Add ability to use secrets

[katherine-boost]

Hi there, thanks so much for providing this Helm chart!

I have a feature request: it would be awesome if there was some way to pass SealedSecrets to the Vouch helm chart, so that I can take mine out of plain text. Specifically,

• config.vouch.jwt.secret - https://github.com/halkeye-helm-charts/vouch/blob/master/values.yaml#L59
• config.oauth.client_id & .client_secret - https://github.com/halkeye-helm-charts/vouch/blob/master/values.yaml#L66:L67

e.g. how the MongoDB Replica Set Helm Chart implements auth.existingKeySecret, auth.existingMetricsSecret, and auth.existingAdminSecret.

I could maybe take a stab at a PR in a couple of weeks, if you're open to that.

Cheers!

[halkeye]

Always open to PRs. I'll see what I can do though. Existing is probably doable

[bnfinet]

Let me know if there's anything I can do to help. FYI env var config is about to drop later the week. Not sure if that would be helpful in this situation.

…

On Tue, May 19, 2020, 2:15 PM Gavin Mogan ***@***.***> wrote: Always open to PRs. I'll see what I can do though. Existing is probably doable — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJUV267XM62KOH2FFP34QTRSLZF5ANCNFSM4NFK5ZMQ> .

[halkeye]

I use helm secrets (sops) myself, so not a high priority for me, but it shouldn't be that hard to make all of https://github.com/halkeye-helm-charts/vouch/blob/master/templates/configmap.yaml a secret (i've learned a lot since this chart was made), and then if existingSecretName is set, just let you use existingSecretName instead of the chart populating it.

Just that new terraria dropped and I'm easily distracted :)

[bnfinet]

FYI - @bgehman offered this writeup including some details of his helm chart implementation using Secret instead of ConfigMap
vouch/vouch-proxy#263 (comment)

[bgehman]

@halkeye I don't have much experience with SealedSecrets (what OP is asking for), but I can submit a PR for moving the existing ConfigMap to Secret (very minor changes needed).

[halkeye]

Yea i'm not going to support sealedsecrets directly, cause its a custom resource descriptor that will break on some installs, but migrate from configmap => secret (👍 ) and supporting existingSecretName (👍) should handle the requested case

[halkeye]

This should be fixed via 92aeca9

I added existingSecretName if you want to completely override the secret the chart generates