feat: mounting secrets as volumes

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [3.0.0] - 2025-12-30
+
+### Added
+
+- Ability to mount secrets as volumes. I'ts handy when you need to mount encrypted config file
+
 ## [2.7.0] - 2025-12-14
 
 ### Added

chart/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.7.0
+version: 3.0.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.

chart/templates/deployment.yaml

@@ -15,6 +15,7 @@ spec:
       labels:
         {{- include "basic.selectorLabels" . | nindent 8 }}
     spec:
+      enableServiceLinks: false
       containers:
         - name: {{ .Release.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -36,27 +37,31 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           {{- end }}
-          {{- if .Values.volumes.enabled }}
           volumeMounts:
-            {{- if .Values.configMap }}
-            - name: {{ .Values.configMap.name }}
-              mountPath: {{ .Values.configMap.mountPath }}
-            {{- end }}
-            {{- range .Values.volumes.mountPath }}
-            {{- $dirmap := regexSplit ":" . -1 }}
-            {{- $sub_path := slice $dirmap 0 1 | first }}
-            {{- $mount := slice $dirmap  1 | last }}
-            {{- if $.Values.volumes.type.pvc }}
-            {{- $path := $mount }}
-            - mountPath: {{ $mount | default "/var/www" }}
-              name: {{ $.Release.Name }}-volume
-            {{- else }}
+            {{- if .Values.volumes.nfs }}
+              {{- range .Values.volumes.nfs.mountPath }}
+                {{- $dirmap := regexSplit ":" . -1 }}
+                {{- $sub_path := slice $dirmap 0 1 | first }}
+                {{- $mount := slice $dirmap  1 | last }}
             - mountPath: {{ $mount | default "/var/www" }}
               name: {{ $.Release.Name }}-volume
               subPath: {{ $sub_path }}
+              {{- end }}
             {{- end }}
+            {{- if .Values.volumes.secret }}
+            - name: {{ .Values.volumes.secret.secretName }}
+              mountPath: {{ .Values.volumes.secret.mountPath }}
+              {{- if .Values.volumes.secret.subPath }}
+              subPath: {{ .Values.volumes.secret.subPath }}
+              {{- end}}
+            {{- end }}
+            {{- if .Values.volumes.configmap }}
+            - name: {{ .Values.volumes.configmap.configMap }}
+              mountPath: {{ .Values.volumes.configmap.mountPath }}
+              {{- if .Values.volumes.configmap.subPath }}
+              subPath: {{ .Values.volumes.configmap.subPath }}
+              {{- end}}
             {{- end }}
-          {{- end}}
           env:
           {{- with .Values.env }}
             {{- toYaml . | nindent 12 }}
@@ -102,31 +107,30 @@ spec:
       {{- with .Values.nodeSelector }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.volumes.enabled }}
-      {{- if .Values.volumes.type.pvc }}
-      {{- $ownership := regexSplit ":" .Values.volumes.ownership -1 }}
-      {{- $gid := slice $ownership 0 1 | first }}
-      securityContext:
-        fsGroup: {{ $gid | default 0 }}
-      {{- end}}
       volumes:
-        {{- if .Values.configMap }}
-        - name: {{ .Values.configMap.name }}
+      {{- if .Values.volumes.configMap }}
+        - name: {{ .Values.volumes.configMap.name }}
           configMap:
-            name: {{ .Values.configMap.name }}
-        {{- end }}
+            name: {{ .Values.volumes.configMap.name }}
+      {{- end }}
+      {{- if .Values.volumes.nfs }}
         - name: {{ .Release.Name }}-volume
-          {{- if .Values.volumes.type.nfs }}
           nfs:
-            server: {{ .Values.volumes.type.nfs.server }}
-            {{- if .Values.volumes.rootDir }}
-            path: {{ .Values.volumes.type.nfs.path }}/{{ .Values.volumes.rootDir }}
-            {{- else }}
-            path: {{ .Values.volumes.type.nfs.path }}/{{ .Release.Name }}
-            {{- end }}
+            server: {{ .Values.volumes.nfs.server }}
+        {{- if .Values.volumes.rootDir }}
+            path: {{ .Values.volumes.nfs.path }}/{{ .Values.volumes.rootDir }}
+        {{- else }}
+            path: {{ .Values.volumes.nfs.path }}/{{ .Release.Name }}
+        {{- end }}
             readOnly: false
-          {{- else }}
-          persistentVolumeClaim:
-            claimName: {{ .Release.Name }}-pvc
-          {{- end }} 
-    {{- end }}
+      {{- end }}
+      {{- if .Values.volumes.secret }}
+        - name: {{ .Values.volumes.secret.secretName }}
+          secret:
+            secretName: {{ .Values.volumes.secret.secretName }}
+      {{- end }}
+      {{- if .Values.volumes.configmap }}
+        - name: {{ .Values.volumes.configmap.configMap }}
+          configMap:
+            name: {{ .Values.volumes.configmap.configMap }}
+      {{- end }}

chart/templates/ingress.yaml

@@ -1,12 +1,10 @@
 {{- if .Values.ingress.enabled -}}
 {{- range .Values.ingress.hosts }}
-{{- $subdomain := .name | splitList "." | first -}}
-{{- $ReleaseName := printf "%s-%s" $.Release.Name $subdomain -}}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ $ReleaseName }}
+  name: {{ $.Release.Name}}
   namespace: {{ $.Release.Namespace }}
   {{- if $.Values.ingress.ssl }}
   annotations:
@@ -23,12 +21,12 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: {{ $ReleaseName }}
+                name: {{ $.Release.Name }}
                 port:
                   number: {{ .servicePort }}
   {{- if $.Values.ingress.ssl }}
   tls:
-    - secretName: {{ $ReleaseName }}-tls
+    - secretName: {{ $.Release.Name }}-tls
       hosts:
         - {{ .name }}
   {{- end }}

chart/templates/service.yaml

@@ -5,7 +5,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ $.Release.Name }}-{{ .name }}"
+  name: "{{ .name }}"
   namespace: {{ $.Release.Namespace }}
 spec:
   type: {{ .type }}

chart/test_values.yaml

@@ -19,12 +19,19 @@ resources:
 #   enabled: false
 volumes:
   enabled: true
-  mountPath: 
-    - storage:/storage
-  type:
-    nfs:
-      server: lab-storage.lan
-      path: /volume1/storagelab
+  nfs:
+    server: lab-storage.lan
+    path: /volume1/storagelab
+    mountPath: 
+    - storage:/
+  secret:
+    secretName: app-secret
+    mountPath: /app/secret.json
+    subPath: secret.json
+  configmap:
+    configMap: app-config
+    mountPath: /conf/config.ini
+    subPath: config.ini
 nodeSelector:
   kubernetes.io/arch: arm64
 services: