vault-agent and aws pod identity support

[sudheesh-87]

Describe the feature or potential improvement

For running a self hosted langfuse deployment in aws EKS env, instead of using kubernetese secrets , can we have vault-agent sidecar integration so that secrets/keys can be accessed from vault . Also to access the AWS managed services like postgress , redis etc , EKS pod idnetity is helpful .

Additional information

No response

[Steffen911]

@sudheesh-87 Are you using the Langfuse terraform deployment or how are you deploying your environment?
The langfuse.extraContainers option in the helm chart (https://github.com/langfuse/langfuse-k8s/tree/main/charts/langfuse) should allow you to deploy side-cars.

[sudheesh-87]

@Steffen911 , I'm using helm chart for deployment , so once we add vault side car to inject secrets in to langfuse container , we need to source those as env variables as required by langfuse configuration, can we use entrypoint like below to source the variable file ?

spec:
containers:
- name: langfuse
command: ["/bin/sh", "-c"]
args:
- "source /vault/secrets/env && exec /original-entrypoint"

[Steffen911]

@sudheesh-87 You'll have to experiment a bit with the entry points to make it work. It's important that the entrypoint.sh script is being executed on our end as otherwise, we wouldn't run postgres and clickhouse migrations. Ideally, you only overwrite the args and leave the command as is.