graylog-helm/examples/values-existing-secret-external-mongodb.yaml at 13b9bdfc048b63a5b135c07a9d2aede4b58bb00d · Graylog2/graylog-helm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# GitOps Pattern: External Secret + External MongoDB
#
# This example demonstrates the correct configuration for users who want to:
# - Use GitOps (Argo CD / Flux) with externally-managed secrets
# - Connect to an external/self-managed MongoDB instance
# - Avoid Helm-managed secret generation and rotation
#
# Why this pattern?
# - Global secrets are managed outside Helm (e.g., via sealed-secrets, external-secrets operator)
# - MongoDB is managed separately (cloud provider, self-managed cluster, etc.)
# - Helm only orchestrates the Graylog and Data Node workloads
#
# Prerequisites:
# 1. A secret named "graylog-managed-secret" (or your chosen name) must exist
#    with the following required keys:
#    - GRAYLOG_PASSWORD_SECRET: Base64-encoded pepper string (≥64 chars)
#    - GRAYLOG_ROOT_PASSWORD_SHA2: SHA256 hash of root password
#    - GRAYLOG_MONGODB_URI: Base64-encoded MongoDB connection string
#    - GRAYLOG_ROOT_USERNAME: (optional) defaults to "admin" if not provided
#
# 2. MongoDB must be running and accessible at the configured connection URI
#
# Example secret creation:
# kubectl create secret generic graylog-managed-secret \
#   --from-literal=GRAYLOG_PASSWORD_SECRET="$(openssl rand -base64 64)" \
#   --from-literal=GRAYLOG_ROOT_PASSWORD_SHA2="$(echo -n mypassword | sha256sum | cut -d' ' -f1)" \
#   --from-literal=GRAYLOG_MONGODB_URI="$(echo -n 'mongodb://graylo[EMAIL_ADDRESS_REDACTED]om:27017/graylog' | base64)" \
#   --from-literal=GRAYLOG_ROOT_USERNAME="admin"
#

global:
  # Point to the externally-managed secret containing all credentials
  # This secret must exist in the same namespace before installation
  existingSecretName: graylog-managed-secret

# Disable chart-managed MongoDB
# When using external MongoDB, set this to false
mongodb:
  communityResource:
    enabled: false

# Configure Graylog to use external MongoDB
graylog:
  # The MongoDB connection URI is read from the external secret's GRAYLOG_MONGODB_URI key
  # You can also override it here if needed (optional):
  # config:
  #   mongodb:
  #     customUri: "mongodb://graylo[EMAIL_ADDRESS_REDACTED]om:27017/graylog"

  # Example: Configure replicas for Graylog
  replicas: 3

  # Example: Configure resources
  resources:
    requests:
      memory: "2Gi"
      cpu: "500m"
    limits:
      memory: "3Gi"
      cpu: "1000m"

# Data Node configuration (also uses the external secret)
datanode:
  # Example: Configure replicas for Data Node
  replicas: 3

  # Example: Configure resources for Data Node
  resources:
    requests:
      memory: "2Gi"
      cpu: "500m"
    limits:
      memory: "4Gi"
      cpu: "1000m"

# Disable MongoDB-specific tests (not applicable when MongoDB is external)
graylog:
  enabled: true

# Example: Configure ingress for external access
ingress:
  enabled: true
  ingressClassName: "nginx"
  web:
    enabled: true
    hosts:
      - host: "graylog.example.com"
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: graylog-tls
        hosts:
          - "graylog.example.com"