Pitch
The Helm Chart's values.yaml should accept an existingSecret value for any secret value., and based on that value, either template the Secrets as necessary or refer to the provided existingSecret for the value. For example, refer to many of Bitnami's charts but specifically https://github.com/bitnami/charts/tree/master/bitnami/postgresql-ha.
Motivation
This change would allow an entire Mastodon configuration to be stored in Git. An Instance's entire custom-values.yaml would be safe to share publicly as the sensitive info will be stored within the target cluster. This is in-line with modern DevOps practice and just feels good as a proponent of Infrastructure-as-Code.
Further, anyone reading the custom-values.yaml or even the base values.yaml will know that Secrets must/can be configured in advance rather than at deployment (the alternative is having a custom-values.yaml and a separate secrets.yaml that is not stored in the repo, which is not very clear).
This is the one thing that is holding me back from deploying my own instance, and I'm willing to submit a PR adding this functionality if the maintainers are open to it!
Pitch
The Helm Chart's values.yaml should accept an
existingSecretvalue for any secret value., and based on that value, either template theSecretsas necessary or refer to the providedexistingSecretfor the value. For example, refer to many of Bitnami's charts but specifically https://github.com/bitnami/charts/tree/master/bitnami/postgresql-ha.Motivation
This change would allow an entire Mastodon configuration to be stored in Git. An Instance's entire
custom-values.yamlwould be safe to share publicly as the sensitive info will be stored within the target cluster. This is in-line with modern DevOps practice and just feels good as a proponent of Infrastructure-as-Code.Further, anyone reading the
custom-values.yamlor even the basevalues.yamlwill know thatSecretsmust/can be configured in advance rather than at deployment (the alternative is having acustom-values.yamland a separatesecrets.yamlthat is not stored in the repo, which is not very clear).This is the one thing that is holding me back from deploying my own instance, and I'm willing to submit a PR adding this functionality if the maintainers are open to it!