<p>I'm using Helm on a Kubernetes cluster and have installed the stable <a href="https://github.com/helm/charts/tree/master/stable/rabbitmq-ha" rel="nofollow noreferrer">rabbitmq-ha chart</a>. I would like to push data to an exchange in rabbitmq from Logstash. I am trying to use the <a href="https://github.com/helm/charts/tree/master/stable/logstash" rel="nofollow noreferrer">logstash stable chart</a>.</p>

<p>The rabbitmq-ha chart has created a secret that contains the password to connect to it. I'd like to be able to get that password and include it in the logstash configuration so that logstash can connect to it.</p>

<p>The ConfigMap for logstash is templated using items from the values file.</p>

<pre><code>  outputs:
    main: |-
      output {
        rabbitmq {
          exchange =&gt; "exchange_name"
          exchange_type =&gt; "fanout"
          host =&gt; "rabbitmq-ha.default.svc.cluster.local"
          password =&gt; "????"
        }
      }
</code></pre>

<p>I don't want to hard-code the password in the values file because that's not great for security and it would mean duplicating the configuration for each environment. I can't see a way to get logstash to read the password from an environment variable.</p>

<p>How do people normally do this?</p>

<p>I could use <a href="https://github.com/futuresimple/helm-secrets" rel="nofollow noreferrer">helm secrets</a> to store the whole <code>outputs</code> configuration and include hard-coded passwords. That would avoid having plain-text passwords in my repository but still doesn't feel like the best way.</p>

<p>Turns out that it is possible to get logstash to read values from the environment variables since at least version 5.0 of logstash. <a href="https://www.elastic.co/guide/en/logstash/current/environment-variables.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/logstash/current/environment-variables.html</a></p>

<p>So my values file can look like</p>

<pre><code>  outputs:
    main: |-
      output {
        rabbitmq {
          exchange =&gt; "exchange_name"
          exchange_type =&gt; "fanout"
          host =&gt; "rabbitmq-ha.default.svc.cluster.local"
          password =&gt; "${RMQ_PASSWORD}"
        }
      }
</code></pre>

<p>The logstash chart allows environment variables to be added to the statefulset using an <code>extraEnv</code> value. The extraEnv allows values to come from secrets.</p>

<pre><code>  extraEnv:
    - name: RMQ_PASSWORD
      valueFrom:
        secretKeyRef:
          name: rabbitmq-ha
          key: rabbitmq-password
</code></pre>
