Add support for existing secrets in Helm chart #43
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Enable users to reference an existing Kubernetes secret for root credentials instead of requiring password in values.yaml. This allows integration with external secret management solutions for production and GitOps workflows. Changes: - Add credentials.root.existingSecret parameter to values.yaml - Make cluster secret creation conditional (only when existingSecret not set) - Update InnoDBCluster to use existingSecret or default secret name The default behavior remains unchanged - if existingSecret is not set, the chart creates the secret automatically as before (backward compatible).
|
Hi, thank you for submitting this pull request. In order to consider your code we need you to sign the Oracle Contribution Agreement (OCA). Please review the details and follow the instructions at https://oca.opensource.oracle.com/ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Add support for using an existing Kubernetes secret for MySQL root credentials in the Helm chart, enabling secure GitOps workflows and integration with external secret management systems.
Contributor Checklist
Motivation
Current limitation:
credentials.root.passwordin values.yamlChanges
credentials.root.existingSecretparameterTesting
Verified with
helm template:✅ Traditional method (password in values) works unchanged
✅ With
existingSecret, chart skips secret creation✅ InnoDBCluster correctly references external secret
✅ Error message clear when neither password nor existingSecret provided
Example Usage
Before (insecure):
After (secure):
Backward Compatibility
100% backward compatible. Existing deployments continue to work without any changes.