Repository navigation
Conversation
…r access Pass apiKey/readOnlyApiKey valueFrom to Qdrant as QDRANT__SERVICE__* env vars instead of copying the secret with lookup, which returns nothing under ArgoCD/helm template and left Qdrant without auth. Only create and mount the chart secret for string or generated keys; point ServiceMonitor at the user's secret.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #249, fixes #346
Problem
With
apiKey.valueFrom.secretKeyRef(orreadOnlyApiKey.valueFrom), the chart usedlookupto copy thereferenced secret into
<release>-apikey. Without cluster access during rendering (ArgoCD, Flux,helm template)lookupreturns nothing, so the secret is created empty,local.yamlis mounted as anempty directory and Qdrant starts without authentication, while ArgoCD reports Synced/Healthy.
Change
valueFromkeys to Qdrant asQDRANT__SERVICE__API_KEY/QDRANT__SERVICE__READ_ONLY_API_KEYenv vars, so the kubelet reads the user's secret at pod start. Nothing is read from the cluster at render time.
<release>-apikeywhen it holds a string or generated (true) key.credentialspoint at the user's secret whenvalueFromis used.truekeys render exactly as before.Testing
make lint,make test-unit,make test-integration(32/32 pass)test/integration/external_api_key_template.bats: deploys withhelm template | kubectl applyand checkscorrect key → 200, no key / wrong key → 401. The 401 checks fail on
main(200) and pass with this change.external_api_key.bats.apiKey.valueFrom: onmain, no key / wrong key → 200; with this branch → 401, correct key → 200.Notes for users upgrading
<release>-apikeysecret is no longer part of the chart when onlyvalueFromkeys are used.Helm removes it on upgrade; ArgoCD shows it as OutOfSync until it is pruned.
helm upgradewhen only the referenced secret changes; restart them or use a tool like Reloader.