From 1d94a56525c274533692bcec2af90768c76b7532 Mon Sep 17 00:00:00 2001 From: Michael Welles Date: Mon, 20 Jul 2026 23:08:46 -0400 Subject: [PATCH] feat(dgraph): support existingSecret for ACL, encryption, and backup admin credentials --- charts/dgraph/templates/alpha/secret-acl.yaml | 2 +- charts/dgraph/templates/alpha/secret-enc.yaml | 2 +- .../dgraph/templates/alpha/statefulset.yaml | 12 ++++++--- .../templates/backups/cronjob-full.yaml | 17 ++++++++++++ .../dgraph/templates/backups/cronjob-inc.yaml | 17 ++++++++++++ charts/dgraph/templates/backups/secrets.yaml | 7 ++--- charts/dgraph/values.yaml | 27 +++++++++++++++++-- 7 files changed, 74 insertions(+), 10 deletions(-) diff --git a/charts/dgraph/templates/alpha/secret-acl.yaml b/charts/dgraph/templates/alpha/secret-acl.yaml index fdf73c065..8d2a82ee8 100644 --- a/charts/dgraph/templates/alpha/secret-acl.yaml +++ b/charts/dgraph/templates/alpha/secret-acl.yaml @@ -1,4 +1,4 @@ -{{ if and .Values.alpha.acl.enabled .Values.alpha.acl.file }} +{{ if and .Values.alpha.acl.enabled (not .Values.alpha.acl.existingSecret) .Values.alpha.acl.file }} apiVersion: v1 kind: Secret metadata: diff --git a/charts/dgraph/templates/alpha/secret-enc.yaml b/charts/dgraph/templates/alpha/secret-enc.yaml index 8b06afc14..027173e31 100644 --- a/charts/dgraph/templates/alpha/secret-enc.yaml +++ b/charts/dgraph/templates/alpha/secret-enc.yaml @@ -1,4 +1,4 @@ -{{ if and .Values.alpha.encryption.enabled .Values.alpha.encryption.file }} +{{ if and .Values.alpha.encryption.enabled (not .Values.alpha.encryption.existingSecret) .Values.alpha.encryption.file }} apiVersion: v1 kind: Secret metadata: diff --git a/charts/dgraph/templates/alpha/statefulset.yaml b/charts/dgraph/templates/alpha/statefulset.yaml index 304e09763..797f54e37 100644 --- a/charts/dgraph/templates/alpha/statefulset.yaml +++ b/charts/dgraph/templates/alpha/statefulset.yaml @@ -316,12 +316,18 @@ spec: {{- if .Values.alpha.encryption.enabled }} - name: enc-volume secret: - secretName: {{ template "dgraph.alpha.fullname" . }}-encryption-secret + # existingSecret lets a pre-created Secret supply the encryption key, so it + # never has to be rendered through Helm values; otherwise mount the Secret + # the chart renders from `encryption.file`. + secretName: {{ .Values.alpha.encryption.existingSecret | default (printf "%s-encryption-secret" (include "dgraph.alpha.fullname" .)) }} {{- end }} - {{- if or .Values.alpha.acl.enabled }} + {{- if .Values.alpha.acl.enabled }} - name: acl-volume secret: - secretName: {{ template "dgraph.alpha.fullname" . }}-acl-secret + # existingSecret lets a pre-created Secret (e.g. one managed by Terraform or an + # external secrets operator) supply the HMAC key, so it never has to be rendered + # through Helm values; otherwise mount the Secret the chart renders from `acl.file`. + secretName: {{ .Values.alpha.acl.existingSecret | default (printf "%s-acl-secret" (include "dgraph.alpha.fullname" .)) }} {{- end }} {{- if .Values.alpha.persistence.enabled }} volumeClaimTemplates: diff --git a/charts/dgraph/templates/backups/cronjob-full.yaml b/charts/dgraph/templates/backups/cronjob-full.yaml index 8f7f89e91..a5e198e28 100644 --- a/charts/dgraph/templates/backups/cronjob-full.yaml +++ b/charts/dgraph/templates/backups/cronjob-full.yaml @@ -126,9 +126,26 @@ spec: {{- end }} {{- if or .Values.alpha.acl.enabled .Values.backups.admin.auth_token }} - name: backup-secret-volume + {{- if and .Values.alpha.acl.enabled .Values.backups.admin.existingSecret }} + projected: + sources: + - secret: + name: {{ .Values.backups.admin.existingSecret }} + items: + - key: {{ .Values.backups.admin.passwordSecretKey }} + path: backup_admin_password + {{- if .Values.backups.admin.auth_token }} + - secret: + name: {{ template "dgraph.backups.fullname" . }}-secret + items: + - key: backup_auth_token + path: backup_auth_token + {{- end }} + {{- else }} secret: secretName: {{ template "dgraph.backups.fullname" . }}-secret {{- end }} + {{- end }} {{- if .Values.backups.nfs.enabled }} - name: backups-nfs-volume persistentVolumeClaim: diff --git a/charts/dgraph/templates/backups/cronjob-inc.yaml b/charts/dgraph/templates/backups/cronjob-inc.yaml index 8a591e794..e82815ba1 100644 --- a/charts/dgraph/templates/backups/cronjob-inc.yaml +++ b/charts/dgraph/templates/backups/cronjob-inc.yaml @@ -126,9 +126,26 @@ spec: {{- end }} {{- if or .Values.alpha.acl.enabled .Values.backups.admin.auth_token }} - name: backup-secret-volume + {{- if and .Values.alpha.acl.enabled .Values.backups.admin.existingSecret }} + projected: + sources: + - secret: + name: {{ .Values.backups.admin.existingSecret }} + items: + - key: {{ .Values.backups.admin.passwordSecretKey }} + path: backup_admin_password + {{- if .Values.backups.admin.auth_token }} + - secret: + name: {{ template "dgraph.backups.fullname" . }}-secret + items: + - key: backup_auth_token + path: backup_auth_token + {{- end }} + {{- else }} secret: secretName: {{ template "dgraph.backups.fullname" . }}-secret {{- end }} + {{- end }} {{- if .Values.backups.nfs.enabled }} - name: backups-nfs-volume persistentVolumeClaim: diff --git a/charts/dgraph/templates/backups/secrets.yaml b/charts/dgraph/templates/backups/secrets.yaml index 92f3c0ff8..d322121f7 100644 --- a/charts/dgraph/templates/backups/secrets.yaml +++ b/charts/dgraph/templates/backups/secrets.yaml @@ -1,7 +1,8 @@ {{- $hasS3Keys := include "dgraph.backups.keys.s3.enabled" . -}} {{- $hasMinioKeys := include "dgraph.backups.keys.minio.enabled" . -}} {{- $backupsEnabled := or .Values.backups.full.enabled .Values.backups.incremental.enabled }} -{{- if and $backupsEnabled (or .Values.alpha.acl.enabled .Values.backups.admin.auth_token $hasS3Keys $hasMinioKeys) -}} +{{- $aclInlinePassword := and .Values.alpha.acl.enabled (not .Values.backups.admin.existingSecret) }} +{{- if and $backupsEnabled (or $aclInlinePassword .Values.backups.admin.auth_token $hasS3Keys $hasMinioKeys) -}} apiVersion: v1 kind: Secret metadata: @@ -15,8 +16,8 @@ metadata: {{- end }} type: Opaque data: - {{- if .Values.alpha.acl.enabled }} - backup_admin_password: {{ required "backups.admin.password must be set when alpha.acl.enabled is true and backups are enabled" .Values.backups.admin.password | toString | b64enc | quote }} + {{- if $aclInlinePassword }} + backup_admin_password: {{ required "backups.admin.password must be set when alpha.acl.enabled is true, backups are enabled, and backups.admin.existingSecret is not set" .Values.backups.admin.password | toString | b64enc | quote }} {{- end }} {{- if .Values.backups.admin.auth_token }} backup_auth_token: {{ .Values.backups.admin.auth_token | toString | b64enc | quote }} diff --git a/charts/dgraph/values.yaml b/charts/dgraph/values.yaml index 1743d5419..c675381f5 100644 --- a/charts/dgraph/values.yaml +++ b/charts/dgraph/values.yaml @@ -390,8 +390,16 @@ alpha: ## ref: https://docs.dgraph.io/installation/configuration/enable-acl acl: enabled: false + ## Filename (and Secret key) of the HMAC secret mounted at /dgraph/acl/. + secretFile: hmac_secret_file + ## Name of a pre-created Secret holding the HMAC key. When set, the chart does NOT + ## render its own ACL Secret from `file` below; the alpha pod mounts this Secret + ## instead, so the HMAC never passes through Helm values or release state. The + ## Secret must contain the `secretFile` key. + existingSecret: "" ## The values in `file: {}` will be the filename as key and the file data as the value. - ## Make sure that the filename key matches the dgraph configuration of `acl_secret_file` + ## Make sure that the filename key matches the dgraph configuration of `acl_secret_file`. + ## Ignored when `existingSecret` is set. # file: # ## value for 1234567890123456789012345678901 # ## Note that Kubernetes secrets must be base64-encoded @@ -401,8 +409,15 @@ alpha: ## ref: https://docs.dgraph.io/installation/configuration/encryption-at-rest encryption: enabled: false + ## Filename (and Secret key) of the encryption key mounted at /dgraph/enc/. + keyFile: enc_key_file + ## Name of a pre-created Secret holding the encryption key. When set, the chart does + ## NOT render its own encryption Secret from `file` below; the alpha pod mounts this + ## Secret instead. The Secret must contain the `keyFile` key. + existingSecret: "" ## The values in `file: {}` will be the filename as key and the file data as the value. - ## Make sure that the filename key matches the dgraph configuration of `encryption_key_file` + ## Make sure that the filename key matches the dgraph configuration of `encryption_key_file`. + ## Ignored when `existingSecret` is set. # file: # ## value for 123456789012345 # ## Note that Kubernetes secrets must be base64-encoded @@ -645,6 +660,14 @@ backups: ## ref: https://docs.dgraph.io/installation/configuration/enable-acl user: groot # password: password + ## Name of a pre-created Secret holding the backup admin password. When set, the + ## chart does NOT mint `backup_admin_password` into its own backups Secret; the + ## CronJob mounts this Secret's key instead, so the password never passes through + ## Helm values or release state. Ignored unless alpha.acl.enabled is true. + existingSecret: "" + ## Key within existingSecret (or the chart's own backups Secret) that holds the + ## backup admin password. + passwordSecretKey: backup_admin_password ## Mutual TLS client certificate and key can be used to secure transaction that was created with ## dgraph cert --client should be specified here. ## ref. https://docs.dgraph.io/admin/security/tls-configuration#tls-options