Use secrets instead of hardcoding credentials in the values.yaml file
johanneskastl opened this issue · comments
Many other charts are not allowing usernames/passwords in the values.yaml
file due to security considerations. Think of a GitOps approach where the values.yaml
file is stored in Git. In this case it would be nice to have an alternative way.
Those charts use environment variables from secrets or are mounting the secrets into the pod, so the pod has access to the credentials. Then the values.yaml
only needs to contain the references to those secrets, i.e. the secret names.
Example from the Bitnami-postgresql chart:
https://github.com/bitnami/charts/blob/main/bitnami/postgresql/values.yaml#L35
Are there any plans to allow this for the openproject chart?
I suppose this can be closed with the changes in #46, / version 4.0.0.
I can confirm that it works! At least for the postgreSQL database.
I do not use the bundled one, so I need the following settings:
postgresql:
bundled: false
connection:
host: <service-name-here>
port: 5432
auth:
existingSecret: my-postgresql-credentials-secret
secretKeys:
userPasswordKey: "password"
As soon as I set the auth.existingSecret
, I need to add the secretKeys
. But that is to be expected, as it is commented out in the chart's values.yaml and hence there is no default value for this.
Thanks for the work @oliverguenther @machisuji