feat: add envfrom into deployments to enable loading entire secrets or configMaps into container ENV_VARs #109
Conversation
…r configMaps into container ENV_VARs Signed-off-by: Marcel Dias <marcel@pltf.dev>
WalkthroughThe changes involve enhancements and clarifications to the Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (4)
- charts/n8n/templates/deployment.webhooks.yaml (1 hunks)
- charts/n8n/templates/deployment.worker.yaml (1 hunks)
- charts/n8n/templates/deployment.yaml (1 hunks)
- charts/n8n/values.yaml (1 hunks)
Additional comments not posted (4)
charts/n8n/templates/deployment.webhooks.yaml (1)
59-62: Review ofenvFromblock additionThe addition of the
envFromblock to load environment variables from external sources like ConfigMaps or Secrets is implemented correctly. This change should help in reducing the boilerplate needed to map each environment variable individually and supports better secrets management practices.charts/n8n/templates/deployment.worker.yaml (1)
59-62: Review ofenvFromblock addition in worker deploymentThe
envFromblock has been correctly added to the worker deployment template, allowing for the seamless integration of environment variables from ConfigMaps or Secrets. This change aligns with best practices for managing environment variables in Kubernetes deployments.charts/n8n/templates/deployment.yaml (1)
70-73: Review ofenvFromblock addition in main deploymentThe
envFromblock has been correctly integrated into the main deployment template. This facilitates the loading of all keys from a ConfigMap or Secret as environment variables, which is particularly useful when dealing with multiple environment variables that are managed externally.charts/n8n/values.yaml (1)
119-122: Review ofenvFromsection removalThe removal of the
envFromsection from thevalues.yamlfile simplifies the Helm chart by removing unused or commented-out configurations. This change should make the chart cleaner and reduce confusion. However, it's important to ensure that all necessary configurations are still possible through other means provided in the Helm chart.
|
update of readme is needed, to indicated this possibility. |
Signed-off-by: Marcel Dias <marcel@pltf.dev>
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
README.md(1 hunks)
🔇 Additional comments (1)
README.md (1)
195-200: Verify the integration with existing secret management
The new envFrom feature needs to be verified for compatibility with the existing existingSecret and secret configurations to ensure there are no conflicts.
✅ Verification successful
Let me check the actual implementation details to verify if there are any conflicts.
No conflicts found between envFrom and existing secret management
The implementation shows clear separation between different secret management approaches:
envFromis used for mounting existing secrets as environment variablesexistingSecret/secretare used specifically for mounting/n8n-secret/secret.jsonextraEnvSecretshandles individual environment variables from existing secrets
These mechanisms operate independently and serve different purposes without interference.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for potential conflicts between envFrom and existing secret management
# Search for existing secret handling in templates
echo "Checking secret handling in templates:"
rg -l 'secret' --type yaml
# Search for envFrom usage in templates
echo "Checking envFrom implementation:"
rg -l 'envFrom' --type yaml
Length of output: 597
Script:
#!/bin/bash
# Check the implementation of secret handling and envFrom in deployment templates
echo "=== Checking deployment.yaml ==="
rg -A 5 'secret|envFrom' charts/n8n/templates/deployment.yaml
echo -e "\n=== Checking values.yaml ==="
rg -A 5 'secret|envFrom' charts/n8n/values.yaml
echo -e "\n=== Checking secret.yaml ==="
cat charts/n8n/templates/secret.yaml
Length of output: 2920
README.md
Outdated
| # Set additional environment variables on the Deployment from k8s secrets | ||
| envFrom: [] | ||
| # List of existing secrets to add to deployments | ||
| # - secretRef: | ||
| # name: secret-name | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Documentation for the new envFrom feature needs enhancement
While the basic structure for envFrom configuration is documented, it would benefit from:
- A description of its purpose (loading entire secrets/configMaps as environment variables)
- An example showing how to use it with ExternalSecrets from AWS SSM ParameterStore
- Integration with the "Typical Values Example" section
Add the following content after line 200:
# - secretRef:
# name: secret-name
+
+# Example using envFrom with AWS SSM ParameterStore via ExternalSecrets:
+# envFrom:
+# - secretRef:
+# name: my-external-secret # Secret created by ExternalSecrets
+
+# For more information about using envFrom with ExternalSecrets, see:
+# https://external-secrets.io/latest/guides/common-k8s-secret-types/#basic-secretAlso, add this example to the "Typical Values Example" section:
secret:
database:
postgresdb:
password: 'big secret'
+
+# Load all environment variables from an existing secret
+envFrom:
+ - secretRef:
+ name: my-environment-variablesCommittable suggestion skipped: line range outside the PR's diff.
Signed-off-by: Marcel Dias <marcel@pltf.dev>
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (2)
README.md (2)
195-202: Enhance documentation for the envFrom featureThe basic structure for
envFromconfiguration is documented well. However, to make it more comprehensive and user-friendly, consider adding:
- A brief description explaining that
envFromallows loading entire secrets or configMaps as environment variables- An example showing configMap usage alongside the secret example
- A link to Kubernetes documentation about envFrom
Add the following content:
# Set additional environment variables on the Deployment from k8s secrets envFrom: [] # List of existing secrets to add to deployments +# This allows loading entire secrets or configMaps as environment variables without mapping each key individually +# For more information, see: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables + # Example using envFrom with AWS SSM ParameterStore via ExternalSecrets: # envFrom: # - secretRef: # name: secret-name +# - configMapRef: +# name: config-name
195-202: Add envFrom example to the "Typical Values Example" sectionTo help users understand how to use this feature in a real-world scenario, consider adding an example to the "Typical Values Example" section that shows how to use
envFromalongside other configurations.Add this example to the "Typical Values Example" section:
# values.yaml config: database: type: postgresdb postgresdb: host: 192.168.0.52 secret: database: postgresdb: password: 'big secret' + +# Load environment variables from existing secrets/configMaps +envFrom: + - secretRef: + name: aws-parameters # Secret created by ExternalSecrets from AWS SSM + - configMapRef: + name: app-config # ConfigMap containing non-sensitive configuration
|
@Vad1mo I have updated the readme. Would appreciate you review. |
feat: add envFrom into deployments to enable loading entire secrets or configMaps into container ENV_VARs
Scenario:
I use ExternalSecrets to fetch ENV_VARs from AWS SSM ParameterStore and create k8s secrets. Using envFrom is possible to load the entire secret without mapping key by key.
Summary by CodeRabbit
New Features
Typical Values Exampleto provide practical configuration insights.Chores
Requirements,Configuration,Installation,N8N Specific Config,Values, andScalingsections for improved clarity and usability.