search

openobserve / openobserve-helm-chart

Helm charts for OpenObserve
Apache License 2.0
26 stars 28 forks source link

Remove secrets from configmap.yaml #44

Open julienkosinski opened 6 months ago

julienkosinski commented 6 months ago

Hello,

It seems that multiple secrets remains in the configmap.yaml. Here are some variables that seems to be secret to me, please correct me if I'm wrong.

What do you think about it?

https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L21 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L31 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L32 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L46 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L49 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L52 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L122 https://github.com/openobserve/openobserve-helm-chart/blob/01801e42b1a1297abdebbdf803801454dd97503b/charts/openobserve/templates/configmap.yaml#L165

Thank you very much.

prabhatsharma commented 6 months ago

Thanks for pointing out variable @julienkosinski . These should definitely be in secrets. Others are not a problem.

ZO_META_POSTGRES_DSN
ZO_META_MYSQL_DSN
O2_DEX_CLIENT_SECRET

ETCD does not store any data and others are not secrets. We should definitely get the above moved to secrets.

julienkosinski commented 4 months ago

Thank you @prabhatsharma for the clarification!

julienkosinski commented 4 months ago

So those need to be in the auth section so that they can also be used with the new externalSecret, am I right? https://github.com/openobserve/openobserve-helm-chart/issues/45#issuecomment-2121289110

Maybe it would need a externalEnterpriseSecret for O2_DEX_CLIENT_SECRET, what do you think?

The new postgres section needs to be considered too.