feat: Support secret keys configurable (#257)

Co-authored-by: velotioaastha <aastha.gupta@velotio.com>
wandb · Nov 14, 2024 · 3b114e9 · 3b114e9
1 parent 18d745a
commit 3b114e9
Show file tree

Hide file tree

Showing 12 changed files with 30 additions and 26 deletions.
diff --git a/charts/operator-wandb/Chart.lock b/charts/operator-wandb/Chart.lock
@@ -42,4 +42,4 @@ dependencies:
   repository: file://charts/yace
   version: 0.1.0
 digest: sha256:bca2b6781737da6806e4485605cf9ce87b1428944b14cb88f082024cc3500bbd
-generated: "2024-11-08T13:07:42.344971+05:30"
+generated: "2024-11-08T13:42:24.351184+05:30"
diff --git a/charts/operator-wandb/Chart.yaml b/charts/operator-wandb/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator-wandb
 description: A Helm chart for deploying W&B to Kubernetes
 type: application
-version: 0.18.15
+version: 0.18.16
 appVersion: 1.0.0
 icon: https://wandb.ai/logo.svg
 

diff --git a/charts/operator-wandb/charts/app/templates/_deployment.tpl b/charts/operator-wandb/charts/app/templates/_deployment.tpl
@@ -62,7 +62,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
           command: ['bash', '-c', "until mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASSWORD -D$MYSQL_DATABASE -P$MYSQL_PORT --execute=\"SELECT 1\"; do echo waiting for db; sleep 2; done"]
       containers:
         - name: {{ .Chart.Name }}
@@ -119,7 +119,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: MYSQL
               value: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_HOST):$(MYSQL_PORT)/$(MYSQL_DATABASE)"
             - name: WEAVE_SERVICE
@@ -137,7 +137,7 @@ spec:
                 secretKeyRef:
                   name: {{ include "wandb.redis.passwordSecret" . }}
                   optional: true
-                  key: REDIS_PASSWORD
+                  key: {{ .Values.global.redis.secretKey }}
             - name: REDIS_PORT
               value: "{{ include "wandb.redis.port" . }}"
             - name: REDIS_HOST
@@ -217,7 +217,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: "{{ include "wandb.bucket.secret" . }}"
-                  key: ACCESS_KEY
+                  key: {{ .Values.global.bucket.accessKeyName }}
                   optional: true
             - name: GORILLA_CUSTOMER_SECRET_STORE_K8S_CONFIG_NAMESPACE
               valueFrom:

diff --git a/charts/operator-wandb/charts/flat-run-fields-updater/templates/deployment.yaml b/charts/operator-wandb/charts/flat-run-fields-updater/templates/deployment.yaml
@@ -76,7 +76,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: "{{ include "wandb.bucket.secret" . }}"
-                  key: ACCESS_KEY
+                  key: {{ .Values.global.bucket.accessKeyName }}
                   optional: true
             - name: GORILLA_CUSTOMER_SECRET_STORE_K8S_CONFIG_NAMESPACE
               valueFrom:
@@ -104,7 +104,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: MYSQL
               value: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_HOST):$(MYSQL_PORT)/$(MYSQL_DATABASE)"
             - name: KAFKA_BROKER_HOST

diff --git a/charts/operator-wandb/charts/mysql/templates/statefulset.yaml b/charts/operator-wandb/charts/mysql/templates/statefulset.yaml
@@ -49,12 +49,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_ROOT_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.rootPasswordKey }}
             - name: MYSQL_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
             {{- include "mysql.extraEnv" (dict "global" .Values.global "local" .Values) | nindent 12 }}
             {{- include "wandb.extraEnvFrom" (dict "root" $ "local" .) | nindent 12 }}
           livenessProbe:

diff --git a/charts/operator-wandb/charts/otel/charts/agent/templates/deamonset.yaml b/charts/operator-wandb/charts/otel/charts/agent/templates/deamonset.yaml
@@ -79,7 +79,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: K8S_NODE_NAME
               valueFrom:
                 fieldRef:
@@ -131,4 +131,4 @@ spec:
           hostPath:
             path: /var/lib/docker/containers
       hostNetwork: false
-{{- end }}
+{{- end }}
diff --git a/charts/operator-wandb/charts/otel/charts/agent/templates/deployment.yaml b/charts/operator-wandb/charts/otel/charts/agent/templates/deployment.yaml
@@ -1,3 +1,4 @@
+
 {{- if eq .Values.mode "deployment" -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -74,8 +75,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key:  MYSQL_PASSWORD
-
+                  key:  {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: K8S_NODE_NAME
               valueFrom:
                 fieldRef:

diff --git a/charts/operator-wandb/charts/parquet/templates/cron.yaml b/charts/operator-wandb/charts/parquet/templates/cron.yaml
@@ -75,7 +75,7 @@ spec:
                   valueFrom:
                     secretKeyRef:
                       name: {{ include "wandb.mysql.passwordSecret" . }}
-                      key:  MYSQL_PASSWORD
+                      key:  {{ .Values.global.mysql.passwordSecret.passwordKey }}
                 - name: MYSQL
                   value: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_HOST):$(MYSQL_PORT)/$(MYSQL_DATABASE)"
 
@@ -129,7 +129,7 @@ spec:
                   valueFrom:
                     secretKeyRef:
                       name: "{{ include "wandb.bucket.secret" . }}"
-                      key: ACCESS_KEY
+                      key: {{ .Values.global.bucket.accessKeyName }}
                       optional: true
 
                 - name: G_HOST_IP
@@ -149,4 +149,4 @@ spec:
                     path: redis_ca.pem
             {{- end }}
           restartPolicy: Never
-{{- end }}
+{{- end }}
diff --git a/charts/operator-wandb/charts/parquet/templates/deployment.yaml b/charts/operator-wandb/charts/parquet/templates/deployment.yaml
@@ -1,3 +1,4 @@
+
 {{- if .Values.enabled }}
 {{- $imageCfg := dict "global" $.Values.global.image "local" $.Values.image -}}
 apiVersion: apps/v1
@@ -88,7 +89,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key: MYSQL_PASSWORD
+                  key: {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: MYSQL
               value: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_HOST):$(MYSQL_PORT)/$(MYSQL_DATABASE)"
             - name: REDIS_PASSWORD
@@ -117,7 +118,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: "{{ include "wandb.bucket.secret" . }}"
-                  key: ACCESS_KEY
+                  key: {{ .Values.global.bucket.accessKeyName }}
                   optional: true
 
             - name: G_HOST_IP

diff --git a/charts/operator-wandb/charts/prometheus/charts/mysql-exporter/templates/deployment.yaml b/charts/operator-wandb/charts/prometheus/charts/mysql-exporter/templates/deployment.yaml
@@ -1,3 +1,4 @@
+
 {{- if .Values.enabled }}
 {{- $imageCfg := dict "global" $.Values.global.image "local" $.Values.image -}}
 apiVersion: apps/v1
@@ -64,15 +65,15 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key:  MYSQL_PASSWORD
+                  key:  {{ .Values.global.mysql.passwordSecret.passwordKey }}
             - name: MYSQL
               value: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_HOST):$(MYSQL_PORT)/$(MYSQL_DATABASE)"
 
             - name: MYSQLD_EXPORTER_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ include "wandb.mysql.passwordSecret" . }}
-                  key:  MYSQL_PASSWORD
+                  key:  {{ .Values.global.mysql.passwordSecret.passwordKey }}
 
             {{- include "mysql-exporter.extraEnv" (dict "global" $.Values.global "local" .Values) | nindent 12 }}
             {{- include "wandb.extraEnvFrom" (dict "root" $ "local" .) | nindent 12 }}
@@ -96,4 +97,4 @@ spec:
               - key: REDIS_CA_CERT
                 path: redis_ca.pem
         {{- end }}
-{{- end }}
+{{- end }}
diff --git a/charts/operator-wandb/templates/_mysql.tpl b/charts/operator-wandb/templates/_mysql.tpl
@@ -9,7 +9,6 @@ Return the name of the secret where information is stored, considering if the cu
 {{- end -}}
 {{- end -}}
 
-
 {{/*
 Return the db port
 */}}
@@ -47,6 +46,4 @@ Return the db password
 */}}
 {{- define "wandb.mysql.password" -}}
 {{- print $.Values.global.mysql.password -}}
-{{- end -}}
-
-
+{{- end -}}
diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml
@@ -64,6 +64,8 @@ global:
     password: ""
     passwordSecret:
       name: ""
+      rootPasswordKey: "MYSQL_ROOT_PASSWORD"
+      passwordKey: "MYSQL_PASSWORD"
 
   slack:
     secret: ""
@@ -107,6 +109,8 @@ global:
   # If specified the application will use this bucket for all storage operations, and will not be overridable by the user.
   bucket:
     secretName: ""
+    accessKeyName: "ACCESS_KEY"
+    secretAccessKeyName: "SECRET_KEY"
 
   redis:
     host: ""
@@ -116,6 +120,7 @@ global:
     caCert: ""
     # The name of the user supplied secret containing the password for the redis instance.
     secretName: ""
+    secretKey: "REDIS_PASSWORD"
 
   kafka:
     # The following values are anchored here, and referenced by alias later for