Instead of just dropping the values of .Values.hasura.overrideDbUrl, .Values.hasura.metadataDbUrl, and .Values.postgres.externalDbUrl directly into environment variables, those environment variables should be set from the chaingraph-secrets object like postgresConnectionString. This ensures that other systems never unintentionally leak the connection information. (Secrets don't get automatically logged or displayed in many places, simple environment variables do.)
E.g. see difference in treatment here:
|
name: hasura |
|
env: |
|
- name: HASURA_GRAPHQL_DATABASE_URL |
|
{{ if .Values.hasura.overrideDbUrl }} |
|
value: {{ .Values.hasura.overrideDbUrl }} |
|
{{ else if .Values.postgres.externalDbUrl }} |
|
value: {{ .Values.postgres.externalDbUrl }} |
|
{{ else }} |
|
valueFrom: |
|
secretKeyRef: |
|
name: chaingraph-secrets |
|
key: postgresConnectionString |
|
{{ end }} |
|
- name: HASURA_GRAPHQL_METADATA_DATABASE_URL |
|
{{ if .Values.hasura.metadataDbUrl }} |
|
value: {{ .Values.hasura.metadataDbUrl }} |
|
{{ else if .Values.hasura.overrideDbUrl }} |
|
value: {{ .Values.hasura.overrideDbUrl }} |
|
{{ else if .Values.postgres.externalDbUrl }} |
|
value: {{ .Values.postgres.externalDbUrl }} |
|
{{ else }} |
|
valueFrom: |
|
secretKeyRef: |
|
name: chaingraph-secrets |
|
key: postgresConnectionString |
|
{{ end }} |
|
- name: HASURA_GRAPHQL_ADMIN_SECRET |
|
{{ if .Values.hasura.adminSecretKey }} |
|
value: {{ .Values.hasura.adminSecretKey }} |
|
{{ else }} |
|
valueFrom: |
|
secretKeyRef: |
|
name: chaingraph-secrets |
|
key: adminSecretKey |
|
{{ end }} |
And the chart documentation will also need to be updated to better explain how to add/modify those values.
Instead of just dropping the values of
.Values.hasura.overrideDbUrl,.Values.hasura.metadataDbUrl, and.Values.postgres.externalDbUrldirectly into environment variables, those environment variables should be set from thechaingraph-secretsobject likepostgresConnectionString. This ensures that other systems never unintentionally leak the connection information. (Secrets don't get automatically logged or displayed in many places, simple environment variables do.)E.g. see difference in treatment here:
chaingraph/charts/chaingraph/templates/hasura.yaml
Lines 23 to 57 in ee3c284
And the chart documentation will also need to be updated to better explain how to add/modify those values.