Skip to content

Commit 8ef2052

Browse files
nicktrnnicktrn
committed
s3: full existing secret support, external fixes
1 parent beb9a9d commit 8ef2052

File tree

5 files changed

+162
-15
lines changed

5 files changed

+162
-15
lines changed

‎hosting/k8s/helm/templates/_helpers.tpl‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,94 @@ clickhouse-password
260260
{{- end -}}
261261
{{- end }}
262262

263+
{{/*
264+
S3 external secret name
265+
*/}}
266+
{{- define "trigger-v4.s3.external.secretName" -}}
267+
{{- if .Values.s3.external.existingSecret -}}
268+
{{ .Values.s3.external.existingSecret }}
269+
{{- else -}}
270+
{{ include "trigger-v4.secretsName" . }}
271+
{{- end -}}
272+
{{- end }}
273+
274+
{{/*
275+
S3 external secret access key ID key
276+
*/}}
277+
{{- define "trigger-v4.s3.external.accessKeyIdKey" -}}
278+
{{- if .Values.s3.external.existingSecret -}}
279+
{{ .Values.s3.external.existingSecretAccessKeyIdKey }}
280+
{{- else -}}
281+
s3-access-key-id
282+
{{- end -}}
283+
{{- end }}
284+
285+
{{/*
286+
S3 external secret secret access key key
287+
*/}}
288+
{{- define "trigger-v4.s3.external.secretAccessKeyKey" -}}
289+
{{- if .Values.s3.external.existingSecret -}}
290+
{{ .Values.s3.external.existingSecretSecretAccessKeyKey }}
291+
{{- else -}}
292+
s3-secret-access-key
293+
{{- end -}}
294+
{{- end }}
295+
296+
{{/*
297+
S3 auth secret name
298+
*/}}
299+
{{- define "trigger-v4.s3.auth.secretName" -}}
300+
{{- if .Values.s3.auth.existingSecret -}}
301+
{{ .Values.s3.auth.existingSecret }}
302+
{{- else -}}
303+
{{ include "trigger-v4.secretsName" . }}
304+
{{- end -}}
305+
{{- end }}
306+
307+
{{/*
308+
S3 auth secret access key ID key
309+
*/}}
310+
{{- define "trigger-v4.s3.auth.accessKeyIdKey" -}}
311+
{{- if .Values.s3.auth.existingSecret -}}
312+
{{ .Values.s3.auth.accessKeyIdSecretKey }}
313+
{{- else -}}
314+
s3-auth-access-key-id
315+
{{- end -}}
316+
{{- end }}
317+
318+
{{/*
319+
S3 auth secret secret access key key
320+
*/}}
321+
{{- define "trigger-v4.s3.auth.secretAccessKeyKey" -}}
322+
{{- if .Values.s3.auth.existingSecret -}}
323+
{{ .Values.s3.auth.secretAccessKeySecretKey }}
324+
{{- else -}}
325+
s3-auth-secret-access-key
326+
{{- end -}}
327+
{{- end }}
328+
329+
{{/*
330+
S3 auth effective access key ID (with fallback to rootUser)
331+
*/}}
332+
{{- define "trigger-v4.s3.auth.effectiveAccessKeyId" -}}
333+
{{- if .Values.s3.auth.accessKeyId -}}
334+
{{ .Values.s3.auth.accessKeyId }}
335+
{{- else -}}
336+
{{ .Values.s3.auth.rootUser }}
337+
{{- end -}}
338+
{{- end }}
339+
340+
{{/*
341+
S3 auth effective secret access key (with fallback to rootPassword)
342+
*/}}
343+
{{- define "trigger-v4.s3.auth.effectiveSecretAccessKey" -}}
344+
{{- if .Values.s3.auth.secretAccessKey -}}
345+
{{ .Values.s3.auth.secretAccessKey }}
346+
{{- else -}}
347+
{{ .Values.s3.auth.rootPassword }}
348+
{{- end -}}
349+
{{- end }}
350+
263351
{{/*
264352
Electric service URL
265353
*/}}

‎hosting/k8s/helm/templates/secrets.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,14 @@ data:
1111
MAGIC_LINK_SECRET: {{ .Values.secrets.magicLinkSecret | b64enc | quote }}
1212
ENCRYPTION_KEY: {{ .Values.secrets.encryptionKey | b64enc | quote }}
1313
MANAGED_WORKER_SECRET: {{ .Values.secrets.managedWorkerSecret | b64enc | quote }}
14-
OBJECT_STORE_ACCESS_KEY_ID: {{ .Values.secrets.objectStore.accessKeyId | b64enc | quote }}
15-
OBJECT_STORE_SECRET_ACCESS_KEY: {{ .Values.secrets.objectStore.secretAccessKey | b64enc | quote }}
14+
{{- if and .Values.s3.external.accessKeyId (not .Values.s3.external.existingSecret) }}
15+
s3-access-key-id: {{ .Values.s3.external.accessKeyId | b64enc | quote }}
16+
s3-secret-access-key: {{ .Values.s3.external.secretAccessKey | b64enc | quote }}
17+
{{- end }}
18+
{{- if and .Values.s3.deploy (not .Values.s3.auth.existingSecret) }}
19+
s3-auth-access-key-id: {{ include "trigger-v4.s3.auth.effectiveAccessKeyId" . | b64enc | quote }}
20+
s3-auth-secret-access-key: {{ include "trigger-v4.s3.auth.effectiveSecretAccessKey" . | b64enc | quote }}
21+
{{- end }}
1622
{{- if and .Values.postgres.external.databaseUrl (not .Values.postgres.external.existingSecret) }}
1723
postgres-database-url: {{ .Values.postgres.external.databaseUrl | b64enc | quote }}
1824
{{- if .Values.postgres.external.directUrl }}

‎hosting/k8s/helm/templates/validate-external-config.yaml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,16 @@ This template will fail the Helm deployment if external config is missing for re
2020
{{- end }}
2121
{{- end }}
2222

23-
{{- if not .Values.s3.deploy }}
24-
{{- if or (not .Values.s3.external.endpoint) (not .Values.s3.external.accessKeyId) }}
25-
{{- fail "S3 external configuration is required when s3.deploy=false. Please provide s3.external.endpoint and s3.external.accessKeyId" }}
23+
{{- if .Values.s3.deploy }}
24+
{{- if and (not .Values.s3.auth.existingSecret) (not .Values.s3.auth.accessKeyId) (not .Values.s3.auth.rootUser) }}
25+
{{- fail "S3 auth credentials are required when s3.deploy=true. Please provide either s3.auth.accessKeyId, s3.auth.existingSecret, or s3.auth.rootUser" }}
26+
{{- end }}
27+
{{- else }}
28+
{{- if not .Values.s3.external.endpoint }}
29+
{{- fail "S3 external configuration is required when s3.deploy=false. Please provide s3.external.endpoint" }}
30+
{{- end }}
31+
{{- if and (not .Values.s3.external.existingSecret) (not .Values.s3.external.accessKeyId) }}
32+
{{- fail "S3 credentials are required when s3.deploy=false. Please provide either s3.external.accessKeyId or s3.external.existingSecret" }}
2633
{{- end }}
2734
{{- end }}
2835

