Fix: Duplicate Env Between Config Secrets - #2445
Conversation
secretRef is listed after configMapRef in every deployment's envFrom, so a key declared in both silently overrides the chart value and makes values-*.yaml edits look like no-ops. Verified each duplicate against Secret Manager before removing: all matched the chart value exactly, so this is not a behavior change. Adds a CI check so a new overlap fails lint instead of shipping silently. Closes #2420 Signed-off-by: Md Asaduzzaman Miah <asad.miah@rhesis.ai>
RHESIS_ADMIN_PASSWORD, RHESIS_USER_PASSWORD, and ANALYTICS_USER_PASSWORD are projected into the rhesis-app-secrets Secret but are not read by the Helm chart, backend, frontend, SDK, or Terraform anywhere. They match the Cloud SQL root/user passwords byte-for-byte, so they are leftovers from before the move to in-cluster Postgres/CNPG, superseded by ADMIN_DB_PASS/APP_DB_PASS/ANALYTICS_DB_PASS. The Secret Manager entries are left in place; only the ExternalSecret wiring is removed. Signed-off-by: Md Asaduzzaman Miah <asad.miah@rhesis.ai>
|
Overall this looks like a solid fix: removing non-secret keys from ExternalSecrets (so values-*.yaml changes aren’t silently overridden) + adding a CI guardrail is a good approach. One concern: Improvement:
Found 1 issue (0 critical, 1 improvement). |
![peqy[bot]](https://avatars.githubusercontent.com/in/1930020?s=60&v=4){kind=small}
| secrets_file="kubernetes/clusters/$env/external-secrets/rhesis-app-secrets.yaml" | ||
| cm_keys=$( | ||
| helm template rhesis charts/rhesis -f "charts/rhesis/values-$env.yaml" \ | ||
| | awk '/kind: ConfigMap/,/^---/' \ |
There was a problem hiding this comment.
Improvement: awk '/kind: ConfigMap/,/^---/' will grab the first ConfigMap in the helm template output, which may come from a dependency chart (postgresql/valkey/otel) depending on render order, and could also run to EOF if there’s no trailing ---.
Fix: target the rhesis ConfigMap explicitly, e.g.
helm template ... --show-only templates/configmap.yaml | grep ..., or select bymetadata.name: rhesis-configbefore extractingdatakeys.
There was a problem hiding this comment.
Good fix — helm template ... --show-only templates/configmap.yaml cleanly targets the chart’s ConfigMap and avoids subchart render-order issues. This addresses my earlier concern.
awk '/kind: ConfigMap/,/^---/' re-triggers for every ConfigMap in the combined helm template output, including subchart ConfigMaps (postgresql/valkey/otel) depending on render order, and could run past EOF if a block has no trailing ---. Use --show-only templates/configmap.yaml to isolate the chart's own ConfigMap instead. Signed-off-by: Md Asaduzzaman Miah <asad.miah@rhesis.ai>
|
Looks good. Removing non-secret keys from ExternalSecrets + adding the Helm |
…ween-config-secrets Signed-off-by: Md Asaduzzaman Miah <asad.miah@rhesis.ai> # Conflicts: # kubernetes/clusters/dev/external-secrets/rhesis-app-secrets.yaml
1 participant
This PR introduces changes from the
fix/duplicate-env-between-config-secretsbranch.📝 Summary
📁 Files Changed ( 5 files)
📋 Commit Details
✅ Checklist
🧪 Testing
📸 Screenshots (if applicable)
🔗 Related Issues