Skip to content

Commit 0cdd1d9

Browse files
maor-rozenfeldCopilot
maor-rozenfeld
and
Copilot
authored
Resolve external secrets by convention (#26)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 2212433 commit 0cdd1d9

8 files changed

Lines changed: 99 additions & 121 deletions

‎chart/templates/_helpers.tpl‎

Lines changed: 55 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -143,11 +143,16 @@ Secret name used to store sensitive environment variables.
143143
{{- end }}
144144

145145
{{/*
146-
Determine if an environment variable name should be treated as a secret.
146+
Determine if an environment variable should be treated as a secret.
147+
A key is a secret if it exists in openopsEnvSecrets or its value references openopsEnvSecrets.
148+
Expected dict: { "root": $, "key": "ENV_VAR", "value": "some-value" }
147149
*/}}
148150
{{- define "openops.isSecretKey" -}}
149-
{{- $key := upper . -}}
150-
{{- if or (contains "PASSWORD" $key) (contains "SECRET" $key) (contains "KEY" $key) (contains "LOGZIO_TOKEN" $key) -}}
151+
{{- $root := .root -}}
152+
{{- $key := .key -}}
153+
{{- $value := .value | default "" | toString -}}
154+
{{- $secrets := default (dict) $root.Values.openopsEnvSecrets -}}
155+
{{- if or (hasKey $secrets $key) (contains ".Values.openopsEnvSecrets." $value) -}}
151156
true
152157
{{- else -}}
153158
false
@@ -162,12 +167,13 @@ Expected dict: { "root": $, "key": "ENV", "value": "value" }
162167
{{- $root := .root -}}
163168
{{- $key := .key -}}
164169
{{- $value := .value -}}
165-
{{- if eq (include "openops.isSecretKey" $key) "true" -}}
170+
{{- if eq (include "openops.isSecretKey" (dict "root" $root "key" $key "value" $value)) "true" -}}
166171
- name: {{ $key }}
167172
valueFrom:
168173
secretKeyRef:
169174
name: {{ include "openops.secretName" $root }}
170175
key: {{ $key }}
176+
optional: true
171177
{{- else -}}
172178
- name: {{ $key }}
173179
value: {{ tpl (tpl $value $root) $root | quote }}
@@ -189,7 +195,43 @@ Expected dict: { "root": $, "env": dict }
189195
{{- end }}
190196

191197
{{/*
192-
Render deployment strategy
198+
Resolve the AWS Secrets Manager property name for a secret key.
199+
For standalone keys (in openopsEnvSecrets), the property is the key itself.
200+
For derived keys (in tables/analytics/etc), the value is a template ref like
201+
"{{ .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD }}" - extract the referenced key name.
202+
Expected dict: { "key": "DATABASE_PASSWORD", "value": "{{ .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD }}" }
203+
*/}}
204+
{{- define "openops.secretPropertyName" -}}
205+
{{- $key := .key -}}
206+
{{- $value := .value | toString -}}
207+
{{- if contains ".Values.openopsEnvSecrets." $value -}}
208+
{{- $value | trimPrefix "{{" | trimPrefix " " | trimSuffix "}}" | trimSuffix " " | trimPrefix ".Values.openopsEnvSecrets." -}}
209+
{{- else -}}
210+
{{- $key -}}
211+
{{- end -}}
212+
{{- end }}
213+
214+
{{/*
215+
Collect ExternalSecret data entries for all secret keys in an env map.
216+
Emits YAML list items for keys that are secrets (in openopsEnvSecrets or referencing it).
217+
Expected dict: { "root": $, "env": dict, "secretName": "my-secret" }
218+
*/}}
219+
{{- define "openops.collectSecretEntries" -}}
220+
{{- $root := .root -}}
221+
{{- $env := .env -}}
222+
{{- $secretName := .secretName -}}
223+
{{- range $k := keys $env | sortAlpha -}}
224+
{{- $v := index $env $k -}}
225+
{{- if eq (include "openops.isSecretKey" (dict "root" $root "key" $k "value" ($v | toString))) "true" }}
226+
- secretKey: {{ $k }}
227+
remoteRef:
228+
key: {{ $secretName }}
229+
property: {{ include "openops.secretPropertyName" (dict "key" $k "value" ($v | toString)) }}
230+
{{- end -}}
231+
{{- end -}}
232+
{{- end }}
233+
234+
{{/*
193235
*/}}
194236
{{- define "openops.deploymentStrategy" -}}
195237
{{- if .Values.global.strategy }}
@@ -293,26 +335,26 @@ Validate that required secrets are configured - ALWAYS ENFORCED
293335
{{- /* Skip validation if using an external secret manager */ -}}
294336
{{- $usingExistingSecret := and .Values.secretEnv .Values.secretEnv.existingSecret (not .Values.secretEnv.create) -}}
295337
{{- if not $usingExistingSecret -}}
296-
{{- $encKey := .Values.openopsEnv.OPS_ENCRYPTION_KEY -}}
338+
{{- $encKey := .Values.openopsEnvSecrets.OPS_ENCRYPTION_KEY -}}
297339
{{- if not $encKey -}}
298-
{{- fail "ERROR: OPS_ENCRYPTION_KEY is required. Generate with: openssl rand -hex 32" -}}
340+
{{- fail "ERROR: OPS_ENCRYPTION_KEY is required. Generate with: openssl rand -hex 16" -}}
299341
{{- end -}}
300342
{{- if ne (len $encKey) 32 -}}
301343
{{- fail "ERROR: OPS_ENCRYPTION_KEY must be exactly 32 hex characters" -}}
302344
{{- end -}}
303-
{{- if not .Values.openopsEnv.OPS_JWT_SECRET -}}
304-
{{- fail "ERROR: OPS_JWT_SECRET is required. Generate with: openssl rand -hex 32" -}}
345+
{{- if not .Values.openopsEnvSecrets.OPS_JWT_SECRET -}}
346+
{{- fail "ERROR: OPS_JWT_SECRET is required. Generate with: openssl rand -hex 16" -}}
305347
{{- end -}}
306-
{{- if not .Values.openopsEnv.OPS_OPENOPS_ADMIN_PASSWORD -}}
348+
{{- if not .Values.openopsEnvSecrets.OPS_OPENOPS_ADMIN_PASSWORD -}}
307349
{{- fail "ERROR: OPS_OPENOPS_ADMIN_PASSWORD is required. Use a strong password" -}}
308350
{{- end -}}
309-
{{- if not .Values.openopsEnv.OPS_POSTGRES_PASSWORD -}}
351+
{{- if not .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD -}}
310352
{{- fail "ERROR: OPS_POSTGRES_PASSWORD is required. Use a strong password" -}}
311353
{{- end -}}
312-
{{- if not .Values.openopsEnv.OPS_ANALYTICS_ADMIN_PASSWORD -}}
354+
{{- if not .Values.openopsEnvSecrets.OPS_ANALYTICS_ADMIN_PASSWORD -}}
313355
{{- fail "ERROR: OPS_ANALYTICS_ADMIN_PASSWORD is required. Use a strong password" -}}
314356
{{- end -}}
315-
{{- if not .Values.openopsEnv.ANALYTICS_POWERUSER_PASSWORD -}}
357+
{{- if not .Values.openopsEnvSecrets.ANALYTICS_POWERUSER_PASSWORD -}}
316358
{{- fail "ERROR: ANALYTICS_POWERUSER_PASSWORD is required. Use a strong password" -}}
317359
{{- end -}}
318360
{{- end -}}

‎chart/templates/deployment-app.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ spec:
7474
- name: OPS_COMPONENT
7575
value: app
7676
{{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnv) | nindent 12 }}
77+
{{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnvSecrets) | nindent 12 }}
7778
ports:
7879
- containerPort: 80
7980
name: http

‎chart/templates/deployment-engine.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ spec:
5757
- name: OPS_COMPONENT
5858
value: engine
5959
{{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnv) | nindent 12 }}
60+
{{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnvSecrets) | nindent 12 }}
6061
{{ include "openops.renderEnv" (dict "root" . "env" .Values.engine.env) | nindent 12 }}
6162
ports:
6263
- containerPort: 3005

‎chart/templates/external-secret.yaml‎

Lines changed: 10 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -41,91 +41,14 @@ spec:
4141
name: {{ .Values.secretEnv.existingSecret | default "openops-env" }}
4242
creationPolicy: Owner
4343
data:
44-
- secretKey: OPS_ENCRYPTION_KEY
45-
remoteRef:
46-
key: {{ .Values.externalSecrets.secretName }}
47-
property: OPS_ENCRYPTION_KEY
48-
- secretKey: OPS_JWT_SECRET
49-
remoteRef:
50-
key: {{ .Values.externalSecrets.secretName }}
51-
property: OPS_JWT_SECRET
52-
- secretKey: OPS_POSTGRES_PASSWORD
53-
remoteRef:
54-
key: {{ .Values.externalSecrets.secretName }}
55-
property: OPS_POSTGRES_PASSWORD
56-
- secretKey: OPS_OPENOPS_ADMIN_PASSWORD
57-
remoteRef:
58-
key: {{ .Values.externalSecrets.secretName }}
59-
property: OPS_OPENOPS_ADMIN_PASSWORD
60-
- secretKey: OPS_ANALYTICS_ADMIN_PASSWORD
61-
remoteRef:
62-
key: {{ .Values.externalSecrets.secretName }}
63-
property: OPS_ANALYTICS_ADMIN_PASSWORD
64-
- secretKey: ANALYTICS_POWERUSER_PASSWORD
65-
remoteRef:
66-
key: {{ .Values.externalSecrets.secretName }}
67-
property: ANALYTICS_POWERUSER_PASSWORD
68-
- secretKey: OPS_SLACK_APP_SIGNING_SECRET
69-
remoteRef:
70-
key: {{ .Values.externalSecrets.secretName }}
71-
property: OPS_SLACK_APP_SIGNING_SECRET
72-
- secretKey: OPS_LOGZIO_TOKEN
73-
remoteRef:
74-
key: {{ .Values.externalSecrets.secretName }}
75-
property: OPS_LOGZIO_TOKEN
76-
- secretKey: OPS_OPENOPS_ADMIN_PASSWORD_SALT
77-
remoteRef:
78-
key: {{ .Values.externalSecrets.secretName }}
79-
property: OPS_OPENOPS_ADMIN_PASSWORD_SALT
80-
- secretKey: OPS_LANGFUSE_PUBLIC_KEY
81-
remoteRef:
82-
key: {{ .Values.externalSecrets.secretName }}
83-
property: OPS_LANGFUSE_PUBLIC_KEY
84-
- secretKey: OPS_LANGFUSE_SECRET_KEY
85-
remoteRef:
86-
key: {{ .Values.externalSecrets.secretName }}
87-
property: OPS_LANGFUSE_SECRET_KEY
88-
- secretKey: OPS_SSO_FRONTEGG_PUBLIC_KEY
89-
remoteRef:
90-
key: {{ .Values.externalSecrets.secretName }}
91-
property: OPS_SSO_FRONTEGG_PUBLIC_KEY
92-
# Tables derived keys
93-
- secretKey: LOGZIO_TOKEN
94-
remoteRef:
95-
key: {{ .Values.externalSecrets.secretName }}
96-
property: OPS_LOGZIO_TOKEN
97-
- secretKey: OPENOPS_ADMIN_PASSWORD_SALT
98-
remoteRef:
99-
key: {{ .Values.externalSecrets.secretName }}
100-
property: OPS_OPENOPS_ADMIN_PASSWORD_SALT
101-
# Tables (Baserow) derived keys
102-
- secretKey: BASEROW_ADMIN_PASSWORD
103-
remoteRef:
104-
key: {{ .Values.externalSecrets.secretName }}
105-
property: OPS_OPENOPS_ADMIN_PASSWORD
106-
- secretKey: BASEROW_JWT_SIGNING_KEY
107-
remoteRef:
108-
key: {{ .Values.externalSecrets.secretName }}
109-
property: OPS_JWT_SECRET
110-
- secretKey: SECRET_KEY
111-
remoteRef:
112-
key: {{ .Values.externalSecrets.secretName }}
113-
property: OPS_ENCRYPTION_KEY
114-
- secretKey: DATABASE_PASSWORD
115-
remoteRef:
116-
key: {{ .Values.externalSecrets.secretName }}
117-
property: OPS_POSTGRES_PASSWORD
118-
# Analytics (Superset) derived keys
119-
- secretKey: ADMIN_PASSWORD
120-
remoteRef:
121-
key: {{ .Values.externalSecrets.secretName }}
122-
property: OPS_ANALYTICS_ADMIN_PASSWORD
123-
- secretKey: POWERUSER_PASSWORD
124-
remoteRef:
125-
key: {{ .Values.externalSecrets.secretName }}
126-
property: ANALYTICS_POWERUSER_PASSWORD
127-
- secretKey: SUPERSET_SECRET_KEY
128-
remoteRef:
129-
key: {{ .Values.externalSecrets.secretName }}
130-
property: SUPERSET_SECRET_KEY
44+
{{- $allEnv := dict -}}
45+
{{- range $k, $v := .Values.openopsEnvSecrets }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}
46+
{{- range $k, $v := .Values.openopsEnv }}{{ if not (hasKey $allEnv $k) }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}{{ end }}
47+
{{- range $k, $v := .Values.tables.env }}{{ if not (hasKey $allEnv $k) }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}{{ end }}
48+
{{- range $k, $v := .Values.analytics.env }}{{ if not (hasKey $allEnv $k) }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}{{ end }}
49+
{{- range $k, $v := .Values.postgres.env }}{{ if not (hasKey $allEnv $k) }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}{{ end }}
50+
{{- if .Values.engine }}{{- if .Values.engine.env }}
51+
{{- range $k, $v := .Values.engine.env }}{{ if not (hasKey $allEnv $k) }}{{ $_ := set $allEnv $k ($v | toString) }}{{ end }}{{ end }}
52+
{{- end }}{{- end }}
53+
{{- include "openops.collectSecretEntries" (dict "root" $ "env" $allEnv "secretName" .Values.externalSecrets.secretName) }}
13154
{{- end }}

‎chart/templates/secret-env.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@
1010
{{- $existingSecret := default "" $secretSettings.existingSecret -}}
1111
{{- if and $create (not $existingSecret) -}}
1212
{{- $autoSecretData := dict -}}
13-
{{- $envSources := list .Values.openopsEnv .Values.engine.env .Values.tables.env .Values.analytics.env .Values.postgres.env -}}
13+
{{- $envSources := list .Values.openopsEnvSecrets .Values.openopsEnv .Values.engine.env .Values.tables.env .Values.analytics.env .Values.postgres.env -}}
1414
{{- range $env := $envSources }}
1515
{{- if $env }}
1616
{{- range $k, $v := $env }}
17-
{{- if eq (include "openops.isSecretKey" $k) "true" }}
17+
{{- if eq (include "openops.isSecretKey" (dict "root" $root "key" $k "value" ($v | toString))) "true" }}
1818
{{- /* Double-tpl allows recursive variable resolution, e.g., "{{ .Values.foo }}" can contain "{{ .Values.bar }}" */ -}}
1919
{{- $_ := set $autoSecretData $k (tpl (tpl $v $root) $root) }}
2020
{{- end }}

‎chart/values.ci.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ global:
1616
enabled: false
1717

1818
# CI test secrets (not for production)
19-
openopsEnv:
19+
openopsEnvSecrets:
2020
OPS_ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef"
2121
OPS_JWT_SECRET: "ci-jwt-secret-not-for-production"
2222
OPS_OPENOPS_ADMIN_PASSWORD: "ci-admin123"

‎chart/values.overrides-example.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ global:
66

77
openopsEnv:
88
OPS_OPENOPS_ADMIN_EMAIL: openops@example.com
9+
10+
openopsEnvSecrets:
911
OPS_OPENOPS_ADMIN_PASSWORD: 9wqhK7jehmxAQlre
1012
OPS_ENCRYPTION_KEY: 7de996f020438444dc2c79e9b843805d
1113
OPS_JWT_SECRET: M72yCOp9riLjIDws

‎chart/values.yaml‎

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,8 @@ openopsEnv:
9797
OPS_OPENOPS_TABLES_VERSION: "{{ .Values.tables.tag }}"
9898
OPS_ANALYTICS_VERSION: "{{ .Values.analytics.tag }}"
9999

100-
# Authentication - REQUIRED, NO DEFAULTS
101-
# Generate secure values with: openssl rand -hex 32
102-
OPS_ENCRYPTION_KEY: "" # REQUIRED: 32-character hex string
103-
OPS_JWT_SECRET: "" # REQUIRED: Random secret string
100+
# Authentication
104101
OPS_OPENOPS_ADMIN_EMAIL: admin@openops.com
105-
OPS_OPENOPS_ADMIN_PASSWORD: "" # REQUIRED: Strong password
106102

