Load secret info from k8s Secret objects.

[docwhat]

Is your feature request related to a problem? Please describe.

I'm using HelmResource CRD objects to install and manage helm v3 packages. Putting a secret in clear text in a HelmResource yaml file, to be committed in a git repository, is a no-no.

Secrets need to be stored separately, ideally in a sealed secret.

Describe the solution you'd like

Instead of storing secret information in the values.yaml, the values.yaml should allow pointing at an exist k8s Secret object by name and namespace.

Describe alternatives you've considered

There isn't really any way to use the chart with the current design without leaking secrets.

Additional context

I like the project. It looks cool!

[lukasmrtvy]

Is possible to resolve ENV variables in comm_config.yaml ?
What about this?

communications:
  slack:
    enabled: false
    channel: $(MY_SLACK_CHANNEL)
    token: $(MY_SLACK_API_TOKEN)
    notiftype: short
extraEnv:
  - name: MY_SLACK_CHANNEL
    value: "foo"
  - name: MY_SLACK_API_TOKEN
    valueFrom:
      secretKeyRef:
        name: mysecret
        key: token

Btw: extraEnv is not supporting valueFrom in helm chart, but its easy to do..

[docwhat]

That seems like it would work. Is using environment variables the ideal way to set secrets?

[robincher]

Have a similar related questions to @lukasmrtvy

Can i use an Env variables to overwrite the configMap values?

If so, where should i put it? At the Deployment level with the corresponding container env vars ? or at the config level shown above.

extraEnv:
  - name: MY_SLACK_CHANNEL
    value: "foo"
  - name: MY_SLACK_API_TOKEN
    valueFrom:
      secretKeyRef:
        name: mysecret
        key: token

[lebenitza]

Any news about this?

[pierluigilenoci]

Any news? @ebrianne already solved this here: https://github.com/ebrianne/helm-charts/pull/9

[ebrianne]

If that's fine I can make a PR soon to integrate this into the official chart

[pierluigilenoci]

@ebrianne I've added a comment about your solution here: #480 (comment), could you please take a look?