From 4f2f937e17db6fafe6d452dc76ccb51cb0da1c4d Mon Sep 17 00:00:00 2001 From: Oscar Carlsson Date: Fri, 2 Oct 2026 08:15:25 +0200 Subject: [PATCH] Clarify how the existingSecret really works --- charts/trek/templates/NOTES.txt | 7 +++++-- charts/trek/values.yaml | 6 +++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/charts/trek/templates/NOTES.txt b/charts/trek/templates/NOTES.txt index 0c11d0dc8..f4cbe3144 100644 --- a/charts/trek/templates/NOTES.txt +++ b/charts/trek/templates/NOTES.txt @@ -2,8 +2,11 @@ - ENCRYPTION_KEY encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. - By default, the chart creates a Kubernetes Secret from `secretEnv.ENCRYPTION_KEY` in values.yaml. - To generate a random key at install (preserved across upgrades), set `generateEncryptionKey: true`. - - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The secret must - contain a key matching `existingSecretKey` (defaults to `ENCRYPTION_KEY`). + - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The chart then + renders no Secret of its own and reads every secret env var from that secret: `ENCRYPTION_KEY` + (renamable via `existingSecretKey`), plus `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `OIDC_CLIENT_SECRET`, + `UNSPLASH_ACCESS_KEY`, `AMAP_API_KEY` and `AMAP_API_SECRET`. Missing keys are simply left unset, + so only provide the ones you use. - If left empty, the server resolves the key automatically: existing installs fall back to data/.jwt_secret (encrypted data stays readable with no manual action); fresh installs auto-generate a key persisted to the data PVC. diff --git a/charts/trek/values.yaml b/charts/trek/values.yaml index 1c32275c9..80b1152dd 100644 --- a/charts/trek/values.yaml +++ b/charts/trek/values.yaml @@ -171,7 +171,11 @@ secretEnv: # If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades generateEncryptionKey: false -# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY +# If set, the chart renders no Secret of its own and instead reads every secret env +# var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via +# existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET, +# UNSPLASH_ACCESS_KEY, AMAP_API_KEY, AMAP_API_SECRET. Missing keys are simply left +# unset (they are optional), so only provide the ones your setup needs. existingSecret: "" existingSecretKey: ENCRYPTION_KEY