Skip to content

Add Kubernetes secret RBAC support to Helm chart#931

Merged
burningalchemist merged 3 commits intoburningalchemist:masterfrom
zofer1zohargo:k8s-secrets-helm
Mar 26, 2026
Merged

Add Kubernetes secret RBAC support to Helm chart#931
burningalchemist merged 3 commits intoburningalchemist:masterfrom
zofer1zohargo:k8s-secrets-helm

Conversation

@zofer1zohargo
Copy link
Copy Markdown
Contributor

Add Role and RoleBinding templates for reading Kubernetes secrets.
Bump Helm chart version to 0.16.1.
Fix service account name resolution in _helpers.tpl.

@burningalchemist
Copy link
Copy Markdown
Owner

burningalchemist commented Mar 22, 2026

@zofer1zohargo since the RBAC bindings are new to the chart and also simply new template files, let's update the version to 0.17.0, and the appVersion to 0.21.0 (you've added a new provider, so it's technically a new feature).

The CI will break after the change as I haven't made the app release yet. It's ok for now, we may convert the PR to draft. Once it's released, we re-run the PR and merge it. 👍

Please don't forget to run make gen_docs in the helm directory.

@zofer1zohargo
Copy link
Copy Markdown
Contributor Author

@zofer1zohargo since the RBAC bindings are new to the chart and also simply new template files, let's update the version to 0.17.0, and the appVersion to 0.21.0 (you've added a new provider, so it's technically a new feature).

The CI will break after the change as I haven't made the app release yet. It's ok for now, we cmay convert the PR to draft. Once it's released, we re-run the PR and merge it. 👍

Please don't forget to run make gen_docs in the helm directory.

Sure I will do that.

@zofer1zohargo
Copy link
Copy Markdown
Contributor Author

I made no helm changes to use other values so gen docs made no changes. This means that if you ask sql exporter helm to create service account it will be granted automatically the right to read secrets from the namespace it is installed. We could have done all sorts of helm tricks in helm charts to mount it and process the file later but this eventually implies that we read secrets and deploy time instead of runtime. I find runtime neater so you don't need to deploy again when password changes. I find that creating the role and binding with another flag is an overkill. We can add it later

@burningalchemist
Copy link
Copy Markdown
Owner

@zofer1zohargo Yeah, agreed. Ok, then we wait for the release, and re-run the tests and we should be good to go. I'll tag you here 👍

@burningalchemist burningalchemist marked this pull request as draft March 22, 2026 18:39
@burningalchemist
Copy link
Copy Markdown
Owner

burningalchemist commented Mar 25, 2026

@zofer1zohargo v0.21 has been released, I also re-ran the failed helm workflow. Please have a look in case you want to adjust the PR and rebase onto the recent master. Otherwise, I'm ready to merge. 👍

@burningalchemist burningalchemist marked this pull request as ready for review March 25, 2026 23:34
@zofer1zohargo
Copy link
Copy Markdown
Contributor Author

@zofer1zohargo v0.21 has been released, I also re-ran the failed helm workflow. Please have a look in case you want to adjust the PR and rebase onto the recent master. Otherwise, I'm ready to merge. 👍

It seems that I had some mix up and another development was pushed to that branch. I will need to sort it out for a clean build

ZOHARGO added 2 commits March 26, 2026 11:03
Add Role and RoleBinding templates for reading Kubernetes secrets.
Bump Helm chart version to 0.16.1.
Fix service account name resolution in _helpers.tpl.

Made-with: Cursor
@zofer1zohargo
Copy link
Copy Markdown
Contributor Author

Should be fine now

@burningalchemist burningalchemist merged commit 5d2fb4c into burningalchemist:master Mar 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants