paperless: Only PAPERLESS_SECRET_KEY mounted when using an existing secret? about helm-charts HOT 4 CLOSED

I just released paperless-4.2.0 which should allow you to specify the values directly via the env block and valueFrom as mentioned above. 📦

from helm-charts.

I just released paperless-4.2.0 which should allow you to specify the values directly via the env block and valueFrom as mentioned above. 📦

Thanks, I just tested and it works flawlessly!

from helm-charts.

Hmmm, leaving secret.create set to false, but adding keys to the secret.values part actually adds the necessary parts:

values.yaml

secret:                                                                                                                                                                                                           
  existingSecret: 'paperless-admin'                                                                                                                                                                               
  values:                                                                                                                                                                                                         
    PAPERLESS_ADMIN_USER:                                                                                                                                                                                         
    PAPERLESS_ADMIN_PASSWORD:                                                                                                                                                                                     
    PAPERLESS_ADMIN_MAIL:                                                                                                                                                                                         
    PAPERLESS_URL:

Resulting deployment

    spec:                                                                                                                                                                                                         
      serviceAccountName: default                                                                                                                                                                                 
      containers:                                                                                                                                                                                                 
        - name: paperless                                                                                                                                                                                         
          image: "ghcr.io/paperless-ngx/paperless-ngx:1.14.5"                                                                                                                                                     
          imagePullPolicy: IfNotPresent                                                                                                                                                                           
          ports:                                                                                                                                                                                                  
            - name: http                                                                                                                                                                                          
              containerPort: 8000                                                                                                                                                                                 
              protocol: "TCP"                                                                                                                                                                                     
          env:                                                                                                                                                                                                    
            - name: "TZ"                                                                                                                                                                                          
              value: "UTC"                                                                                                                                                                                        
            - name: PAPERLESS_TIME_ZONE                                                                                                                                                                           
              value: "UTC"                                                                                                                                                                                        
            - name: PAPERLESS_CONSUMPTION_DIR                                                                                                                                                                     
              value: /consumption                                                                                                                                                                                 
            - name: PAPERLESS_REDIS                                                                                                                                                                               
              value: redis://paperless-redis:6379                                                                                                                                                                 
            - name: PAPERLESS_ADMIN_MAIL                                                                                                                                                                          
              valueFrom:          
                secretKeyRef:
                  name: paperless-admin    
                  key: PAPERLESS_ADMIN_MAIL
            - name: PAPERLESS_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef: 
                  name: paperless-admin
                  key: PAPERLESS_ADMIN_PASSWORD
            - name: PAPERLESS_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: paperless-admin
                  key: PAPERLESS_ADMIN_USER
            - name: PAPERLESS_SECRET_KEY                                                                 
              valueFrom:
                secretKeyRef:
                  name: paperless-admin
                  key: PAPERLESS_SECRET_KEY
            - name: PAPERLESS_URL
              valueFrom:      
                secretKeyRef:    
                  name: paperless-admin  
                  key: PAPERLESS_URL  
            - name: PAPERLESS_PORT    
              value: "8000"
          volumeMounts:

Not sure if that is intended behaviour. At least I would not have guessed it from the description...

from helm-charts.

Hi @ojkastl,

Hmmm, leaving secret.create set to false, but adding keys to the secret.values part actually adds the necessary parts:

values.yaml

secret:                                                                                                                                                                                                           
  existingSecret: 'paperless-admin'                                                                                                                                                                               
  values:                                                                                                                                                                                                         
    PAPERLESS_ADMIN_USER:                                                                                                                                                                                         
    PAPERLESS_ADMIN_PASSWORD:                                                                                                                                                                                     
    PAPERLESS_ADMIN_MAIL:                                                                                                                                                                                         
    PAPERLESS_URL:

Resulting deployment

    spec:                                                                                                                                                                                                         
      serviceAccountName: default                                                                                                                                                                                 
      containers:                                                                                                                                                                                                 
        - name: paperless                                                                                                                                                                                         
          image: "ghcr.io/paperless-ngx/paperless-ngx:1.14.5"                                                                                                                                                     
          imagePullPolicy: IfNotPresent                                                                                                                                                                           
          ports:                                                                                                                                                                                                  
            - name: http                                                                                                                                                                                          
              containerPort: 8000                                                                                                                                                                                 
              protocol: "TCP"                                                                                                                                                                                     
          env:                                                                                                                                                                                                    
            - name: "TZ"                                                                                                                                                                                          
              value: "UTC"                                                                                                                                                                                        
            - name: PAPERLESS_TIME_ZONE                                                                                                                                                                           
              value: "UTC"                                                                                                                                                                                        
            - name: PAPERLESS_CONSUMPTION_DIR                                                                                                                                                                     
              value: /consumption                                                                                                                                                                                 
            - name: PAPERLESS_REDIS                                                                                                                                                                               
              value: redis://paperless-redis:6379                                                                                                                                                                 
            - name: PAPERLESS_ADMIN_MAIL                                                                                                                                                                          
              valueFrom:          
                secretKeyRef:
                  name: paperless-admin    
                  key: PAPERLESS_ADMIN_MAIL
            - name: PAPERLESS_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef: 
                  name: paperless-admin
                  key: PAPERLESS_ADMIN_PASSWORD
            - name: PAPERLESS_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: paperless-admin
                  key: PAPERLESS_ADMIN_USER
            - name: PAPERLESS_SECRET_KEY                                                                 
              valueFrom:
                secretKeyRef:
                  name: paperless-admin
                  key: PAPERLESS_SECRET_KEY
            - name: PAPERLESS_URL
              valueFrom:      
                secretKeyRef:    
                  name: paperless-admin  
                  key: PAPERLESS_URL  
            - name: PAPERLESS_PORT    
              value: "8000"
          volumeMounts:

Not sure if that is intended behaviour. At least I would not have guessed it from the description...

As you mentioned already it is required to add the keys from your existing secret also to the values block. Also the keys should have non-empty values associated to be rendered.

I agree that this is neither very convenient nor documented very well but I haven't found a good way to explicitly whitelist env vars from an existing secret without injecting them all.

If you have a better idea feel free to show me and/or create a PR for it! 😊

At least I will try to improve the related documentation/comments in the next few days.

Addittionaly, I will add the possibility to specify a value from a secret within the env block:

env:
  - name: PAPERLESS_ADMIN_PASSWORD
    valueFrom:
      secretKeyRef:
        name: my-paperless-secret
        key: PAPERLESS_ADMIN_PASSWORD

I hope this helps!

BR, Pascal

from helm-charts.