feat(chart): use infisical (#1276)

chart/env/prod.yaml

@@ -347,20 +347,9 @@ envVars:
   WEBSEARCH_BLOCKLIST: '["youtube.com", "twitter.com"]'
   XFF_DEPTH: '2'
 
-externalSecrets:
+infisical:
   enabled: true
-  secretStoreName: "chat-ui-prod-secretstore"
-  secretName: "chat-ui-prod-secrets"
-  parameters:
-    MONGODB_URL: "hub-prod-chat-ui-mongodb-url"
-    OPENID_CONFIG: "hub-prod-chat-ui-openid-config"
-    SERPER_API_KEY: "hub-prod-chat-ui-serper-api-key"
-    HF_TOKEN: "hub-prod-chat-ui-hf-token"
-    WEBHOOK_URL_REPORT_ASSISTANT: "hub-prod-chat-ui-webhook-report-assistant"
-    ADMIN_API_SECRET: "hub-prod-chat-ui-admin-api-secret"
-    USAGE_LIMITS: "hub-prod-chat-ui-usage-limits"
-    MESSAGES_BEFORE_LOGIN: "hub-prod-chat-ui-messages-before-login"
-    IP_TOKEN_SECRET: "hub-prod-chat-ui-ip-token-secret"
+  env: "prod-us-east-1"
 
 autoscaling:
   enabled: true

chart/templates/deployment.yaml

@@ -61,9 +61,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: {{ include "name" . }}
-          {{- if $.Values.externalSecrets.enabled }}
+          {{- if $.Values.infisical.enabled }}
             - secretRef:
-                name: {{ $.Values.externalSecrets.secretName }}
+                name: {{ include "name" $ }}-infisical-secret
           {{- end }}
           {{- with $.Values.extraEnvFrom }}
             {{- toYaml . | nindent 14 }}

chart/templates/infisical.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.infisical.enabled }}
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: {{ include "name" $ }}-infisical-secret
+  namespace: {{ $.Release.Namespace }}
+spec:
+  authentication:
+    universalAuth:
+      credentialsRef:
+        secretName: {{ .Values.infisical.operatorSecretName | quote }}
+        secretNamespace: {{ .Values.infisical.operatorSecretNamespace | quote }}
+      secretsScope:
+        envSlug: {{ .Values.infisical.env | quote }}
+        projectSlug: {{ .Values.infisical.project | quote }}
+        secretsPath: /
+  hostAPI: {{ .Values.infisical.url | quote }}
+  managedSecretReference:
+    creationPolicy: Owner
+    secretName: {{ include "name" $ }}-secs
+    secretNamespace: {{ .Release.Namespace | quote }}
+    secretType: Opaque
+  resyncInterval: {{ .Values.infisical.resyncInterval }}
+{{- end }}

chart/templates/secrets.yaml

@@ -1,21 +0,0 @@
-{{- if .Values.externalSecrets.enabled }}
-apiVersion: "external-secrets.io/v1beta1"
-kind: ExternalSecret
-metadata:
-  labels: {{ include "labels.standard" . | nindent 4 }}
-  name: {{ include "name" $ }}-external-secret
-  namespace: {{ $.Release.Namespace }}
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: {{ .Values.externalSecrets.secretStoreName }}
-    kind: SecretStore
-  target:
-    name: {{ .Values.externalSecrets.secretName }}
-  data:
-    {{- range $key, $value := .Values.externalSecrets.parameters }}
-    - secretKey: {{ $key | quote }}
-      remoteRef:
-        key: {{ $value | quote }}
-    {{- end }}
-{{- end }}

chart/values.yaml

@@ -38,12 +38,17 @@ nodeSelector: {}
 tolerations: []
 
 envVars: { }
-externalSecrets:
+
+infisical:
   enabled: false
-  secretStoreName: ""
-  secretName: ""
-  parameters: { }
-# Allow to environment injections on top or instead of externalSecrets
+  env: ""
+  project: "huggingchat-v2-a1"
+  url: ""
+  resyncInterval: 60
+  operatorSecretName: "huggingchat-operator-secrets"
+  operatorSecretNamespace: "hub-utils"
+
+# Allow to environment injections on top or instead of infisical
 extraEnvFrom: []
 extraEnv: []
 

docs/source/installation/helm.md

@@ -29,7 +29,7 @@ resources:
 
 envVars:
   MONGODB_URL: mongodb://chat-ui-mongo:27017
-  # Ensure that your values.yaml will not leak anywhere or use externalSecrets instead
+  # Ensure that your values.yaml will not leak anywhere
   # PRs welcome for a chart rework with envFrom support!
   HF_TOKEN: secret_token
 ```