Secrets are exposed in values.yaml and can't be referenced via secretKeyRef

[ajgon]

Secrets are exposed in values.yaml and can't be referenced via secretKeyRef

[ajgon]

Hey!

Yes I'm aware of that, but to be honest maintaining helm charts is cumbersome, and eventually I gave up on this repo. I moved to something else, and I strongly recommend it, as it's way more versatile and can be used for practically every self-hosted container - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template.

For example, for LLDAP, you can use something like this:

app-template:
  image:
    repository: nitnelave/lldap
    pullPolicy: Always
    tag: latest-alpine
  controller:
    type: daemonset
  strategy:
    type: Recreate
  podSecurityContext:
    fsGroup: 1000
  env:
    LLDAP_DATABASE_URL_FILE: /secrets/database-url
    LLDAP_HTTP_URL: http://lldap.example.com
    LLDAP_JWT_SECRET_FILE: /secrets/jwt-secret
    LLDAP_KEY_FILE: /secrets/key-file
    LLDAP_LDAPS_OPTIONS__ENABLED: "false"
    LLDAP_LDAP_BASE_DN: dc=example,dc=com
    LLDAP_LDAP_USER_DN: admin
    LLDAP_LDAP_USER_EMAIL: [email protected]
    LLDAP_LDAP_USER_PASS_FILE: /secrets/user-password
    LLDAP_SMTP_OPTIONS__ENABLE_PASSWORD_RESET: "true"
    LLDAP_SMTP_OPTIONS__FROM: [email protected]
    LLDAP_SMTP_OPTIONS__PASSWORD_FILE: /secrets/smtp-password
    LLDAP_SMTP_OPTIONS__PORT: "587"
    LLDAP_SMTP_OPTIONS__SERVER: my.smtpserver.com
    LLDAP_SMTP_OPTIONS__SMTP_ENCRYPTION: STARTTLS
    LLDAP_SMTP_OPTIONS__USER: [email protected]
    LLDAP_VERBOSE: "true"

    GID: "1000"
    TZ: Europe/Warsaw
    UID: "1000"

  service:
    main:
      ports:
        http:
          enabled: true
          port: 17170
        ldap:
          enabled: true
          port: 389
          targetPort: 3890

  ingress:
    main:
      enabled: true
      ingressClassName: nginx
      hosts:
        - host: lldap.example.com
          paths:
            - path: /
              pathType: Prefix
              service:
                port: 17170

  persistence:
    secrets:
      enabled: true
      type: secret
      name: lldap
      defaultMode: 0440

  probes:
    liveness:
      enabled: true
      custom: true
      spec:
        httpGet:
          path: /
          port: http

and then you can create a secret with corresponding fields:

kind: Secret
apiVersion: v1
metadata:
  name: lldap
  namespace: auth
type: Opaque
stringData:
  database-url: 'postgres://lldap:[email protected]:5432/lldap'
  jwt-secret: abcd
  key-file: efgh
  smtp-password: ijkl
  user-password: mnop