search

camunda / camunda-platform-helm

Camunda Platform 8 Self-Managed Helm charts
https://docs.camunda.io/docs/self-managed/overview/
Apache License 2.0
74 stars 139 forks source link

[ISSUE] RESTAPI_PUSHER_SECRET does not allow you to reference a differently-named k8s Secret #2281

Open jessesimpson36 opened 3 months ago

jessesimpson36 commented 3 months ago

Describe the issue:

In https://github.com/camunda/camunda-platform-helm/issues/644

we wanted to define a configuration that would use existingSecret for all components. one set of secretKeyRef's in the webmodeler restapi appears to not have a configurable secret name.

https://github.com/camunda/camunda-platform-helm/blob/e9ffb23292a0a3886cb4612a0e09d594dc7d32d4/charts/camunda-platform-latest/templates/web-modeler/deployment-restapi.yaml#L54-L68

A workaround to this would be to set 

webModeler:
  restapi:
    env:
      - name: RESTAPI_PUSHER_SECRET
        valueFrom:
          secretKeyRef:
            name: name-of-different-secret
            key: pusher-app-secret

Actual behavior:

RESTAPI_PUSHER_SECRET uses RELEASE-web-modeler for the secret name regardless of whether all existingSecrets are defined explicitly.

Expected behavior:

I expect that I can reference a Secret for any references of secretKeyRef.

How to reproduce:

Logs:

Environment:

Please note: Without the following info, it's hard to resolve the issue and probably it will be closed.

jessesimpson36 commented 3 months ago

This is related to

1898 and #2277 and overall product-hub ticket https://github.com/camunda/product-hub/issues/2312

daniel-ewing commented 3 months ago

Hi @jessesimpson36, have you tested this with CHC 10.3.2? It did not work for me:

image

image

jessesimpson36 commented 3 months ago

You are referencing the kubectl describe information, which doesn't properly display duplicate environment variables. I would suggest testing the functionality, or exec'ing into the pod to see what environment variable you actually have referenced.

But I admit I have not yet tested this workaround.

jessesimpson36 commented 3 months ago

I created a secret with 

kubectl  create secret generic --from-literal pusher-app-secret=jesseishacker name-of-different-secret

and exec'd into the restapi pod and confirmed the env var is set properly.

~ $ env | grep PUSHER
RESTAPI_PUSHER_SECRET=jesseishacker

I have now tested the workaround.

daniel-ewing commented 2 months ago

Confirmed the alternate solution in 10.3.2 using:

webModeler:
  restapi:
    env:
      - name: RESTAPI_PUSHER_SECRET
        valueFrom:
          secretKeyRef:
            name: name-of-different-secret
            key: pusher-app-secret