Skip to content

Conversation

@aogier
Copy link
Contributor

@aogier aogier commented Jan 19, 2025

Ciao, this PR exploits the possibilities of kubernetes to more richly express secrets in the environment by using secrets/configmap projections.
It is inobtrusive as it only mangle maps leaving any other value alone.

helm template zulip . \
  --set zulip.environment.SECRETS_email_password=password \
  --set-json zulip.environment.SECRETS_password='
    {"valueFrom":{"secretKeyRef":{"name": "secret", "key": "key"}}}' \
  -s templates/statefulset.yaml \
| yq -Y '.spec.template.spec.containers[] .env[] 
         | select((.name=="SETTING_EXTERNAL_HOST") 
                  or .name=="SECRETS_password")'

- name: SECRETS_email_password
  value: "password"
- name: SECRETS_password
  valueFrom:
    secretKeyRef:
      key: key
      name: secret

This easily unlocks the possibility to specify existing secrets in env vars without defining a dedicated one and going the #482 way. It does not breaks current workflow, but enable whoever want to do that to have it :)

Hope this helps, ciao!

@alexmv alexmv force-pushed the feature/richer-env-config branch from 034c5fe to 92dbc52 Compare September 18, 2025 18:40
@alexmv alexmv merged commit d3aee4a into zulip:main Sep 18, 2025
1 check passed
@alexmv
Copy link
Contributor

alexmv commented Sep 18, 2025

I did some rewording in the doc and commit message. Merged, and thanks @aogier!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants