31 lines
1.7 KiB
YAML
31 lines
1.7 KiB
YAML
{{- if .Values.secret.create }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "medical-chatbot.secretName" . }}
|
|
labels:
|
|
{{- include "medical-chatbot.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
postgres-password: {{ .Values.secret.postgresPassword | quote }}
|
|
postgres-dsn: {{ printf "postgresql://duoc_thu:%s@%s:5432/duoc_thu" .Values.secret.postgresPassword (default (printf "%s-postgres" (include "medical-chatbot.fullname" .)) .Values.secret.postgresHost) | quote }}
|
|
grafana-admin-password: {{ .Values.secret.grafanaAdminPassword | quote }}
|
|
{{- if and .Values.aws.staticCredentials.enabled .Values.aws.staticCredentials.accessKeyId }}
|
|
aws-access-key-id: {{ .Values.aws.staticCredentials.accessKeyId | quote }}
|
|
aws-secret-access-key: {{ .Values.aws.staticCredentials.secretAccessKey | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secret.langfusePublicKey }}
|
|
{{/* Both keys or neither: a public key without its secret authenticates
|
|
nothing, and ai-service already treats a partial config as "not
|
|
configured" (see rag/telemetry.py's _langfuse_exporters). */}}
|
|
langfuse-public-key: {{ .Values.secret.langfusePublicKey | quote }}
|
|
langfuse-secret-key: {{ required "secret.langfuseSecretKey is required when secret.langfusePublicKey is set" .Values.secret.langfuseSecretKey | quote }}
|
|
{{- end }}
|
|
{{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
|
|
{{/* Required (not defaulted) once either service is turned on — same
|
|
fail-closed posture as the image-tag guard above: a guessable or empty
|
|
secret here would let anyone forge an admin JWT. */}}
|
|
jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
|
|
{{- end }}
|
|
{{- end }}
|