Reference sensitive data from secrets and config maps #1024

mkaesz-wandb · 2025-01-24T14:21:32Z

Description

Added secrets refs for MySQL, Bucket and License
Added config map refs for Custom CAs
Removed some typos

Ticket

Does this PR fix an existing issue? If yes, provide a link here.

… CAs

github-actions · 2025-01-24T14:21:59Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

+```
+
+**Important:**
+If using a ConfigMap, each key in the ConfigMap must end with `.crt` (e.g., `my-cert.crt` or `ca-cert1.crt`). This naming convention is required for `update-ca-certificates` to parse and add each certificate to the system CA store.


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Latin] Use 'for example' instead of 'e.g.'.

Please fix this and following instances of the same feedback. I took two years of Latin in high school, but most of our readers probably did not.

github-actions · 2025-01-24T14:21:59Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

+```
+
+**Important:**
+Each key in the ConfigMap must end with `.crt` (e.g., `my-cert.crt` or `ca-cert1.crt`). This naming convention is required for `update-ca-certificates` to parse and add each certificate to the system CA store.


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Latin] Use 'for example' instead of 'e.g.'.

cloudflare-workers-and-pages · 2025-01-24T14:25:42Z

Deploying docs with Cloudflare Pages

Latest commit:	`515e8c0`
Status:	✅ Deploy successful!
Preview URL:	https://cfbf0296.docodile.pages.dev
Branch Preview URL:	https://operator-secret-refs.docodile.pages.dev

View logs

flamarion

Not sure if the suggested names are the best ones, but I suggest we standardize the names and do not perfix with wandb

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

flamarion

LGTM 🚢

mdlinville · 2025-01-24T23:30:10Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

@@ -465,28 +465,67 @@ global:
    secretKey: HDKYe4Q...JAp1YyjysnX
 ```

+The `kmsKey` must be `null`.


I'm confused -- if it must be null, then why have the key at all? In the example for AWS above, the kmsKey is the empty string. Must it be empty for S3 and null for S3-compatible storage that is not on AWS?

mdlinville · 2025-01-24T23:33:05Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

@@ -709,10 +748,13 @@ global:
    oidc:
      clientId: ""
      secret: ""
+      # Only include if your IdP requires it.


Do we know of any major IdPs that do or don't require it? Okta? AAD? GCP?

mdlinville · 2025-01-24T23:33:55Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

      authMethod: ""
      issuer: ""
 ```

+`authMethod` is optional. 


The comment previously seems to imply that it is not optional, either your IdP requires it (it's not optional) or it doesn't (then does it even evaluate the field?)

mdlinville · 2025-01-24T23:35:00Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

+metadata:
+  name: custom-ca-certs
+data:
+  ca-cert1.crt: |


Do we have any best practices around compound certs? For example, they can become unwieldy and poor performing in a clustered environment with many nodes, if they share a compound certificate.

mdlinville · 2025-01-24T23:36:17Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

+    -----END CERTIFICATE-----
+```
+
+**Important:**


Also, this is no longer the righrt way to do an admonition . Instead, use the Hugo shortcode:

{{% alert %}} ... {{% /alert %}}

mdlinville · 2025-01-24T23:36:42Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

@@ -784,7 +852,7 @@ The only valid value for `runAsGroup:` is `0`. Any other value is an error.
 {{% /alert %}}


-To configure the application pod, add a section `app` to your configuration:
+Example: To configure the application pod, add a section `app` to your configuration:


Suggested change

Example: To configure the application pod, add a section `app` to your configuration:

For example, to configure the application pod, add a section `app` to your configuration:

mdlinville · 2025-01-24T23:36:53Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

@@ -807,7 +875,7 @@ app:
      readOnlyRootFilesystem: false
      allowPrivilegeEscalation: false 
 ```
-The same concept applies to `console`, `weave`, `otel`, `weave-trace`, `flat-run-fields-updater` and `parquet`.
+The same concept applies to `console`, `weave`, `weave-trace` and `parquet`.


Suggested change

The same concept applies to `console`, `weave`, `weave-trace` and `parquet`.

The same concept applies to `console`, `weave`, `weave-trace` and `parquet`.

mdlinville · 2025-01-24T23:37:33Z

content/guides/hosting/hosting-options/self-managed/kubernetes-operator/_index.md

+    -----END CERTIFICATE-----
+```
+
+**Important:**


As above, please also update this admonition.

added secrets refs for MySQL, Bucket and License, config maps for the…

4ea2e4c

… CAs

mkaesz-wandb requested a review from a team as a code owner January 24, 2025 14:21

mkaesz-wandb requested a review from flamarion January 24, 2025 14:21

github-actions bot reviewed Jan 24, 2025

View reviewed changes

flamarion requested changes Jan 24, 2025

View reviewed changes

incorporated Flamarion's feedback

515e8c0

flamarion approved these changes Jan 24, 2025

View reviewed changes

mdlinville self-requested a review January 24, 2025 23:27

mdlinville reviewed Jan 24, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reference sensitive data from secrets and config maps #1024

Reference sensitive data from secrets and config maps #1024

mkaesz-wandb commented Jan 24, 2025

github-actions bot Jan 24, 2025

mdlinville Jan 24, 2025 •

edited

Loading

github-actions bot Jan 24, 2025

cloudflare-workers-and-pages bot commented Jan 24, 2025 •

edited

Loading

flamarion left a comment

flamarion left a comment

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

mdlinville Jan 24, 2025

	Example: To configure the application pod, add a section `app` to your configuration:
	For example, to configure the application pod, add a section `app` to your configuration:

	The same concept applies to `console`, `weave`, `weave-trace` and `parquet`.

	The same concept applies to `console`, `weave`, `weave-trace` and `parquet`.

Reference sensitive data from secrets and config maps #1024

Are you sure you want to change the base?

Reference sensitive data from secrets and config maps #1024

Conversation

mkaesz-wandb commented Jan 24, 2025

Description

Ticket

github-actions bot Jan 24, 2025

Choose a reason for hiding this comment

mdlinville Jan 24, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot Jan 24, 2025

Choose a reason for hiding this comment

cloudflare-workers-and-pages bot commented Jan 24, 2025 • edited Loading

Deploying docs with Cloudflare Pages

flamarion left a comment

Choose a reason for hiding this comment

flamarion left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mdlinville Jan 24, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Jan 24, 2025 •

edited

Loading