ecc1f31996
* feat(helm): add existingSecret support Allow users to reference a pre-existing Kubernetes Secret instead of having the chart create one. This enables better secret management through tools like External Secrets Operator or sealed-secrets. Usage: ```yaml existingSecret: "my-pre-created-secret" ``` When existingSecret is set: - The chart skips creating its own Secret resource - Deployments reference the provided secret name - Secret checksum annotation is omitted (no auto-rollout on changes) The existing secret should contain all required keys: - API secrets (e.g., HINDSIGHT_API_LLM_API_KEY) - Control plane secrets - postgres-password (if using external PostgreSQL) * fix(helm): use envFrom for existingSecret and fix env var ordering - Add envFrom to inject all keys from existingSecret as env vars automatically - Fix POSTGRES_PASSWORD ordering (must be before DATABASE_URL for $(VAR) interpolation) - Only use api.secrets/controlPlane.secrets when existingSecret is not set - Update values.yaml documentation for existingSecret usage --------- Co-authored-by: Anatolii Lapytskyi <ala@herobase.com>
19 lines
619 B
YAML
19 lines
619 B
YAML
{{- if not .Values.existingSecret }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "hindsight.secretName" . }}
|
|
labels:
|
|
{{- include "hindsight.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
data:
|
|
{{- range $key, $value := .Values.api.secrets }}
|
|
{{ $key }}: {{ $value | b64enc | quote }}
|
|
{{- end }}
|
|
{{- range $key, $value := .Values.controlPlane.secrets }}
|
|
{{ $key }}: {{ $value | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if and (not .Values.postgresql.enabled) .Values.postgresql.external.password }}
|
|
postgres-password: {{ .Values.postgresql.external.password | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|