107103
# Telemetry
108104
OPS_LOG_LEVEL: info
@@ -125,7 +121,6 @@ openopsEnv:
125121
OPS_POSTGRES_HOST: '{{ include "openops.postgresHost" . }}'
126122
OPS_POSTGRES_PORT: '{{ include "openops.postgresPort" . }}'
127123
OPS_POSTGRES_USERNAME: postgres
128-
OPS_POSTGRES_PASSWORD: "" # REQUIRED: Strong password
129124

130125
# Tables
131126
OPS_OPENOPS_TABLES_DATABASE_NAME: tables
@@ -139,18 +134,32 @@ openopsEnv:
139134
# Analytics
140135
OPS_ANALYTICS_PUBLIC_URL: '{{ include "openops.publicUrl" . }}'
141136
OPS_ANALYTICS_PRIVATE_URL: '{{ include "openops.analyticsServiceUrl" . }}'
142-
OPS_ANALYTICS_ADMIN_PASSWORD: "" # REQUIRED: Strong password
143-
ANALYTICS_POWERUSER_PASSWORD: "" # REQUIRED: Strong password
144137
ANALYTICS_ALLOW_ADHOC_SUBQUERY: "true"
145138

146139
# AWS
147140
OPS_AWS_ENABLE_IMPLICIT_ROLE: "false"
148141

149142
# Blocks custom settings
150143
OPS_CODE_BLOCK_MEMORY_LIMIT_IN_MB: "256"
151-
OPS_SLACK_APP_SIGNING_SECRET: ""
152144
OPS_SLACK_ENABLE_INTERACTIONS: "true"
153145

