How to avoid passing sensitive data through values.yml (bitnami chart)

Question

I am trying to deploy a rabbitmq-cluster on minikube based on the chart of Bitnami and facing the following challenge: When I try to pass the credentials using a secret I am getting this error: couldn't find key rabbitmq-password in Secret default/rabbit

I created a secret called rabbit in my minikube cluster and tryed to set the values-file like this:

auth:
  # username: user
  # password: pass
  existingPasswordSecret: rabbit

and also like this:

 auth:
      username: ${RABBITMQ_USERNAME}
      password: ${RABBITMQ_PASSWORD}
      existingPasswordSecret: rabbit

This is my secret-file:

apiVersion: v1
kind: Secret
metadata:
  name: rabbit
type: Opaque
data:
  RABBITMQ_USERNAME: dXNlcg== (bitnami variable)
  RABBITMQ_PASSWORD: cGFzcw== (bitnami variable)

This is the default secret of the chart (I am installing the chart using helm install rabbitmq -f rabbitmq/values.yml bitnami/rabbitmq):

apiVersion: v1
kind: Secret
metadata:
  name: {{ include "rabbitmq.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels: {{- include "common.labels.standard" . | nindent 4 }}
type: Opaque
data:
  {{- if not .Values.auth.existingPasswordSecret }}
  {{- if .Values.auth.password }}
  rabbitmq-password: {{ .Values.auth.password | b64enc | quote }}
  {{- else }}
  rabbitmq-password: {{ randAlphaNum 10 | b64enc | quote }}
  {{- end }}
  {{- end }}

From the message you got and also the default secret structure, you can see that you need a rabbitmq-password key in the secret, while your secret is using RABBITMQ_PASSWORD for the key instead. Regarding the user, you can't provide it in the secret as the chart does not support it. — Ale
Thanks, man. That was really the problem. I am completely new to all this so sometimes, even if the answer is obvious, I don't see it. Post this as an answer if you want and I will upvote it. — marcelo

Ale Ale · Accepted Answer · 2020-12-16T08:24:26

The error message is telling you that you are missing the rabbitmq-password key in your secret:

couldn't find key rabbitmq-password in Secret default/rabbit

If we take a look at your secret, we can see you are providing two keys (RABBITMQ_USERNAME and RABBITMQ_PASSWORD), but not the rabbitmq-password key it expects:

apiVersion: v1
kind: Secret
metadata:
  name: rabbit
type: Opaque
data:
  RABBITMQ_USERNAME: dXNlcg== (bitnami variable)
  RABBITMQ_PASSWORD: cGFzcw== (bitnami variable)

Knowing this, you have to provide your password using rabbitmq-password instead of RABBITMQ_PASSWORD. The chart does not provide support for passing the user as a secret, tho. Your secret should look like this:

apiVersion: v1
kind: Secret
metadata:
  name: rabbit
type: Opaque
data:
  rabbitmq-password: cGFzcw== (bitnami variable)

How to avoid passing sensitive data through values.yml (bitnami chart)

1 Answers