feat(helm): add secret/config consumption wiring (cert mounts, reloader, extraConfig)#3734
Closed
djwhitt wants to merge 1 commit into
Closed
feat(helm): add secret/config consumption wiring (cert mounts, reloader, extraConfig)#3734djwhitt wants to merge 1 commit into
djwhitt wants to merge 1 commit into
Conversation
Builds on the initial chart to support the full secret/config surface a production deployment needs: - certFilesSecret / certFilesMountPath: mount a Secret of cert/key files (DB SSL + gRPC TLS) as files, and point the DB_SSL_*_PATH / LOGFLARE_TLS_*_PATH env vars at the mount. Logflare reads these from disk, so envFrom can't carry them. (Requires the configurable-path support in logflare runtime.exs.) - reloader: optional Stakater Reloader annotation so the Deployment rolls when its ConfigMap or referenced Secrets change (the chart can't checksum Secrets it doesn't own). - extraConfig: free-form passthrough of non-secret env vars into the ConfigMap, for the long tail of configuration not modeled as first-class values. Adds helm-unittest coverage for each and documents them in the README. All new behavior is default-off, so existing rendering is unchanged.
Contributor
Author
|
Closing in favor of #3728 — the separate stacked PR adds more confusion than it's worth. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks the secret/config consumption wiring from #3728 onto the
feat/helm-external-secretsbranch (#3729), so the chart that #575 deploys can actually use the secrets ESO materializes. #3729 renders the ExternalSecrets; this adds the half that reads them.Targets
feat/helm-external-secretsso everything lands on the branch supabase/k8s-observability#575 points at. Supersedes #3728 (which was a parallel branch offfeat/helm) — close that one once this merges.What this adds (cherry-picked from the approved #3728)
logflare.certFilesSecret/certFilesMountPathmount thelogflare-cert-filesSecret as files and setDB_SSL_CA_CERT_PATH/DB_SSL_CLIENT_CERT_PATH/DB_SSL_CLIENT_KEY_PATH/LOGFLARE_TLS_CERT_PATH/LOGFLARE_TLS_KEY_PATH. Without this, ESO createslogflare-cert-filesbut the app never sees the certs (it reads them from disk).logflare.extraConfig: free-form non-secret env vars rendered into the ConfigMap — for the long tail of per-env config (e.g.SPOOL_*,LIBCLUSTER_TOPOLOGY,LOGFLARE_LOG_LEVEL).logflare.reloader: optional Stakater Reloader annotation so the Deployment rolls on ConfigMap/Secret changes.All default-off; existing rendering is unchanged. Includes the helm-unittest coverage from #3728. Clean cherry-pick — no version double-bump (Chart.yaml stays at #3729's
0.2.0).Follow-ups (not blocking)
certFilesSecret(this PR) and the genericvolumes/volumeMountsexample (feat(helm): add optional ESO ExternalSecret templates #3729). Worth consolidating oncertFilesSecretsince it also wires the*_PATHenv vars.valuesObjectshould setcertFilesSecret: logflare-cert-files(rather than manual volumes) to get the mount + path env vars.Depends on / stacks with #3719 and #3729.