146+
# Secret environment variables
147+
# Any var in this section is treated as a secret (stored in K8s Secret, referenced via secretKeyRef).
148+
# Generate secure values with: openssl rand -hex 16
149+
openopsEnvSecrets:
150+
OPS_ENCRYPTION_KEY: "" # REQUIRED: 32-character hex string (openssl rand -hex 16)
151+
OPS_JWT_SECRET: "" # REQUIRED: Random secret string
152+
OPS_OPENOPS_ADMIN_PASSWORD: "" # REQUIRED: Strong password
153+
OPS_POSTGRES_PASSWORD: "" # REQUIRED: Strong password
154+
OPS_ANALYTICS_ADMIN_PASSWORD: "" # REQUIRED: Strong password
155+
ANALYTICS_POWERUSER_PASSWORD: "" # REQUIRED: Strong password
156+
OPS_SLACK_APP_SIGNING_SECRET: ""
157+
SUPERSET_SECRET_KEY: "thisISaSECRET_1234"
158+
OPS_LOGZIO_TOKEN: ""
159+
OPS_LANGFUSE_PUBLIC_KEY: ""
160+
OPS_LANGFUSE_SECRET_KEY: ""
161+
OPS_SSO_FRONTEGG_PUBLIC_KEY: ""
162+
154163
secretEnv:
155164
create: true
156165
existingSecret: ""
@@ -276,10 +285,10 @@ tables:
276285
BASEROW_PUBLIC_URL: "{{ .Values.openopsEnv.OPS_OPENOPS_TABLES_PUBLIC_URL }}"
277286
BASEROW_PRIVATE_URL: "{{ .Values.openopsEnv.OPS_OPENOPS_TABLES_API_URL }}"
278287
BASEROW_EXTRA_ALLOWED_HOSTS: '*'
279-
SECRET_KEY: "{{ .Values.openopsEnv.OPS_ENCRYPTION_KEY }}"
280-
BASEROW_JWT_SIGNING_KEY: "{{ .Values.openopsEnv.OPS_JWT_SECRET }}"
288+
SECRET_KEY: "{{ .Values.openopsEnvSecrets.OPS_ENCRYPTION_KEY }}"
289+
BASEROW_JWT_SIGNING_KEY: "{{ .Values.openopsEnvSecrets.OPS_JWT_SECRET }}"
281290
BASEROW_ADMIN_USERNAME: "{{ .Values.openopsEnv.OPS_OPENOPS_ADMIN_EMAIL }}"
282-
BASEROW_ADMIN_PASSWORD: "{{ .Values.openopsEnv.OPS_OPENOPS_ADMIN_PASSWORD }}"
291+
BASEROW_ADMIN_PASSWORD: "{{ .Values.openopsEnvSecrets.OPS_OPENOPS_ADMIN_PASSWORD }}"
283292
BASEROW_REFRESH_TOKEN_LIFETIME_HOURS: "{{ .Values.openopsEnv.OPS_JWT_TOKEN_LIFETIME_HOURS }}"
284293
BASEROW_ACCESS_TOKEN_LIFETIME_MINUTES: "{{ .Values.openopsEnv.OPS_TABLES_TOKEN_LIFETIME_MINUTES }}"
285294
SYNC_TEMPLATES_ON_STARTUP: 'false'
@@ -289,7 +298,7 @@ tables:
289298
DATABASE_HOST: "{{ .Values.openopsEnv.OPS_POSTGRES_HOST }}"
290299
DATABASE_PORT: "{{ .Values.openopsEnv.OPS_POSTGRES_PORT }}"
291300
DATABASE_USER: "{{ .Values.openopsEnv.OPS_POSTGRES_USERNAME }}"
292-
DATABASE_PASSWORD: "{{ .Values.openopsEnv.OPS_POSTGRES_PASSWORD }}"
301+
DATABASE_PASSWORD: "{{ .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD }}"
293302
REDIS_URL: '{{ include "openops.redisUrl" . }}'
294303
storage:
295304
size: 10Gi
@@ -336,17 +345,17 @@ analytics:
336345
port: 8088
337346
path: /health
338347
env:
339-
ADMIN_PASSWORD: "{{ .Values.openopsEnv.OPS_ANALYTICS_ADMIN_PASSWORD }}"
340-
POWERUSER_PASSWORD: "{{ .Values.openopsEnv.ANALYTICS_POWERUSER_PASSWORD }}"
348+
ADMIN_PASSWORD: "{{ .Values.openopsEnvSecrets.OPS_ANALYTICS_ADMIN_PASSWORD }}"
349+
POWERUSER_PASSWORD: "{{ .Values.openopsEnvSecrets.ANALYTICS_POWERUSER_PASSWORD }}"
341350
GUNICORN_LOGLEVEL: 'debug'
342351
DATABASE_DIALECT: 'postgresql'
343352
DATABASE_DB: 'analytics'
344353
DATABASE_HOST: "{{ .Values.openopsEnv.OPS_POSTGRES_HOST }}"
345354
DATABASE_PORT: "{{ .Values.openopsEnv.OPS_POSTGRES_PORT }}"
346355
DATABASE_USER: "{{ .Values.openopsEnv.OPS_POSTGRES_USERNAME }}"
347-
DATABASE_PASSWORD: "{{ .Values.openopsEnv.OPS_POSTGRES_PASSWORD }}"
356+
DATABASE_PASSWORD: "{{ .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD }}"
348357
DATABASE_HOST_ALT: "{{ .Values.openopsEnv.OPS_OPENOPS_TABLES_DB_HOST }}"
349-
SUPERSET_SECRET_KEY: "{{ .Values.openopsEnv.OPS_ENCRYPTION_KEY }}"
358+
SUPERSET_SECRET_KEY: "{{ .Values.openopsEnvSecrets.SUPERSET_SECRET_KEY }}"
350359
SUPERSET_FEATURE_ALLOW_ADHOC_SUBQUERY: '"{{ .Values.openopsEnv.ANALYTICS_ALLOW_ADHOC_SUBQUERY }}"'
351360
REDIS_HOST: "{{ .Values.openopsEnv.OPS_REDIS_HOST }}"
352361
REDIS_PORT: "{{ .Values.openopsEnv.OPS_REDIS_PORT }}"
@@ -391,7 +400,7 @@ postgres:
391400
env:
392401
maxConnections: "300"
393402
POSTGRES_USER: "{{ .Values.openopsEnv.OPS_POSTGRES_USERNAME }}"
394-
POSTGRES_PASSWORD: "{{ .Values.openopsEnv.OPS_POSTGRES_PASSWORD }}"
403+
POSTGRES_PASSWORD: "{{ .Values.openopsEnvSecrets.OPS_POSTGRES_PASSWORD }}"
395404
POSTGRES_DB: "{{ .Values.openopsEnv.OPS_POSTGRES_DATABASE }}"
396405
# Authentication configuration
397406
auth:

0 commit comments

Comments
 (0)