‎hosting/k8s/helm/templates/webapp.yaml‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,16 +284,55 @@ spec:
284284
secretKeyRef:
285285
name: {{ include "trigger-v4.secretsName" . }}
286286
key: MANAGED_WORKER_SECRET
287+
{{- if .Values.s3.deploy }}
288+
{{- if .Values.s3.auth.existingSecret }}
289+
- name: OBJECT_STORE_ACCESS_KEY_ID
290+
valueFrom:
291+
secretKeyRef:
292+
name: {{ include "trigger-v4.s3.auth.secretName" . }}
293+
key: {{ include "trigger-v4.s3.auth.accessKeyIdKey" . }}
294+
- name: OBJECT_STORE_SECRET_ACCESS_KEY
295+
valueFrom:
296+
secretKeyRef:
297+
name: {{ include "trigger-v4.s3.auth.secretName" . }}
298+
key: {{ include "trigger-v4.s3.auth.secretAccessKeyKey" . }}
299+
{{- else }}
287300
- name: OBJECT_STORE_ACCESS_KEY_ID
288301
valueFrom:
289302
secretKeyRef:
290303
name: {{ include "trigger-v4.secretsName" . }}
291-
key: OBJECT_STORE_ACCESS_KEY_ID
304+
key: s3-auth-access-key-id
292305
- name: OBJECT_STORE_SECRET_ACCESS_KEY
293306
valueFrom:
294307
secretKeyRef:
295308
name: {{ include "trigger-v4.secretsName" . }}
296-
key: OBJECT_STORE_SECRET_ACCESS_KEY
309+
key: s3-auth-secret-access-key
310+
{{- end }}
311+
{{- else }}
312+
{{- if .Values.s3.external.existingSecret }}
313+
- name: OBJECT_STORE_ACCESS_KEY_ID
314+
valueFrom:
315+
secretKeyRef:
316+
name: {{ include "trigger-v4.s3.external.secretName" . }}
317+
key: {{ include "trigger-v4.s3.external.accessKeyIdKey" . }}
318+
- name: OBJECT_STORE_SECRET_ACCESS_KEY
319+
valueFrom:
320+
secretKeyRef:
321+
name: {{ include "trigger-v4.s3.external.secretName" . }}
322+
key: {{ include "trigger-v4.s3.external.secretAccessKeyKey" . }}
323+
{{- else if .Values.s3.external.accessKeyId }}
324+
- name: OBJECT_STORE_ACCESS_KEY_ID
325+
valueFrom:
326+
secretKeyRef:
327+
name: {{ include "trigger-v4.secretsName" . }}
328+
key: s3-access-key-id
329+
- name: OBJECT_STORE_SECRET_ACCESS_KEY
330+
valueFrom:
331+
secretKeyRef:
332+
name: {{ include "trigger-v4.secretsName" . }}
333+
key: s3-secret-access-key
334+
{{- end }}
335+
{{- end }}
297336
{{- end }}
298337
{{- if .Values.webapp.observability }}
299338
{{- if .Values.webapp.observability.tracing.exporterUrl }}

‎hosting/k8s/helm/values.yaml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ secrets:
2525
# - MAGIC_LINK_SECRET
2626
# - ENCRYPTION_KEY
2727
# - MANAGED_WORKER_SECRET
28-
# - OBJECT_STORE_ACCESS_KEY_ID
29-
# - OBJECT_STORE_SECRET_ACCESS_KEY
3028
existingSecret: ""
3129

3230
# Session secret for user authentication (32 hex chars)
@@ -37,10 +35,7 @@ secrets:
3735
encryptionKey: "f686147ab967943ebbe9ed3b496e465a"
3836
# Worker secret for managed worker authentication (32 hex chars)
3937
managedWorkerSecret: "447c29678f9eaf289e9c4b70d3dd8a7f"
40-
# Object store credentials (change for production)
41-
objectStore:
42-
accessKeyId: "admin"
43-
secretAccessKey: "very-safe-password"
38+
# Object store credentials moved to s3.auth and s3.external section
4439

4540
# Webapp configuration
4641
webapp:
@@ -567,6 +562,13 @@ s3:
567562
auth:
568563
rootUser: "admin"
569564
rootPassword: "very-safe-password"
565+
# Webapp credentials for S3 access (defaults to root credentials if not specified)
566+
accessKeyId: "" # Defaults to rootUser if empty
567+
secretAccessKey: "" # Defaults to rootPassword if empty
568+
# Existing secret support for webapp credentials
569+
existingSecret: "" # If set, accessKeyId/secretAccessKey will be ignored
570+
accessKeyIdSecretKey: "access-key-id" # Key in existingSecret containing access key ID
571+
secretAccessKeySecretKey: "secret-access-key" # Key in existingSecret containing secret access key
570572

571573
# The required "packets" bucket is created by default.
572574
defaultBuckets: "packets"
@@ -579,8 +581,13 @@ s3:
579581
# External S3 connection (when deploy: false)
580582
external:
581583
endpoint: "" # e.g., "https://s3.amazonaws.com" or "https://your-minio.com:9000"
582-
accessKeyId: ""
583-
secretAccessKey: ""
584+
accessKeyId: "admin" # Default for internal MinIO - change for production
585+
secretAccessKey: "very-safe-password" # Default for internal MinIO - change for production
586+
#
587+
# Secure credential management
588+
existingSecret: "" # Name of existing secret containing S3 credentials
589+
existingSecretAccessKeyIdKey: "access-key-id" # Key in existing secret containing access key ID
590+
existingSecretSecretAccessKeyKey: "secret-access-key" # Key in existing secret containing secret access key
584591

585592
# Docker Registry configuration
586593
registry:

0 commit comments

Comments
 (0)