From 18a5b55839fc6add07691cb77c6e4d7d95325444 Mon Sep 17 00:00:00 2001
From: David Fry <david@infitx.com>
Date: Thu, 1 May 2025 13:52:03 +0100
Subject: [PATCH] use env entries instead of envFrom (#36)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reason for this PR is that currently if the secret doesn’t have the
key NB_API_KEY yet at deployment time, the deployment will still run and
pull in an env list that doesn’t include NB_API_KEY since the envFrom
will just pull any and all keys it finds in the secret and makes env
vars out of them. then at a later point, once the NB_API_KEY key is
populated in the secret, one has to bounce the pod to get the key to be
picked up.

if you use the env: valueFrom syntax using a named key, if that named
key doesn’t exist, the deployment should give an error and retry until
the secret key is available
---
 .../templates/deployment.yaml                   | 17 ++++++++++-------
 helm/kubernetes-operator/values.yaml            |  5 +++--
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/helm/kubernetes-operator/templates/deployment.yaml b/helm/kubernetes-operator/templates/deployment.yaml
index 6394e74..539cf4d 100644
--- a/helm/kubernetes-operator/templates/deployment.yaml
+++ b/helm/kubernetes-operator/templates/deployment.yaml
@@ -78,13 +78,16 @@ spec:
             successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
             timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
           {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
-          envFrom:
-            - secretRef:
-                {{- if .Values.netbirdAPI.keyFromSecret }}
-                name: {{.Values.netbirdAPI.keyFromSecret}}
-                {{- else }}
-                name: {{ include "kubernetes-operator.fullname" . }}
-                {{- end }}
+          env:
+            - name: NB_API_KEY
+                valueFrom:
+                  {{- if .Values.netbirdAPI.keyFromSecret }}
+                  name: {{.Values.netbirdAPI.keyFromSecretName}}
+                  key: {{.Values.netbirdAPI.keyFromSecretKey}}
+                  {{- else }}
+                  name: {{ include "kubernetes-operator.fullname" . }}
+                  key: NB_API_KEY
+                  {{- end }}
           {{- end }}
           readinessProbe:
             failureThreshold: 3
diff --git a/helm/kubernetes-operator/values.yaml b/helm/kubernetes-operator/values.yaml
index 0386268..5c24cc9 100644
--- a/helm/kubernetes-operator/values.yaml
+++ b/helm/kubernetes-operator/values.yaml
@@ -70,7 +70,7 @@ operator:
     name: ""
 
   # This is for setting Kubernetes Annotations to a Pod.
-  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ 
+  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
   podAnnotations: {}
   # This is for setting Kubernetes Labels to a Pod.
   # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
@@ -190,4 +190,5 @@ cluster:
 netbirdAPI: {}
   # NetBird Service Account Token
   # key: "nbp_m0LM9ZZvDUzFO0pY50iChDOTxJgKFM3DIqmZ"
-  # keyFromSecret: "Secret name with NB_API_KEY=Service Account Token"
\ No newline at end of file
+  # keyFromSecretName: "Secret name"
+  # keyFromSecretKey: "NB_API_KEY"
\ No newline at end of file