From ecc1f31996ef65ac05ceb30ecbf7c79889df98bd Mon Sep 17 00:00:00 2001 From: Anatolii Lapytskyi Date: Thu, 8 Jan 2026 10:36:03 +0100 Subject: [PATCH] feat(helm): add existingSecret support (#119) * feat(helm): add existingSecret support Allow users to reference a pre-existing Kubernetes Secret instead of having the chart create one. This enables better secret management through tools like External Secrets Operator or sealed-secrets. Usage: ```yaml existingSecret: "my-pre-created-secret" ``` When existingSecret is set: - The chart skips creating its own Secret resource - Deployments reference the provided secret name - Secret checksum annotation is omitted (no auto-rollout on changes) The existing secret should contain all required keys: - API secrets (e.g., HINDSIGHT_API_LLM_API_KEY) - Control plane secrets - postgres-password (if using external PostgreSQL) * fix(helm): use envFrom for existingSecret and fix env var ordering - Add envFrom to inject all keys from existingSecret as env vars automatically - Fix POSTGRES_PASSWORD ordering (must be before DATABASE_URL for $(VAR) interpolation) - Only use api.secrets/controlPlane.secrets when existingSecret is not set - Update values.yaml documentation for existingSecret usage --------- Co-authored-by: Anatolii Lapytskyi --- helm/hindsight/templates/_helpers.tpl | 11 +++++++++++ helm/hindsight/templates/api-deployment.yaml | 19 +++++++++++++++---- .../templates/controlplane-deployment.yaml | 12 +++++++++++- helm/hindsight/templates/secret.yaml | 4 +++- helm/hindsight/values.yaml | 9 +++++++++ 5 files changed, 49 insertions(+), 6 deletions(-) diff --git a/helm/hindsight/templates/_helpers.tpl b/helm/hindsight/templates/_helpers.tpl index 9b6efc8b..418a41c7 100644 --- a/helm/hindsight/templates/_helpers.tpl +++ b/helm/hindsight/templates/_helpers.tpl @@ -110,3 +110,14 @@ API URL for control plane {{- define "hindsight.apiUrl" -}} {{- printf "http://%s-api:%d" (include "hindsight.fullname" .) (.Values.api.service.port | int) }} {{- end }} + +{{/* +Get the name of the secret to use +*/}} +{{- define "hindsight.secretName" -}} +{{- if .Values.existingSecret }} +{{- .Values.existingSecret }} +{{- else }} +{{- printf "%s-secret" (include "hindsight.fullname" .) }} +{{- end }} +{{- end }} diff --git a/helm/hindsight/templates/api-deployment.yaml b/helm/hindsight/templates/api-deployment.yaml index ad188e8d..47fb22c9 100644 --- a/helm/hindsight/templates/api-deployment.yaml +++ b/helm/hindsight/templates/api-deployment.yaml @@ -15,7 +15,9 @@ spec: template: metadata: annotations: + {{- if not .Values.existingSecret }} checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- end }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} @@ -37,27 +39,36 @@ spec: - name: http containerPort: {{ .Values.api.service.targetPort }} protocol: TCP + {{- if .Values.existingSecret }} + envFrom: + - secretRef: + name: {{ .Values.existingSecret }} + {{- end }} env: - - name: HINDSIGHT_API_DATABASE_URL - value: {{ include "hindsight.databaseUrl" . | quote }} + {{- /* POSTGRES_PASSWORD must be defined before DATABASE_URL for $(VAR) interpolation */}} {{- if not .Values.postgresql.enabled }} - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: - name: {{ include "hindsight.fullname" . }}-secret + name: {{ include "hindsight.secretName" . }} key: postgres-password {{- end }} + - name: HINDSIGHT_API_DATABASE_URL + value: {{ include "hindsight.databaseUrl" . | quote }} {{- range $key, $value := .Values.api.env }} - name: {{ $key }} value: {{ $value | quote }} {{- end }} + {{- /* Only use api.secrets when not using existingSecret (for chart-managed secrets) */}} + {{- if not .Values.existingSecret }} {{- range $key, $value := .Values.api.secrets }} - name: {{ $key }} valueFrom: secretKeyRef: - name: {{ include "hindsight.fullname" $ }}-secret + name: {{ include "hindsight.secretName" $ }} key: {{ $key }} {{- end }} + {{- end }} livenessProbe: {{- toYaml .Values.api.livenessProbe | nindent 10 }} readinessProbe: diff --git a/helm/hindsight/templates/controlplane-deployment.yaml b/helm/hindsight/templates/controlplane-deployment.yaml index 1704330d..9ddc4f2b 100644 --- a/helm/hindsight/templates/controlplane-deployment.yaml +++ b/helm/hindsight/templates/controlplane-deployment.yaml @@ -15,7 +15,9 @@ spec: template: metadata: annotations: + {{- if not .Values.existingSecret }} checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- end }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} @@ -37,6 +39,11 @@ spec: - name: http containerPort: {{ .Values.controlPlane.service.targetPort }} protocol: TCP + {{- if .Values.existingSecret }} + envFrom: + - secretRef: + name: {{ .Values.existingSecret }} + {{- end }} env: - name: HINDSIGHT_CP_DATAPLANE_API_URL value: {{ include "hindsight.apiUrl" . | quote }} @@ -44,13 +51,16 @@ spec: - name: {{ $key }} value: {{ $value | quote }} {{- end }} + {{- /* Only use controlPlane.secrets when not using existingSecret (for chart-managed secrets) */}} + {{- if not .Values.existingSecret }} {{- range $key, $value := .Values.controlPlane.secrets }} - name: {{ $key }} valueFrom: secretKeyRef: - name: {{ include "hindsight.fullname" $ }}-secret + name: {{ include "hindsight.secretName" $ }} key: {{ $key }} {{- end }} + {{- end }} livenessProbe: {{- toYaml .Values.controlPlane.livenessProbe | nindent 10 }} readinessProbe: diff --git a/helm/hindsight/templates/secret.yaml b/helm/hindsight/templates/secret.yaml index 8cd6e800..914c2ea3 100644 --- a/helm/hindsight/templates/secret.yaml +++ b/helm/hindsight/templates/secret.yaml @@ -1,7 +1,8 @@ +{{- if not .Values.existingSecret }} apiVersion: v1 kind: Secret metadata: - name: {{ include "hindsight.fullname" . }}-secret + name: {{ include "hindsight.secretName" . }} labels: {{- include "hindsight.labels" . | nindent 4 }} type: Opaque @@ -15,3 +16,4 @@ data: {{- if and (not .Values.postgresql.enabled) .Values.postgresql.external.password }} postgres-password: {{ .Values.postgresql.external.password | b64enc | quote }} {{- end }} +{{- end }} diff --git a/helm/hindsight/values.yaml b/helm/hindsight/values.yaml index dcbe3b68..610aafb4 100644 --- a/helm/hindsight/values.yaml +++ b/helm/hindsight/values.yaml @@ -3,6 +3,15 @@ # Chart version - use this to set a consistent image tag across all components version: "0.1.1" +# Use an existing secret instead of creating one from values +# When set, all keys from this secret are injected as environment variables via envFrom +# Required keys: +# - postgres-password: PostgreSQL password (when postgresql.enabled=false) +# Optional keys (any key becomes an env var): +# - HINDSIGHT_API_LLM_API_KEY: API key for LLM provider +# - Any other env vars you want to inject +# existingSecret: "my-hindsight-secret" + # Global settings replicaCount: 1