Feature: Allow getting secret data from existing Kubernetes Secrets

README.md

@@ -10,7 +10,7 @@ This Helm chart deploys a LibreTranslate instance on a Kubernetes cluster using
 ## Setup helm chart repository
 
 ```bash
-helm repo add libretranslate https://libretranslate.github.io/helm-chart/
+helm repo add libretranslate https://small-hack.github.io/libretranslate-elm-chart/
 helm repo update
 helm search repo libretranslate
 ```

charts/libretranslate/Chart.yaml

@@ -6,4 +6,4 @@ sources:
   - https://github.com/LibreTranslate/LibreTranslate/
   - https://github.com/LibreTranslate/helm-chart/
 icon: https://libretranslate.com/static/favicon.ico
-version: 0.1.2
+version: 0.2.0

charts/libretranslate/templates/configmap.yaml

@@ -30,8 +30,12 @@ data:
   debug: {{ .Values.appSettings.debug | squote }}
   ssl: {{ .Values.appSettings.ssl | squote }}
   apiKeys: {{ .Values.appSettings.apiKeys | squote }}
+  {{- if and (not .Values.appSettings.existingSecret) (not .Values.appSettings.secretKeys.origin) }}
   requireApiKeyOrigin: {{ .Values.appSettings.requireApiKeyOrigin | squote }}
+  {{- end }}
+  {{- if and (not .Values.appSettings.existingSecret) (not .Values.appSettings.secretKeys.secret) }}
   requireApiKeySecret: {{ .Values.appSettings.requireApiKeySecret | squote }}
+  {{- end }}
   suggestions: {{ .Values.appSettings.suggestions | squote }}
   disableFilesTranslation: {{ .Values.appSettings.disableFilesTranslation | squote }}
   disableWebUi: {{ .Values.appSettings.disableWebUi | squote }}

charts/libretranslate/templates/secret-api-key.yaml

@@ -0,0 +1,9 @@
+{{- if and .Values.appSettings.requireApiKeySecret (not .Values.appSettings.existingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "libretranslate.fullname" . }}-api-key
+type: Opaque
+data:
+  requireApiKeySecret: {{ .Values.appSettings.requireApiKeySecret | quote }}
+{{- end }}

charts/libretranslate/templates/secret.yaml → charts/libretranslate/templates/secret-auth.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.adminUser.existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -7,3 +8,4 @@ data:
   auth: {{ .Values.adminUser.auth | quote }}
   username: {{ .Values.adminUser.name | quote }}
   password: {{ .Values.adminUser.password | quote }}
+{{- end }}

charts/libretranslate/templates/statefulset.yaml

@@ -20,7 +20,12 @@ spec:
         {{- toYaml .Values.podAnnotations | nindent 8 }}
         {{- end }}
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- if and .Values.appSettings.requireApiKeySecret (not .Values.appSettings.existingSecret) }}
+        checksum/secret-api-key: {{ include (print $.Template.BasePath "/secret-api-key.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and .Values.adminUser.auth (not .Values.adminUser.existingSecret) }}
+        checksum/secret-auth: {{ include (print $.Template.BasePath "/secret-auth.yaml") . | sha256sum }}
+        {{- end }}
       labels:
         {{- include "libretranslate.selectorLabels" . | nindent 8 }}
     spec:
@@ -106,19 +111,30 @@ spec:
                   name: libretranslate-appsettings
                   key: apiKeys
             {{- end }}
-            {{- if and (.Values.appSettings.requireApiKeyOrigin) (ne .Values.appSettings.requireApiKeyOrigin "") }}
+            {{- if or .Values.appSettings.requireApiKeyOrigin (and .Values.appSettings.existingSecret .Values.appSettings.secretKeys.apiKeyorigin) }}
             - name: LT_REQUIRE_API_KEY_ORIGIN
               valueFrom:
+                {{- if not .Values.appSettings.existingSecret }}
                 configMapKeyRef:
                   name: libretranslate-appsettings
                   key: requireApiKeyOrigin
+                {{- else }}
+                secretKeyRef:
+                  name: {{ .Values.appSettings.existingSecret }}
+                  key: {{ .Values.appSettings.secretKeys.apiKeyorigin }}
+                {{- end }}
             {{- end }}
-            {{- if and (.Values.appSettings.requireApiKeySecret) (ne .Values.appSettings.requireApiKeySecret "") }}
+            {{- if or .Values.appSettings.requireApiKeySecret (and .Values.appSettings.existingSecret .Values.appSettings.secretKeys.apiKeysecret) }}
             - name: LT_REQUIRE_API_KEY_SECRET
               valueFrom:
-                configMapKeyRef:
-                  name: libretranslate-appsettings
+                secretKeyRef:
+                {{- if not .Values.appSettings.existingSecret }}
+                  name: {{ include "libretranslate.fullname" . }}-api-key
                   key: requireApiKeySecret
+                {{- else }}
+                  name: {{ .Values.appSettings.existingSecret }}
+                  key: {{ .Values.appSettings.secretKeys.apiKeysecret }}
+                {{- end }}
             {{- end }}
             {{- if and (.Values.appSettings.suggestions) (ne .Values.appSettings.suggestions "") }}
             - name: LT_SUGGESTIONS
@@ -341,4 +357,4 @@ spec:
       storageClassName: {{ .Values.persistence.db.storageClass | quote }}
       {{- end }}
   {{- end }}
-  {{- end }}
+  {{- end }}

charts/libretranslate/values.yaml

@@ -127,6 +127,12 @@ adminUser:
   name: "YWRtaW4K"  # copy the username in base64 as a reference
   auth: "YWRtaW46JGFwcjEkYlpydmYvUFYkSHBHSlhqZU1EN0ZON2kyYndsMVRNMQoK"  # copy the output from the htpasswd command here as a reference
   password: "bXlTZWNyZXRQYXNzd29yZAo="  # copy the password as base64 for the admin user here as a reference
+  existingSecret: "" # use an existing secret for admin user
+  # key in existing secret
+  secretKeys:
+    name: "name"
+    auth: "auth"
+    password: "password"
 
 # Settings / Flags
 appSettings:
@@ -140,6 +146,12 @@ appSettings:
   disableWebUi:          "false"    # Disable web ui (Default: Web Ui enabled)
   updateModels:          "false"    # Update language models at startup (Default: Only on if no models found)
   metrics:               "false"    # Enable the /metrics endpoint for exporting Prometheus usage metrics (Default: Disabled)
+  existingSecret: "" # use an existing secret for api key origin and secret
+  # keys in existing secret
+  secretKeys:
+    apiKeyorigin: ""
+    apiKeysecret: "secret"
+
 
 # Configuration Parameters
 appConfig: