feat(helm): wire in secret file mounts, reloader, and extra config#3728
Merged
Conversation
Builds on the initial chart to support the full secret/config surface a production deployment needs: - certFilesSecret / certFilesMountPath: mount a Secret of cert/key files (DB SSL + gRPC TLS) as files, and point the DB_SSL_*_PATH / LOGFLARE_TLS_*_PATH env vars at the mount. Logflare reads these from disk, so envFrom can't carry them. (Requires the configurable-path support in logflare runtime.exs.) - reloader: optional Stakater Reloader annotation so the Deployment rolls when its ConfigMap or referenced Secrets change (the chart can't checksum Secrets it doesn't own). - extraConfig: free-form passthrough of non-secret env vars into the ConfigMap, for the long tail of configuration not modeled as first-class values. Adds helm-unittest coverage for each and documents them in the README. All new behavior is default-off, so existing rendering is unchanged.
stigglor
approved these changes
Jul 23, 2026
djwhitt
marked this pull request as ready for review
July 23, 2026 22:45
Ziinc
reviewed
Jul 24, 2026
| certFilesMountPath: /etc/logflare/certs | ||
|
|
||
| # Roll the Deployment automatically when its ConfigMap or referenced Secrets | ||
| # change. Requires the Stakater Reloader controller to be installed. |
Contributor
There was a problem hiding this comment.
Feels like reloading should be done outside of this chart, would defer to @stigglor opinion here
Contributor
Author
There was a problem hiding this comment.
Would adding a deploymentAnnotations map to make it open ended be reasonable?
This was referenced Jul 24, 2026
djwhitt
added a commit
that referenced
this pull request
Jul 24, 2026
#3736) * feat(helm): support custom vm.args via RELEASE_VM_ARGS Adds an opt-in `vmArgs` value rendered into a ConfigMap, mounted at /etc/logflare/vm.args, and wired via RELEASE_VM_ARGS. Defaults to a set including `+Q 1048576`, which caps the BEAM's preallocated port table — needed on Kubernetes, where containerd runs pods with nofile=infinity and the VM would otherwise size the table from that (~2GB RSS at boot). Mounted with subPath so it coexists with the cert-files mount under /etc/logflare. A checksum/vm-args pod annotation rolls the Deployment when the args change. Set vmArgs to "" to fall back to the image's baked-in vm.args. Adds helm-unittest coverage. * feat(helm): replace Stakater-specific reloader toggle with generic deploymentAnnotations Per review on #3728: the `logflare.reloader` boolean hard-coded a Stakater- specific annotation, which is too opinionated for a public chart. Replace it with a generic top-level `deploymentAnnotations` map (mirroring podAnnotations) that renders onto the Deployment's own metadata.annotations. This keeps the chart neutral about the reload mechanism — opt into Reloader with `deploymentAnnotations: { reloader.stakater.com/auto: "true" }` — and fills a real gap: there was no hook for Deployment-level annotations (podAnnotations only reaches the pod template). Updates the helm-unittest cases and README.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of O11Y-2137.
What
Wires the chart to carry the full secret/config surface a real deployment needs, so it can consume the ExternalSecret-materialised Secrets (
logflare-secrets,logflare-cert-files) from the k8s-observability side.certFilesSecret/certFilesMountPath— mounts a Secret whose keys are cert filenames (db-server-ca.pem,db-client-cert.pem,db-client-key.pem,cert.pem,cert.key) as files, and setsDB_SSL_CA_CERT_PATH/DB_SSL_CLIENT_CERT_PATH/DB_SSL_CLIENT_KEY_PATH/LOGFLARE_TLS_CERT_PATH/LOGFLARE_TLS_KEY_PATHto point at the mount. Logflare reads these from disk, soenvFromcan't deliver them.reloader— optional Stakater Reloader annotation so the Deployment rolls when its ConfigMap or referenced Secrets change (the chart can't checksum Secrets it doesn't own).extraConfig— free-form map of non-secret env vars rendered verbatim into the ConfigMap, for the long tail of config not modeled as first-class values (e.g.SPOOL_*,LIBCLUSTER_TOPOLOGY,GOOGLE_*_SA, per-env cluster sizing).Notes
GOOGLE_APPLICATION_CREDENTIALS_JSON), not a mounted file.config/runtime.exs(logflare feat(config): make credential and cert paths configurable #3727) for the*_PATHvars andGOOGLE_APPLICATION_CREDENTIALS_JSONto take effect at runtime.SUPER_USER_AUTHENTICATION_TOKEN; single-tenant usesLOGFLARE_PUBLIC/PRIVATE_ACCESS_TOKEN). The chart stays agnostic —envFrominjects whatever keys the referenced Secret has — so this isn't hardcoded.Related PRs
Part of the Logflare-on-Kubernetes secrets migration: