From a2fe61b1f665c2baac4a37ac87106130b1b10dbf Mon Sep 17 00:00:00 2001 From: keyhan Date: Fri, 3 Jul 2026 19:24:34 +0330 Subject: [PATCH] fix(platform): inject ELASTIC_PASSWORD from platform secrets in production Backend validate-production-config requires a non-default ELASTIC_PASSWORD; read it from abrban-platform-secrets.elastic-password like other credentials. Co-authored-by: Cursor --- .../cloudhost-platform/templates/backend-deployment.yaml | 5 +++++ backend/helm/cloudhost-platform/values.yaml | 2 +- gitops/sealed-secrets/abrban-platform-secrets.example.yaml | 4 +++- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/backend/helm/cloudhost-platform/templates/backend-deployment.yaml b/backend/helm/cloudhost-platform/templates/backend-deployment.yaml index 7186cb1..ceec103 100644 --- a/backend/helm/cloudhost-platform/templates/backend-deployment.yaml +++ b/backend/helm/cloudhost-platform/templates/backend-deployment.yaml @@ -98,6 +98,11 @@ spec: secretKeyRef: name: {{ include "cloudhost-platform.secretName" . }} key: cluster-kubeconfig-key + - name: ELASTIC_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "cloudhost-platform.secretName" . }} + key: elastic-password - name: FRONTEND_URL value: {{ include "cloudhost-platform.corsOrigins" . | quote }} {{- include "cloudhost-platform.buildEnv" . | nindent 12 }} diff --git a/backend/helm/cloudhost-platform/values.yaml b/backend/helm/cloudhost-platform/values.yaml index 5358d57..3ad869b 100644 --- a/backend/helm/cloudhost-platform/values.yaml +++ b/backend/helm/cloudhost-platform/values.yaml @@ -124,7 +124,7 @@ secrets: # Use a pre-created Secret instead of chart-managed one. Required for GitOps # (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on # every sync). Secret must contain keys: postgres-password, jwt-secret, - # jwt-refresh-secret, cluster-kubeconfig-key. + # jwt-refresh-secret, cluster-kubeconfig-key, redis-password, elastic-password. existingSecret: "" jwtSecret: "" jwtRefreshSecret: "" diff --git a/gitops/sealed-secrets/abrban-platform-secrets.example.yaml b/gitops/sealed-secrets/abrban-platform-secrets.example.yaml index 34db3ff..0c1c69a 100644 --- a/gitops/sealed-secrets/abrban-platform-secrets.example.yaml +++ b/gitops/sealed-secrets/abrban-platform-secrets.example.yaml @@ -3,7 +3,8 @@ # Real SealedSecret lives in cloud-host-gitops/sealed-secrets/ — never commit plaintext passwords. # # Required keys (must match backend Deployment + validate-production-config): -# postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key, redis-password +# postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key, +# redis-password, elastic-password (must match elasticsearch-credentials in logging) # # Generate (replace CHANGE_ME_* with strong random values): # @@ -13,6 +14,7 @@ # --from-literal=jwt-refresh-secret='CHANGE_ME_REFRESH_32CHARS_MIN' \ # --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \ # --from-literal=redis-password='CHANGE_ME_REDIS' \ +# --from-literal=elastic-password='CHANGE_ME_ELASTIC' \ # --dry-run=client -o json \ # | kubeseal \ # --controller-name=sealed-secrets-controller \