AndyYang
6c69de2df1
- Add crypto utility (internal/utils/crypto.go) with AES-256-GCM encrypt/decrypt using SYSTEM_AES_KEY env var, with "enc:v1:" prefix for versioned ciphertext - Encrypt tenant API key via GORM BeforeSave/AfterFind hooks and manual encryption in CreateTenant/UpdateAPIKey (db.Updates bypasses hooks) - Encrypt model API key in ModelParameters Value/Scan (driver.Valuer) - Widen api_key column from varchar(64) to varchar(256) across all DB dialects (MySQL, ParadeDB, SQLite) and add versioned migration 000018 - Propagate SYSTEM_AES_KEY through docker-compose, Helm secrets and values - Fix migration 000017 PL/pgSQL dollar-quoting syntax ($ -> $$)
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
{{/*
|
|
Copyright 2025 Tencent
|
|
SPDX-License-Identifier: MIT
|
|
|
|
Secrets for WeKnora components.
|
|
|
|
IMPORTANT: For production deployments, use one of these approaches:
|
|
1. Set values via --set flags during installation
|
|
2. Use External Secrets Operator with cloud secret managers
|
|
3. Use sealed-secrets for GitOps workflows
|
|
4. Provide an existing secret via secrets.existingSecret
|
|
*/}}
|
|
{{- if not .Values.secrets.existingSecret }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "weknora.secretName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "weknora.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
# Database credentials
|
|
DB_USER: {{ .Values.secrets.dbUser | quote }}
|
|
DB_PASSWORD: {{ required "secrets.dbPassword is required" .Values.secrets.dbPassword | quote }}
|
|
DB_NAME: {{ .Values.secrets.dbName | quote }}
|
|
# Redis credentials
|
|
REDIS_USERNAME: {{ .Values.secrets.redisUsername | default "" | quote }}
|
|
REDIS_PASSWORD: {{ required "secrets.redisPassword is required" .Values.secrets.redisPassword | quote }}
|
|
# Application secrets
|
|
JWT_SECRET: {{ required "secrets.jwtSecret is required" .Values.secrets.jwtSecret | quote }}
|
|
TENANT_AES_KEY: {{ .Values.secrets.tenantAesKey | default (randAlphaNum 32) | quote }}
|
|
SYSTEM_AES_KEY: {{ .Values.secrets.systemAesKey | default (randAlphaNum 32) | quote }}
|
|
{{- if .Values.neo4j.enabled }}
|
|
# Neo4j credentials (for GraphRAG)
|
|
NEO4J_USERNAME: {{ .Values.neo4j.username | quote }}
|
|
NEO4J_PASSWORD: {{ required "neo4j.password is required when neo4j is enabled" .Values.neo4j.password | quote }}
|
|
{{- end }}
|
|
{{- end }}
|