[common][helm] helm support for config providers#3685
Conversation
fresh-borzoni
changed the title
0a20066 to
806f2f7
Compare
806f2f7 to
228def5
Compare
228def5 to
d167c44
Compare
affo
left a comment
affo
left a comment
There was a problem hiding this comment.
@fresh-borzoni thank you so much for this contrib!
Most of my comments are nits, the contribution looks already very good
| --from-literal=access-key=... --from-literal=secret-key=... | ||
| ``` | ||
|
|
||
| ```yaml |
There was a problem hiding this comment.
can we also add an example for env?
| Base directory under which each secret mount gets its own subdirectory. | ||
| */}} | ||
| {{- define "fluss.secrets.basePath" -}} | ||
| /etc/fluss/secrets |
There was a problem hiding this comment.
do you think it is better to make this overridable by the user in case?
| # Secrets referenced from configurationOverrides via config provider markers: | ||
| # mounts are read with ${directory:/etc/fluss/secrets/<name>:<key>}, env entries | ||
| # with ${env:<NAME>}. The chart generates the matching config.providers lines. | ||
| secrets: |
There was a problem hiding this comment.
I think we can add a basePath here, so that the user can override, and it defaults to etc/fluss/secrets
| # mounts are read with ${directory:/etc/fluss/secrets/<name>:<key>}, env entries | ||
| # with ${env:<NAME>}. The chart generates the matching config.providers lines. | ||
| secrets: | ||
| # - name: paimon-creds |
There was a problem hiding this comment.
do you think in this case it would be better to rename name to something similar to subDir?
I think this would be more explicit for the user to understand that to use it it should be ${directory:<basePath>/<SubDir>:key}.
Just a nit, name still fits well, it took me some time to understand :)
2 participants
closes #3686
On the helm side, secrets become declarative:
The chart generates the config.providers config with allowed.paths/env allowlist derived from the declared entries, so the rendered server.yaml stays a plain ConfigMap with no secret material.
Plus some follow-ups from the #3658 review threads: