devs add their Google Calendar keys for local development. but is simpler to just use them in prod. I agree with you

lmktfy · 2026-01-18T09:25:28Z

layouts/calendar/baseof.html

    <script src='{{ .Site.BaseURL }}/js/calendar.js'></script>
    <script>
-      renderCalendar();
+      {{ $apiKey := getenv "HUGO_GOOGLE_CALENDAR_API_KEY" | default .Site.Params.google_calendar_api_key | default "" }}


Can we make the requirement conditional on whether it is a production build?

lmktfy · 2026-01-18T09:25:56Z

static/js/calendar.js

+
+    if (!apiKey || apiKey === 'PLACEHOLDER_VALUE') {
+      console.warn('Google Calendar API key is missing. Calendar will not render.');
+      calendarEl.innerHTML = '<div style="padding: 20px; border: 1px solid #ccc; background: #f9f9f9; text-align: center;">Community Calendar is not available in this environment (missing API Key).</div>';


Avoid embedding CSS here

lmktfy · 2026-01-18T16:53:58Z

layouts/calendar/baseof.html

    <script>
-      renderCalendar();
+      {{ if hugo.IsProduction }}
+        {{ $apiKey := getenv "HUGO_GOOGLE_CALENDAR_API_KEY" | default "" }}


Here's how I'd do it

Always try to fetch the value

If not production, it doesn't matter

If it's missing *in production", call errorf to outright fail the build

lmktfy · 2026-01-18T16:59:58Z

static/js/calendar.js

  document.addEventListener('DOMContentLoaded', function() {
    var calendarEl = document.getElementById('calendar');
+
+    if (!calendarEl) {


A trick: we can set eg data-isproduction on the root <html> element. But we only do that for production builds, and then client side we know if a calendar / API key is expected.

like this?

<html {{ if hugo.IsProduction }}data-isproduction="true"{{ end }}>

TineoC · 2026-02-07T15:56:59Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

jberkus · 2026-02-12T16:58:00Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

@ameukam ?

ameukam · 2026-02-12T18:35:19Z

@mrbobbytables @mfahlandt @stmcginnis Who would be the best person to reach out to for providing and setting the GOOGLE_CALENDAR_API_KEY in the production environment (Netlify) of the webpage?

@ameukam ?

That will be @kubernetes/steering-committee which is the current admin group of the Google Workspace org we use: https://github.com/kubernetes/steering#google-workspace

BenTheElder · 2026-02-12T18:54:03Z

Specifically: https://github.com/kubernetes/steering#top-level-accounts

BenTheElder · 2026-02-12T18:54:35Z

Though steering doesn't have access to the Netlify side, just the Google Workspace.

TineoC · 2026-03-11T02:21:17Z

@katcosgrove @aojea @soltysh Hi! we need to set up a Google API Key for our Calendar to remove this public key for being stored in the source code.

What needs to be done?

Create a Google Calendar key behind the K8s Google Workspace
Store it securely in Netflify. (from our SIG the only person I know has access to it is @reylejano there could be more).

soltysh · 2026-03-13T16:20:26Z

This is being handled in this slack thread.

lmktfy · 2026-03-15T16:28:43Z

/uncc

Happy to approve this change once it's ready for that. I recommend adding a hold before asking for approval, because the unhold is easier to secure than approval.

TineoC · 2026-03-15T19:35:00Z

/hold

reylejano · 2026-03-20T21:04:04Z

The Netlify steps are done. The GOOGLE_CALENDAR_API_KEY env var is added and a deploy is triggered

TineoC · 2026-03-20T21:08:15Z

@reylejano could you double check the preview in netlify?

Is getting 400 error:

{
  "error": {
    "code": 400,
    "message": "API key not valid. Please pass a valid API key.",
    "errors": [
      {
        "message": "API key not valid. Please pass a valid API key.",
        "domain": "global",
        "reason": "badRequest"
      }
    ],
    "status": "INVALID_ARGUMENT",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "API_KEY_INVALID",
        "domain": "googleapis.com",
        "metadata": {
          "service": "calendar-json.googleapis.com"
        }
      },
      {
        "@type": "type.googleapis.com/google.rpc.LocalizedMessage",
        "locale": "en-US",
        "message": "API key not valid. Please pass a valid API key."
      }
    ]
  }
}

TineoC · 2026-03-20T21:13:33Z

#623 (comment) @reylejano my bad! the description was incorrect. The right key is: HUGO_GOOGLE_CALENDAR_API_KEY

reylejano · 2026-03-20T21:43:33Z

#623 (comment) @reylejano my bad! the description was incorrect. The right key is: HUGO_GOOGLE_CALENDAR_API_KEY

I changed it to the right key

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Jan 16, 2026

k8s-ci-robot requested review from SayakMukhopadhyay and reylejano January 16, 2026 20:04

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 16, 2026

TineoC force-pushed the fix/remove-hardcoded-api-key branch from 71e96f0 to eefacc4 Compare January 16, 2026 20:05

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Jan 16, 2026

TineoC force-pushed the fix/remove-hardcoded-api-key branch from b315ccc to 6b4e71d Compare January 16, 2026 20:13

lmktfy reviewed Jan 18, 2026

View reviewed changes

TineoC requested a review from lmktfy January 18, 2026 16:13

lmktfy reviewed Jan 18, 2026

View reviewed changes

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 19, 2026

TineoC requested a review from lmktfy January 29, 2026 02:05

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Feb 12, 2026

k8s-ci-robot removed the request for review from lmktfy March 15, 2026 16:28

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 15, 2026

TineoC force-pushed the fix/remove-hardcoded-api-key branch from 8ec4e20 to 8ae4064 Compare March 20, 2026 21:11

fix(calendar): remove hardcoded api key and inject via env var

626f561

TineoC force-pushed the fix/remove-hardcoded-api-key branch from 8ae4064 to 626f561 Compare March 20, 2026 21:12

fix(calendar): fix api key injection and add fallback params

1ccdc9c

TineoC force-pushed the fix/remove-hardcoded-api-key branch from abb1d95 to 1ccdc9c Compare March 21, 2026 14:22

Conversation

TineoC commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Setup Instructions

1. Google Cloud Console (Obtain API Key)

2. Netlify Dashboard

Local Development

Uh oh!

k8s-ci-robot commented Jan 16, 2026

Uh oh!

TineoC commented Jan 16, 2026

Uh oh!

lmktfy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

lmktfy Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

TineoC commented Feb 7, 2026

Uh oh!

jberkus commented Feb 12, 2026

Uh oh!

ameukam commented Feb 12, 2026

Uh oh!

BenTheElder commented Feb 12, 2026

Uh oh!

BenTheElder commented Feb 12, 2026

Uh oh!

TineoC commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

soltysh commented Mar 13, 2026

Uh oh!

lmktfy commented Mar 15, 2026

Uh oh!

TineoC commented Mar 15, 2026

Uh oh!

reylejano commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TineoC commented Mar 20, 2026

Uh oh!

TineoC commented Mar 20, 2026

Uh oh!

reylejano commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

TineoC commented Jan 16, 2026 •

edited

Loading

lmktfy left a comment •

edited

Loading

TineoC Jan 18, 2026 •

edited

Loading

TineoC commented Mar 11, 2026 •

edited

Loading

reylejano commented Mar 20, 2026 •

edited

Loading