You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fluss.apache.org by ip...@apache.org on 2026/04/17 11:04:07 UTC
(fluss) branch main updated: [helm] Support injecting environment variables and external secrets (#3098)
This is an automated email from the ASF dual-hosted git repository.
ipolyzos pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fluss.git
The following commit(s) were added to refs/heads/main by this push:
new 3e23c69c6 [helm] Support injecting environment variables and external secrets (#3098)
3e23c69c6 is described below
commit 3e23c69c6705cebb263cce76e2c7036a7bb5c29e
Author: Anton Borisov <14...@users.noreply.github.com>
AuthorDate: Fri Apr 17 12:04:03 2026 +0100
[helm] Support injecting environment variables and external secrets (#3098)
* [helm] Support injecting environment variables and external secrets
* skip whole suite on helm changes
* avoid allowlist
---
.github/workflows/ci.yaml | 2 +
.github/workflows/helm-chart.yaml | 7 +-
helm/templates/sts-coordinator.yaml | 7 +
helm/templates/sts-tablet.yaml | 7 +
helm/tests/env_test.yaml | 174 +++++++++++++++++++++
helm/values.yaml | 4 +
website/docs/install-deploy/deploying-with-helm.md | 33 ++++
7 files changed, 230 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 931cf07c8..4ef7d372d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -24,10 +24,12 @@ on:
- ci-**
paths-ignore:
- 'website/**'
+ - 'helm/**'
- '**/*.md'
pull_request:
paths-ignore:
- 'website/**'
+ - 'helm/**'
- '**/*.md'
concurrency:
diff --git a/.github/workflows/helm-chart.yaml b/.github/workflows/helm-chart.yaml
index da529c530..28493856e 100644
--- a/.github/workflows/helm-chart.yaml
+++ b/.github/workflows/helm-chart.yaml
@@ -48,7 +48,6 @@ jobs:
run: helm lint ./helm
- name: "Run helm-unittest"
- uses: d3adb5/helm-unittest-action@v2
- with:
- helm-version: latest
- charts: helm
+ run: |
+ helm plugin install https://github.com/helm-unittest/helm-unittest
+ helm unittest ./helm
diff --git a/helm/templates/sts-coordinator.yaml b/helm/templates/sts-coordinator.yaml
index 6773ba4b4..7bd9d7f36 100644
--- a/helm/templates/sts-coordinator.yaml
+++ b/helm/templates/sts-coordinator.yaml
@@ -68,6 +68,13 @@ spec:
- name: FLUSS_ENV_JAVA_OPTS
value: "-Djava.security.auth.login.config=/etc/fluss/conf/jaas.conf"
{{- end }}
+ {{- with .Values.coordinator.extraEnv }}
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.coordinator.envFrom }}
+ envFrom:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
ports:
- name: internal
containerPort: {{ .Values.listeners.internal.port }}
diff --git a/helm/templates/sts-tablet.yaml b/helm/templates/sts-tablet.yaml
index b7a1cb78b..4390174f2 100644
--- a/helm/templates/sts-tablet.yaml
+++ b/helm/templates/sts-tablet.yaml
@@ -64,6 +64,13 @@ spec:
- name: FLUSS_ENV_JAVA_OPTS
value: "-Djava.security.auth.login.config=/etc/fluss/conf/jaas.conf"
{{- end }}
+ {{- with .Values.tablet.extraEnv }}
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.tablet.envFrom }}
+ envFrom:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
ports:
- name: internal
containerPort: {{ .Values.listeners.internal.port }}
diff --git a/helm/tests/env_test.yaml b/helm/tests/env_test.yaml
new file mode 100644
index 000000000..7d8a3e617
--- /dev/null
+++ b/helm/tests/env_test.yaml
@@ -0,0 +1,174 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+suite: defaults
+templates:
+ - templates/sts-coordinator.yaml
+ - templates/sts-tablet.yaml
+
+tests:
+ - it: should not render envFrom by default on coordinator
+ asserts:
+ - isNull:
+ path: spec.template.spec.containers[0].envFrom
+ template: templates/sts-coordinator.yaml
+
+ - it: should not render envFrom by default on tablet
+ asserts:
+ - isNull:
+ path: spec.template.spec.containers[0].envFrom
+ template: templates/sts-tablet.yaml
+
+---
+
+suite: coordinator env
+templates:
+ - templates/sts-coordinator.yaml
+
+tests:
+ - it: should render envFrom with secretRef on coordinator
+ set:
+ coordinator.envFrom:
+ - secretRef:
+ name: my-eso-secret
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ secretRef:
+ name: my-eso-secret
+
+ - it: should render envFrom with configMapRef on coordinator
+ set:
+ coordinator.envFrom:
+ - configMapRef:
+ name: my-config
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ configMapRef:
+ name: my-config
+
+ - it: should render extraEnv on coordinator
+ set:
+ coordinator.extraEnv:
+ - name: AWS_REGION
+ value: us-east-1
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].env
+ content:
+ name: AWS_REGION
+ value: us-east-1
+
+ - it: should not apply tablet env to coordinator
+ set:
+ tablet.envFrom:
+ - secretRef:
+ name: tablet-secret
+ tablet.extraEnv:
+ - name: TABLET_ONLY
+ value: "true"
+ asserts:
+ - isNull:
+ path: spec.template.spec.containers[0].envFrom
+ - notContains:
+ path: spec.template.spec.containers[0].env
+ content:
+ name: TABLET_ONLY
+ value: "true"
+
+---
+
+suite: tablet env
+templates:
+ - templates/sts-tablet.yaml
+
+tests:
+ - it: should render envFrom with secretRef on tablet
+ set:
+ tablet.envFrom:
+ - secretRef:
+ name: my-eso-secret
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ secretRef:
+ name: my-eso-secret
+
+ - it: should render envFrom with configMapRef on tablet
+ set:
+ tablet.envFrom:
+ - configMapRef:
+ name: my-config
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ configMapRef:
+ name: my-config
+
+ - it: should render extraEnv on tablet
+ set:
+ tablet.extraEnv:
+ - name: AWS_REGION
+ value: us-east-1
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].env
+ content:
+ name: AWS_REGION
+ value: us-east-1
+
+ - it: should render multiple envFrom sources on tablet
+ set:
+ tablet.envFrom:
+ - secretRef:
+ name: secret-one
+ - secretRef:
+ name: secret-two
+ asserts:
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ secretRef:
+ name: secret-one
+ - contains:
+ path: spec.template.spec.containers[0].envFrom
+ content:
+ secretRef:
+ name: secret-two
+
+ - it: should not apply coordinator env to tablet
+ set:
+ coordinator.envFrom:
+ - secretRef:
+ name: coordinator-secret
+ coordinator.extraEnv:
+ - name: COORDINATOR_ONLY
+ value: "true"
+ asserts:
+ - isNull:
+ path: spec.template.spec.containers[0].envFrom
+ - notContains:
+ path: spec.template.spec.containers[0].env
+ content:
+ name: COORDINATOR_ONLY
+ value: "true"
diff --git a/helm/values.yaml b/helm/values.yaml
index 7dd11f545..7f3569497 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -46,6 +46,8 @@ tablet:
extraVolumes: []
extraVolumeMounts: []
initContainers: []
+ extraEnv: []
+ envFrom: []
coordinator:
numberOfReplicas: 1
@@ -56,6 +58,8 @@ coordinator:
extraVolumes: []
extraVolumeMounts: []
initContainers: []
+ extraEnv: []
+ envFrom: []
# Fluss listener configurations
listeners:
diff --git a/website/docs/install-deploy/deploying-with-helm.md b/website/docs/install-deploy/deploying-with-helm.md
index ec39572f8..23afef60b 100644
--- a/website/docs/install-deploy/deploying-with-helm.md
+++ b/website/docs/install-deploy/deploying-with-helm.md
@@ -271,12 +271,45 @@ It is recommended to set these explicitly in production.
| `coordinator.extraVolumes` | Extra volumes to add to the CoordinatorServer pod spec | `[]` |
| `coordinator.extraVolumeMounts` | Extra volume mounts to add to the coordinator container | `[]` |
| `coordinator.initContainers` | Init containers to run before the coordinator container starts | `[]` |
+| `coordinator.extraEnv` | Additional environment variables for the coordinator container | `[]` |
+| `coordinator.envFrom` | Additional envFrom sources (e.g., Secrets, ConfigMaps) for the coordinator container | `[]` |
| `tablet.extraVolumes` | Extra volumes to add to TabletServer pod specs | `[]` |
| `tablet.extraVolumeMounts` | Extra volume mounts to add to the tablet container | `[]` |
| `tablet.initContainers` | Init containers to run before the tablet container starts | `[]` |
+| `tablet.extraEnv` | Additional environment variables for the tablet container | `[]` |
+| `tablet.envFrom` | Additional envFrom sources (e.g., Secrets, ConfigMaps) for the tablet container | `[]` |
## Advanced Configuration
+### Injecting Environment Variables from External Secrets
+
+You can inject environment variables from Kubernetes Secrets or ConfigMaps using `envFrom`. This is useful when combined with the [External Secrets Operator](https://external-secrets.io/) or similar tools that provision Secrets from external stores (AWS Secrets Manager, HashiCorp Vault, etc.).
+
+```yaml
+tablet:
+ envFrom:
+ - secretRef:
+ name: aws-credentials
+coordinator:
+ envFrom:
+ - secretRef:
+ name: aws-credentials
+```
+
+You can also set individual environment variables using `extraEnv`:
+
+```yaml
+tablet:
+ extraEnv:
+ - name: AWS_REGION
+ value: us-east-1
+ - name: MY_SECRET
+ valueFrom:
+ secretKeyRef:
+ name: my-secret
+ key: password
+```
+
### Custom ZooKeeper Configuration
For external ZooKeeper clusters: