Hey I would like to commit my helm values files to git but I

Question

Hey I would like to commit my helm values files to git but I m not feeling comfortable to commit passwords Is it possible to turn off secret generation for helm generated secret files like `postgresql password` in the official helm chart

Noah K · Answer

I m not sure I see any generation

Noah K · Answer

I populates the secret if a value is present but that s it

szalai1 · Answer

If I remove the password it still generates a secret config regardless using the default secret `test`

Noah K · Answer

Sure I guess I m not sure what you re asking for

Noah K · Answer

Helm doesn t really offer a way around having secrets in the clear in your values Best bet is the helm secrets plugin and encrypting them before committing usually leave the bulk of it in plain and have just the secret values in their own encrypted file

szalai1 · Answer

That s fine what I want is the ability to exclude the generated secret or override it

Noah K · Answer

The chart does not support that directly You can override it with an output filter though

Noah K · Answer

szalai1 · Answer

thanks this is exactly what I m thinking about using kustomize to post process the manifest

szalai1 · Answer

thanks a lot for helping +1

Noah K · Answer

+1 Just beware that Kustomize mostly can t knock out whole objects

Noah K · Answer

Which can be annoying if you want to use SealedSecrets or similar

szalai1 · Answer

I just need to add an annotation that the secret is managed by kubeseal

szalai1 · Answer

so the sealedsecret can overwrite it

Noah K · Answer

If you re using Helm manually yes If you re using something like Argo or Flux you can get cranky sync behavior slightly smiling face

Noah K · Answer

with argo you can set a Skip annotation on the secret

szalai1 · Answer

I m using argo Found this as well <https dev to camptocamp ops use kustomize to post render helm charts in argocd 2ml6>

Noah K · Answer

Okay so what you probably want instead is `<http argocd argoproj io hook|argocd argoproj io hook> Skip`

Noah K · Answer

That makes Argo pretend the object is always in sync and ignore it slightly smiling face

szalai1 · Answer

but I still need kustomize to put on the secret right

Noah K · Answer

Yeah I mean you need some kind of post render filter and kustomize is probably the easiest slightly smiling face

Noah K · Answer

If you want to write a sed command from hell more power to ya wink

szalai1 · Answer

tempting but I already spent too much time on this smile

Noah K · Answer

Piecing together a good secrets workflow is definitely one of my least favorite parts of k8s

Noah K · Answer

Not sure I would even call sealed secrets good but it s what we have so it goes

szalai1 · Answer

same here sealed secrets make it work but if you want to change it something

Matyas Tamas · Answer

the sed command from hell solution isn t actually that bad if you use `envsubst` There s probably a better way to do this but I ve been using local env variable substitution and made some scripts for pulling env values to a env file e g `source env amp amp helm upgrade install dagster release dagster dagster f lt envsubst lt values yaml `

Matyas Tamas · Answer

values yaml just has env variables in it for substitution e g `postgresqlPassword $ DAGSTER PG PASSWORD `

szalai1 · Answer

thanks for sharing

William Sheu · Answer

i also ran into this I ended up just forking the helm chart and making some changes to allow passing in an independent secret for postgres <https github com PenguinToast dagster commit c99d2f34c15aa7fec29d25e7294a8fa5d9699365>

William Sheu · Answer

but never got around to making a proper PR for this change

rex · Answer

ah nice < William Sheu> made a similar change with the introduction of ` Values global postgresSecretName` to pass down the secret name to one of our subcharts

rex · Answer

just need to add a toggle to disable generating the secret in our helm chart

William Sheu · Answer

< rex> made a pull request here wasn t sure where to put the toggle value didn t really make sense in either `global` or in `postgresql` since that specifies subchart values happy to make changes here if you think there s a better place for it