Pass helm credentials #301
Comments
|
Hi, I'm not sure that error is related to the private secret. It seems more like it's just having a problem managing helm local cache directory? Perhaps you could run with --log-level=DEBUG (before other params) and pull out any relevant helm lines? It's supposed to make all the needed directories for helm. |
|
Oh I see, it can't pull the helm chart from the repo, you are right. I misunderstood thinking we were talking about the release, not repo. |
|
Do you have an example of how to use helm cli with secrets like this? Are there fields in the repository config or something else? |
|
Hi @allenporter, sorry for the late response. You can reproduce the same behavior with helm when adding the repo without a password: The same command succeeds with username and password: Interestingly, helm already fails when adding the repository. flux-local only terminates with an error when I also add a helm release. |
|
@allenporter is there something I can further assist with? |
|
Thanks for the extra detail -- sorry this fell off my radar. The way this works now in flux local is that instead of adding the repo one at a time, it makes the repository config file: Line 75 in b15d571 help template command Line 205 in b15d571 --password and a --username flag so that looks like it can be used.
I think the steps we need are:
I realize though we need a way to pass a secret for that repository... Maybe another command line flag similar to --sources, or maybe an enviroment variable, or maybe it can find it from another object in the cluster (e.g. you create a fake |
|
@allenporter Thanks for the explanation of what happens in the code. I'm going to take some time to get my head around the options here. I can also pass the token via the URL and postBuild variable substitution like this However, I do not think variable substitution is supported by flux-local atm, but perhaps this is an easier approach to implement. |
|
I haven't come up with a perfect solution yet, but I've managed to get it to work with variables substitution before running flux-local. I'm still not sure how we should pass credentials to flux-local, I think the best way would be to pass username and password to the As for the environment variable part, I'm not sure about the naming of the variables. In my case, only one token is needed for each chart, but I think a solution should support different tokens per helm repository. This would require environment variables like |
|
Maybe we can add a flag where secretes are passed in as key/value pairs, then referenced as needed. |
|
Hello all, |
|
@xakaitetoia ---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: myhelmrepo
namespace: flux-system
spec:
interval: 1m
url: https://token:${helm_pull_token}@gitlab.example.com/api/v4/projects/1234/packages/helm/stableWe run a script in our pipeline that recursively replaces the helm_pull_token in all files in a given subdirectory with an actual token created at runtime: #!/bin/bash
folder_path="$1"
replace_variable_in_file() {
file_path="$1"
envsubst '$helm_pull_token' < "$file_path" > temp.txt
mv temp.txt "$file_path"
}
search_files_recursive() {
local current_folder="$1"
for file in "$current_folder"/*; do
if [ -f "$file" ]; then
replace_variable_in_file "$file"
elif [ -d "$file" ]; then
search_files_recursive "$file"
fi
done
}
search_files_recursive "$folder_path"Not a pretty solution, but it gets the job done. |
We have added a private helm repository to our flux deployment.
Flux gets its credentials from a secret in the kubernetes cluster (which is therefore of course not available to flux-local in the repo).
Example helm repository:
Accordingly, a flux-local run in the CI pipeline terminates with the following error:
We would therefore need a way to also provide a secret via flux-local to helm, so that we could pull and diff the private helmrelease from within a ci pipeline.
The text was updated successfully, but these errors were encountered: