mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
fix(cnpg,kong): wire cnpg-backup-sa, migrate PodMonitor, drop DASHBOARD consumer
Three Junie briefs landed in one commit: #07 — Wire cnpg-backup-sa into CNPG cluster spec (drift R8) deploy/gcp/gke/knoe-db.yaml: add spec.serviceAccountName: cnpg-backup-sa (requires CNPG v1.29+, which is the live operator version). etc/init_cnpg_gke.sh: operator install URL now uses CNPG_OPERATOR_VERSION variable (default 1.29.0); new §11 patches knoe-db and knoe-db-barman-cloud RoleBindings to add cnpg-backup-sa as a subject if not already present — matching the 2026-04-29 live stabilization. #13 — Migrate off deprecated enablePodMonitor + podMonitorRelabelings Both deprecated fields removed from deploy/gcp/gke/knoe-db.yaml spec.monitoring. New deploy/gcp/gke/knoe-db-podmonitor.yaml carries the PodMonitor with the cluster relabeling rule (cnpg.io/cluster pod label → cluster label; required for all 85 CNPG Grafana panels). Apply alongside knoe-db.yaml on next cluster patch. #15 — Remove dead DASHBOARD consumer + basicauth_credentials supabase/helm/knoe-supabase: - wrapper.sh: drop DASHBOARD_USERNAME / DASHBOARD_PASSWORD envsubst lines - config.yaml: drop DASHBOARD consumer + basicauth_credentials block - kong/deployment.yaml: drop both DASHBOARD env-var secret refs - values.yaml: rename secret.dashboard → secret.openai (apiKey only; username/password dropped — no enforcer since commit 25f1b2e) - secrets/dashboard.yaml + _helpers.tpl: renamed to openai / supabase.secret.openai - studio/deployment.yaml: reads from secret.openai.apiKey - ci/example.yaml: updated to secret.openai.apiKey helm template confirms knoe-supabase-openai secret referenced; no DASHBOARD output. docs/TODO.md: queue items #7, #13, #15 + drift row R8 archived to Done. Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
chrisfu
parent
5d17325c10
commit
c3fae73de3
33
deploy/gcp/gke/knoe-db-podmonitor.yaml
Normal file
33
deploy/gcp/gke/knoe-db-podmonitor.yaml
Normal file
@ -0,0 +1,33 @@
|
||||
---
|
||||
# Manually-managed PodMonitor for the knoe-db CNPG cluster.
|
||||
#
|
||||
# Replaces the deprecated spec.monitoring.enablePodMonitor +
|
||||
# spec.monitoring.podMonitorRelabelings fields in knoe-db.yaml (both flagged
|
||||
# for removal by the CNPG operator; see queue #13 in docs/TODO.md).
|
||||
#
|
||||
# The relabeling rule injects a `cluster` label on every scraped sample,
|
||||
# sourced from the cnpg.io/cluster pod label. The CNPG Grafana dashboards
|
||||
# filter every panel by `cluster="$cluster"`, so without this relabel only
|
||||
# 2 of 85 CNPG metrics (the operator-collector ones) render.
|
||||
#
|
||||
# Apply alongside knoe-db.yaml:
|
||||
# kubectl apply -f deploy/gcp/gke/knoe-db-podmonitor.yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: knoe-db
|
||||
namespace: knoe-db-0
|
||||
labels:
|
||||
# Match the label selector used by kube-prometheus-stack's Prometheus
|
||||
# instance so this PodMonitor is picked up automatically.
|
||||
release: kps
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
cnpg.io/cluster: knoe-db
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
relabelings:
|
||||
- sourceLabels: ["__meta_kubernetes_pod_label_cnpg_io_cluster"]
|
||||
targetLabel: cluster
|
||||
action: replace
|
||||
@ -4,6 +4,11 @@ metadata:
|
||||
name: knoe-db
|
||||
namespace: knoe-db-0
|
||||
spec:
|
||||
# Run cluster pods as cnpg-backup-sa (annotated for Workload Identity to the
|
||||
# cnpg-backup@... GCP SA). This is how barman-cloud authenticates to
|
||||
# gs://knoe-0-backups/ without a static key. Requires CNPG v1.29+.
|
||||
# The SA is provisioned by etc/init_cnpg_gke.sh § "Apply ServiceAccount + annotate with WI".
|
||||
serviceAccountName: cnpg-backup-sa
|
||||
instances: 3
|
||||
enablePDB: false
|
||||
# Image pulled from GCP Artifact Registry — set ARTIFACT_REGISTRY in conf/prod/gcp.cfg
|
||||
@ -199,15 +204,7 @@ spec:
|
||||
storageClassName: premium-rwo # pd-ssd; restore to premium-rwo after quota increase (matches PGDATA above)
|
||||
|
||||
monitoring:
|
||||
# NOTE: enablePodMonitor + podMonitorRelabelings are CNPG-deprecated and
|
||||
# will be removed in a future release. Migration path: manually manage
|
||||
# the PodMonitor resource. Tracked in docs/TODO.md as a follow-up.
|
||||
enablePodMonitor: true # kube-prometheus-stack is installed before CNPG → PodMonitor CRD present
|
||||
# Add a `cluster` label to every scraped sample, sourced from the
|
||||
# cnpg.io/cluster pod label. The cnpg-grafana dashboards filter every
|
||||
# panel by `cluster="$cluster"`, so without this relabel only 2 of 85
|
||||
# CNPG metrics (the operator-collector ones) render.
|
||||
podMonitorRelabelings:
|
||||
- sourceLabels: ["__meta_kubernetes_pod_label_cnpg_io_cluster"]
|
||||
targetLabel: cluster
|
||||
action: replace
|
||||
# enablePodMonitor and podMonitorRelabelings removed — both fields are
|
||||
# deprecated by the CNPG operator and will be removed in a future release.
|
||||
# The PodMonitor is now managed as a sibling resource:
|
||||
# deploy/gcp/gke/knoe-db-podmonitor.yaml (queue #13).
|
||||
|
||||
10
docs/TODO.md
10
docs/TODO.md
@ -43,7 +43,6 @@ The Kanban "Now" section at top is the only place this doc imposes structure. Ev
|
||||
- **DB cluster (`knoe-dev-cnpg-0`):** delete `kube-system/prole-supabase-dirprep` Job (18d stale, prole-era)
|
||||
|
||||
|
||||
7. **Update `etc/init_cnpg_gke.sh` to set `cluster.spec.serviceAccountName: cnpg-backup-sa` and create the RoleBinding additions** — current script creates `cnpg-backup-sa` but doesn't wire it as the cluster pod SA. After 2026-04-29 stabilization the live cluster does this; the init script should reflect it so a fresh deploy lands in the same end state. **Brief: [`docs/plans/junie/07-init-cnpg-gke-sa-wiring.md`](plans/junie/07-init-cnpg-gke-sa-wiring.md). Assigned to Junie.**
|
||||
|
||||
8. **Port oauth2-proxy manifest to k3d / k3s / min modes** — `deploy/gcp/gke/oauth2-proxy-deployment.yaml` is GKE-shaped (uses `cloud.google.com/v1` BackendConfig + GCE health-check semantics). For non-GCE deploy modes the same Deployment runs unchanged but the ingress glue differs (Traefik / nginx-ingress / no LB at all). Add a `deploy/k3s/oauth2-proxy-deployment.yaml` with the Traefik-flavored ingress annotations once we deploy that mode.
|
||||
|
||||
@ -55,11 +54,9 @@ The Kanban "Now" section at top is the only place this doc imposes structure. Ev
|
||||
|
||||
12. **Fork the Supabase Studio image to wire in-app help / support / feedback buttons to `mailto:support@knoe.dev` (or `https://db.0.knoe.dev/support`)** — upstream Studio (`supabase/studio:2026.02.16-sha-26c615c`) hardcodes those URLs to Supabase-cloud endpoints (`supabase.com/dashboard/api/feedback` etc.) which are unreachable from self-hosted, so the in-app "Report a problem" / "Send feedback" / "Get help" flows error out. No env-var hook exists in upstream — verified by Explore search. Fork the image, patch the relevant TSX (`apps/studio/components/layouts/AppLayout/AppLayout.tsx`, support-dialog component, settings/help links — handful of files), publish to our registry, bump `image.studio.repository` in [`supabase/helm/knoe-supabase/values.yaml`](../supabase/helm/knoe-supabase/values.yaml). Same fork is the natural place to fix the OpenAI key panel, telemetry endpoints, and any other in-Studio assumptions about Supabase cloud as we encounter them. Stop-gap until then: `https://db.0.knoe.dev/support` 302s to `mailto:support@knoe.dev` (Kong route `support`); just need to tell users to bookmark or remember it.
|
||||
|
||||
13. **Migrate off CNPG-deprecated `monitoring.enablePodMonitor` + `podMonitorRelabelings` fields** — both fields in [`deploy/gcp/gke/knoe-db.yaml`](../deploy/gcp/gke/knoe-db.yaml) `spec.monitoring` are flagged deprecated by the CNPG operator and "will be removed in a future release". Migration path per the operator's warning: manually manage the PodMonitor resource (i.e. write `deploy/gcp/gke/knoe-db-podmonitor.yaml` ourselves and apply alongside the Cluster). New file would carry the `relabelings` (cluster label injection, currently sourced from pod label `cnpg.io/cluster`) and any future scrape customization. Cluster spec keeps only the bare CNPG operator config. No urgency — works fine on the current operator (CNPG v1.29) — but file before the next CNPG upgrade. Reference: kubectl deprecation warning emitted on every patch of these fields. **Brief: [`docs/plans/junie/13-podmonitor-manual-management.md`](plans/junie/13-podmonitor-manual-management.md). Assigned to Junie.**
|
||||
|
||||
14. **Migrate cnpg-prometheus datasource UID to the stable `cnpg-prometheus` name** — currently the live datasource has the auto-generated UID `P5531627C358300FE` from the original kps install. We pinned `uid: cnpg-prometheus` in [`monitoring/kps-values-gke.yaml`](../monitoring/kps-values-gke.yaml) so any FRESH kps install lands on the stable name, but Grafana refuses to change the UID of an already-provisioned datasource (read-only via API; rollout-restart doesn't migrate it). The dashboard transform [`monitoring/cnpg-dashboard-transforms.yaml`](../monitoring/cnpg-dashboard-transforms.yaml) `ds_prometheus_default_to_cnpg` carries the auto-uid as a workaround. Migration path on the next clean kps re-install (or after a maintenance window where we can wipe the Grafana sqlite DB to drop datasources): swap `value: P5531627C358300FE` → `value: cnpg-prometheus` in the transform and re-run the sync tool. No client-visible change either way.
|
||||
|
||||
15. **Remove DASHBOARD consumer + `basicauth_credentials` from `supabase/helm/knoe-supabase/templates/kong/config.yaml`** — now-dead config: the basic-auth plugin block was removed in commit (this oauth2-proxy work), so the consumer + credentials it gated have no enforcer. Lines 30-32 (`{{- if .Values.secret.dashboard }} - username: DASHBOARD {{- end }}`) and lines 44-49 (the `basicauth_credentials:` block) can be deleted; then drop `secret.dashboard` from `values.yaml` and the `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD` envsubst lines from `wrapper.sh`. Cleanup-only; current state is harmless. **Brief: [`docs/plans/junie/15-remove-dead-dashboard-consumer.md`](plans/junie/15-remove-dead-dashboard-consumer.md). Assigned to Junie. Note: brief flags the OpenAI key trap — `secret.dashboard.openAiApiKey` is the only LIVE consumer of that section, so don't blanket-delete.**
|
||||
|
||||
---
|
||||
|
||||
@ -70,7 +67,6 @@ Items where docs describe an intended state that doesn't match live state. Each
|
||||
| # | Reality (current) | Intended state | Documented at | Tracked work item |
|
||||
|---|---|---|---|---|
|
||||
| R6 | Image refs `knoe-authority:latest` in deploy manifests | `knoe-auth:latest` (matches Maven artifact `knoe-auth.jar` post-rename) | Phase C plan follow-ups | Queue item #3 |
|
||||
| R8 | `etc/init_cnpg_gke.sh` doesn't set `cluster.spec.serviceAccountName` or extend the role bindings to `cnpg-backup-sa` | Script lands a fresh deploy in the same end state as live (with `serviceAccountName: cnpg-backup-sa` and role-binding subjects added) | Live cluster spec + RoleBindings | Queue item #7 |
|
||||
|
||||
---
|
||||
|
||||
@ -99,6 +95,12 @@ Items where docs describe an intended state that doesn't match live state. Each
|
||||
|
||||
*(items get archived here when they land, with a date and commit reference; or just delete if not worth memorializing)*
|
||||
|
||||
- 2026-05-02 — **Wire `cnpg-backup-sa` into CNPG cluster spec + init script** (queue #7 / drift R8). `deploy/gcp/gke/knoe-db.yaml` gains `spec.serviceAccountName: cnpg-backup-sa` (requires CNPG v1.29+). `etc/init_cnpg_gke.sh`: operator install URL now uses `CNPG_OPERATOR_VERSION` variable (default `1.29.0`); new §11 patches both `knoe-db` and `knoe-db-barman-cloud` RoleBindings to add `cnpg-backup-sa` as a subject if not already present, matching the 2026-04-29 live stabilization. `bash -n` clean. Brief: [`docs/plans/junie/07-init-cnpg-gke-sa-wiring.md`](plans/junie/07-init-cnpg-gke-sa-wiring.md).
|
||||
|
||||
- 2026-05-02 — **Migrate off CNPG-deprecated `enablePodMonitor` + `podMonitorRelabelings`** (queue #13). Both deprecated fields removed from `deploy/gcp/gke/knoe-db.yaml` `spec.monitoring`. New sibling manifest `deploy/gcp/gke/knoe-db-podmonitor.yaml` carries the `PodMonitor` with the `cluster` relabeling rule (sourced from `cnpg.io/cluster` pod label; required for all 85 CNPG Grafana dashboard panels). Apply alongside `knoe-db.yaml`. Brief: [`docs/plans/junie/13-podmonitor-manual-management.md`](plans/junie/13-podmonitor-manual-management.md).
|
||||
|
||||
- 2026-05-02 — **Remove dead DASHBOARD consumer + `basicauth_credentials` from Kong chart** (queue #15). `supabase/helm/knoe-supabase`: removed `DASHBOARD_USERNAME`/`DASHBOARD_PASSWORD` envsubst lines from `wrapper.sh`, DASHBOARD consumer + `basicauth_credentials` block from `config.yaml`, and both env-var secret refs from `kong/deployment.yaml`. `values.yaml` `secret.dashboard` section renamed to `secret.openai` (only `apiKey` field; `username`/`password` dropped). `templates/secrets/dashboard.yaml` + `_helpers.tpl` updated to `openai`/`supabase.secret.openai`. `studio/deployment.yaml` updated to read from `secret.openai.apiKey`. `ci/example.yaml` updated. `helm template` confirms `knoe-supabase-openai` secret referenced, no DASHBOARD output. Brief: [`docs/plans/junie/15-remove-dead-dashboard-consumer.md`](plans/junie/15-remove-dead-dashboard-consumer.md).
|
||||
|
||||
- 2026-05-02 — **k3s manifest rename: `prole-*` → `knoe-*`** (queue #2 / drift R5) in commit [fb7e8b7](#). Five `git mv` in `deploy/opentofu/k3s/manifests/knoe/`: `prole-{configmap,deployment,service,kdc-configmap,kdc-secrets.example}.yaml` → `knoe-*`. Content sweep of `knoe-kdc-configmap.yaml`: replaced stale `PROLE.LOCAL`/`PROLE.ORG` realm refs and `PROLE_KDC_*` env vars with `KNOE.DEV`/`KNOE_KDC_*` to match the canonical GKE configmap. Kustomize renders cleanly (`kubectl kustomize` → 1193 lines, exit 0). Brief: [`docs/plans/junie/02-k3s-prole-rename.md`](plans/junie/02-k3s-prole-rename.md).
|
||||
|
||||
- 2026-05-02 — **Fix `scripts/patch_garage_cross_cluster.sh`** (queue #6 / drift R9) in commits [34a25dd](#) + [e9df3c4](#). Three defects from the 2026-04-29 one-shot run: (A) `DB_CLUSTER` default `knoe-cnpg-0` → `knoe-dev-cnpg-0` (stale rebrand artifact; header comment + overrides block also updated); (B) Phase 1 deletion loop now includes `service/garage-s3-ilb` (the LoadBalancer that was left orphaned after the original run); (C) `deploy/gcp/gke/knoe-db-backup-gcs.yaml` split — legacy `ScheduledBackup` with deprecated `method: barmanObjectStore` removed, file is now SA-only. `bash -n` clean; CONFIRM=false dry-run prints correct cluster names. Brief: [`docs/plans/junie/06-patch-garage-script-fixes.md`](plans/junie/06-patch-garage-script-fixes.md).
|
||||
|
||||
@ -30,6 +30,11 @@ DB_PASSWORD="${DB_PASSWORD:-}"
|
||||
CNPG_DB_OWNER="${CNPG_DB_OWNER:-knoe}"
|
||||
CNPG_STORAGE_CLASS_ORDER="${CNPG_STORAGE_CLASS_ORDER:-premium-rwo,ssd,premium,standard-rwo,garage-hdd,standard,dynamic-rwo}"
|
||||
CNPG_STORAGE_WAIT_TIMEOUT="${CNPG_STORAGE_WAIT_TIMEOUT:-240}"
|
||||
# v1.29.0+ is required: spec.serviceAccountName lets the cluster pods run as
|
||||
# cnpg-backup-sa (annotated with iam.gke.io/gcp-service-account for WI), which
|
||||
# is how the GCS-backed barman ObjectStore authenticates without a static key.
|
||||
# Older operators (we used 1.24.0 historically) silently drop the field.
|
||||
CNPG_OPERATOR_VERSION="${CNPG_OPERATOR_VERSION:-1.29.0}"
|
||||
|
||||
# ── Argument parsing ─────────────────────────────────────────────────────────
|
||||
while [[ $# -gt 0 ]]; do
|
||||
@ -398,9 +403,9 @@ kubectl apply -f "$GKE_MANIFEST_DIR/namespace.yaml"
|
||||
|
||||
# ── 7. Install CNPG operator (if not present) ─────────────────────────────────
|
||||
if ! kubectl get crd clusters.postgresql.cnpg.io >/dev/null 2>&1; then
|
||||
log "Installing CloudNativePG operator ..."
|
||||
log "Installing CloudNativePG operator v${CNPG_OPERATOR_VERSION} ..."
|
||||
kubectl apply --server-side -f \
|
||||
https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.24.0.yaml
|
||||
"https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${CNPG_OPERATOR_VERSION}.yaml"
|
||||
log "Waiting for CNPG operator to be ready ..."
|
||||
kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=120s
|
||||
else
|
||||
@ -478,6 +483,37 @@ done
|
||||
|
||||
log "CNPG provisioning selected storageClass=${selected_storage_class}."
|
||||
|
||||
# ── 11. Ensure RoleBindings reference cnpg-backup-sa ─────────────────────────
|
||||
# CNPG auto-creates knoe-db and knoe-db-barman-cloud RoleBindings at cluster
|
||||
# creation. With spec.serviceAccountName set from the start the operator may
|
||||
# use cnpg-backup-sa as the sole subject, but if it still uses the default SA
|
||||
# name (cluster name) we patch both bindings to add cnpg-backup-sa — matching
|
||||
# the live state after the 2026-04-29 stabilization session.
|
||||
log "Ensuring CNPG-managed RoleBindings include cnpg-backup-sa ..."
|
||||
for rb in "${CNPG_CLUSTER_NAME}" "${CNPG_CLUSTER_NAME}-barman-cloud"; do
|
||||
for _ in 1 2 3 4 5; do
|
||||
kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" >/dev/null 2>&1 && break
|
||||
sleep 2
|
||||
done
|
||||
if kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" >/dev/null 2>&1; then
|
||||
if ! kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" \
|
||||
-o jsonpath='{.subjects[*].name}' | grep -qw cnpg-backup-sa; then
|
||||
patch_file="$(mktemp)"
|
||||
cat > "${patch_file}" <<EOF
|
||||
[{"op":"add","path":"/subjects/-","value":{"kind":"ServiceAccount","name":"cnpg-backup-sa","namespace":"${CNPG_NAMESPACE}"}}]
|
||||
EOF
|
||||
kubectl -n "${CNPG_NAMESPACE}" patch rolebinding "${rb}" \
|
||||
--type='json' --patch-file="${patch_file}" || true
|
||||
rm -f "${patch_file}"
|
||||
log " Patched RoleBinding ${rb} to add cnpg-backup-sa."
|
||||
else
|
||||
log " RoleBinding ${rb} already includes cnpg-backup-sa."
|
||||
fi
|
||||
else
|
||||
log " WARNING: RoleBinding ${rb} not found — skipping patch."
|
||||
fi
|
||||
done
|
||||
|
||||
log ""
|
||||
log "Done. Monitor with:"
|
||||
log " kubectl -n $CNPG_NAMESPACE get cluster knoe-db"
|
||||
|
||||
@ -6,10 +6,8 @@ secret:
|
||||
smtp:
|
||||
username: your-mail@example.com
|
||||
password: example123456
|
||||
dashboard:
|
||||
username: supabase
|
||||
password: this_password_is_insecure_and_should_be_updated
|
||||
openAiApiKey: api-key
|
||||
openai:
|
||||
apiKey: api-key
|
||||
db:
|
||||
password: example123456
|
||||
database: postgres
|
||||
|
||||
@ -16,8 +16,6 @@ data:
|
||||
sed \
|
||||
-e "s|\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|" \
|
||||
-e "s|\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|" \
|
||||
-e "s|\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|" \
|
||||
-e "s|\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|" \
|
||||
/usr/local/kong/template.yml \
|
||||
> /usr/local/kong/kong.yml
|
||||
|
||||
@ -27,9 +25,6 @@ data:
|
||||
_transform: true
|
||||
|
||||
consumers:
|
||||
{{- if .Values.secret.dashboard }}
|
||||
- username: DASHBOARD
|
||||
{{- end }}
|
||||
- username: anon
|
||||
keyauth_credentials:
|
||||
- key: ${SUPABASE_ANON_KEY}
|
||||
@ -41,12 +36,6 @@ data:
|
||||
group: anon
|
||||
- consumer: service_role
|
||||
group: admin
|
||||
{{- if .Values.secret.dashboard }}
|
||||
basicauth_credentials:
|
||||
- consumer: DASHBOARD
|
||||
username: ${DASHBOARD_USERNAME}
|
||||
password: ${DASHBOARD_PASSWORD}
|
||||
{{- end }}
|
||||
services:
|
||||
# Dedicated health endpoint used by the GCE LB BackendConfig.
|
||||
# request-termination returns 200 synchronously without hitting any
|
||||
|
||||
@ -71,28 +71,6 @@ spec:
|
||||
name: {{ include "supabase.secret.jwt" . }}
|
||||
key: serviceKey
|
||||
{{- end }}
|
||||
{{- if .Values.secret.dashboard }}
|
||||
- name: DASHBOARD_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.secret.dashboard.secretRef }}
|
||||
name: {{ .Values.secret.dashboard.secretRef }}
|
||||
key: {{ .Values.secret.dashboard.secretRefKey.username | default "username" }}
|
||||
{{- else }}
|
||||
name: {{ include "supabase.secret.dashboard" . }}
|
||||
key: username
|
||||
{{- end }}
|
||||
- name: DASHBOARD_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.secret.dashboard.secretRef }}
|
||||
name: {{ .Values.secret.dashboard.secretRef }}
|
||||
key: {{ .Values.secret.dashboard.secretRefKey.password | default "password" }}
|
||||
{{- else }}
|
||||
name: {{ include "supabase.secret.dashboard" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.deployment.kong.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
|
||||
@ -13,10 +13,10 @@ Expand the name of the SMTP secret.
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the dashboard secret.
|
||||
Expand the name of the openai secret.
|
||||
*/}}
|
||||
{{- define "supabase.secret.dashboard" -}}
|
||||
{{- printf "%s-dashboard" (include "supabase.fullname" .) }}
|
||||
{{- define "supabase.secret.openai" -}}
|
||||
{{- printf "%s-openai" (include "supabase.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{{- if .Values.secret.dashboard }}
|
||||
{{- if not .Values.secret.dashboard.secretRef }}
|
||||
{{- if .Values.secret.openai }}
|
||||
{{- if not .Values.secret.openai.secretRef }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "supabase.secret.dashboard" . }}
|
||||
name: {{ include "supabase.secret.openai" . }}
|
||||
labels:
|
||||
{{- include "supabase.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- range $key, $value := .Values.secret.dashboard }}
|
||||
{{- range $key, $value := .Values.secret.openai }}
|
||||
{{- if $value }}
|
||||
{{- if eq (typeOf $value) "string" }}
|
||||
{{ $key }}: {{ $value | b64enc }}
|
||||
|
||||
@ -92,12 +92,12 @@ spec:
|
||||
- name: OPENAI_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.secret.dashboard.secretRef }}
|
||||
name: {{ .Values.secret.dashboard.secretRef }}
|
||||
key: {{ .Values.secret.dashboard.secretRefKey.openAiApiKey | default "openAiApiKey" }}
|
||||
{{- if .Values.secret.openai.secretRef }}
|
||||
name: {{ .Values.secret.openai.secretRef }}
|
||||
key: {{ .Values.secret.openai.secretRefKey.apiKey | default "apiKey" }}
|
||||
{{- else }}
|
||||
name: {{ include "supabase.secret.dashboard" . }}
|
||||
key: openAiApiKey
|
||||
name: {{ include "supabase.secret.openai" . }}
|
||||
key: apiKey
|
||||
{{- end }}
|
||||
|
||||
- name: SUPABASE_ANON_KEY
|
||||
|
||||
@ -101,21 +101,18 @@ secret:
|
||||
# username: username
|
||||
# password: password
|
||||
|
||||
## Studio dashboard credentials
|
||||
##
|
||||
dashboard:
|
||||
username: "supabase"
|
||||
password: "this_password_is_insecure_and_should_be_updated"
|
||||
openAiApiKey: "key_super_secret"
|
||||
## OpenAI API key — passed to Studio's AI Assist sidebar.
|
||||
## Optional; if absent, the AI Assist panel renders an error toast but
|
||||
## the rest of Studio works fine. Replace via secretRef in production.
|
||||
openai:
|
||||
apiKey: "key_super_secret"
|
||||
|
||||
## Reference to existing secret
|
||||
# secretRef: ""
|
||||
|
||||
## Map to actual keys inside secretRef if they differ
|
||||
# secretRefKey:
|
||||
# username: username
|
||||
# password: password
|
||||
# openAiApiKey: openAiApiKey
|
||||
# apiKey: apiKey
|
||||
|
||||
## S3-compatible credentials
|
||||
##
|
||||
|
||||
Loading…
Reference in New Issue
Block a user