Skip to content

Fix: Updating GeoIP default image and secret handling #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alix-graylog merged 4 commits into from
Aug 5, 2026
Merged

Fix: Updating GeoIP default image and secret handling #168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3cfd79e
fix(geoip): Updating default geoip image tag, moving geoip secret to …
alix-graylog Aug 5, 2026
764c24c
Merge branch 'main' into geoip-fix
alix-graylog Aug 5, 2026
fa7244f
test: fixing broken geoip test
alix-graylog Aug 5, 2026
158ff68
Merge branch 'main' into geoip-fix
alix-graylog Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 45 additions & 14 deletions charts/graylog/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,6 +877,36 @@ Use the following paths when enabling the Geo-location processor in the Graylog
- Path to the city database: `/usr/share/graylog/data/geolocation/GeoLite2-City.mmdb`
- Path to the ASN database: `/usr/share/graylog/data/geolocation/GeoLite2-ASN.mmdb`

### MaxMind Credentials From An External Secret

Instead of passing the credentials to Helm, put them in a Secret of your own and point the
GeoIP update sidecar at it. The sidecar reads that Secret directly, so the credentials never
pass through the chart-managed Graylog Secret.

```sh
kubectl create secret generic graylog-geoip -n graylog \
--from-literal=GEO_IP_MAXMIND_ACCOUNT_ID="<YOUR-MAXMIND-ACCOUNT-ID-HERE>" \
--from-literal=GEO_IP_MAXMIND_LICENSE_KEY="<YOUR-MAXMIND-LICENSE-KEY-HERE>"

helm upgrade graylog graylog/graylog -n graylog --reuse-values \
--set graylog.config.geolocation.enabled=true \
--set graylog.config.geolocation.maxmindGeoIp.enabled=true \
--set graylog.config.geolocation.maxmindGeoIp.existingSecret=graylog-geoip
```

If your Secret uses different key names — say one generated by an `ExternalSecret` — override
`graylog.config.geolocation.maxmindGeoIp.accountIdKey` and `licenseKeyKey`. See
[examples/graylog-geoip-secret.yaml](../../examples/graylog-geoip-secret.yaml) for a complete
manifest.

> [!IMPORTANT]
> This is independent of `global.existingSecretName`. That Secret is **not** expected to carry
> `GEO_IP_MAXMIND_ACCOUNT_ID`/`GEO_IP_MAXMIND_LICENSE_KEY` — if you previously stored the MaxMind
> credentials there, keep them where they are and set
> `graylog.config.geolocation.maxmindGeoIp.existingSecret` to that same Secret name.
> Inline `accountId`/`licenseKey` values need chart-managed secrets and are rejected together with
> `global.existingSecretName`.

# Using External Resources

## Managing Secrets Externally
Expand Down Expand Up @@ -1139,20 +1169,21 @@ These values affect Graylog, DataNode, and MongoDB.
| `graylog.config.email.webInterfaceUrl` | Web interface URL for email links. | `"https://graylog.example.com"` |
| `graylog.config.plugins.enabled` | Enable Graylog plugin system. | `false` |
| `graylog.config.geolocation.enabled` | Enable the Geolocation Processor. | `false` |
| `graylog.config.geolocation.maxmindGeoIp.enabled` | Wire the MaxMind credentials below into the chart-managed Secret. | `true` |
| `graylog.config.geolocation.maxmindGeoIp.accountId` | MaxMind Account ID. | |
| `graylog.config.geolocation.maxmindGeoIp.licenseKey` | MaxMind License Key. | |
| `graylog.config.geolocation.maxmindGeoIp.editionIds` | Space-separated list of MaxMind database editions. | `"GeoLite2-City GeoLite2-ASN"` |
| `graylog.config.geolocation.sidecar.enabled` | Run the GeoIP update sidecar. This replaces the former CronJob. | `true` |
| `graylog.config.geolocation.sidecar.schedule` | Five-field cron-style update schedule. **Known defect: no schedule currently triggers an update.** The sidecar matches a field only when it is `*` or a number with no leading zero, so the default `0 0 * * *` never fires. Step syntax such as `*/6` never fires, and a padded field such as `09` stops the loop with `value too great for base`. Update the databases out of band until this is corrected. | `"0 0 * * *"` |
| `graylog.config.geolocation.sidecar.image.repository` | GeoIP update sidecar image repository. | `maxmindinc` |
| `graylog.config.geolocation.sidecar.image.name` | GeoIP update sidecar image name. | `geoipupdate` |
| `graylog.config.geolocation.sidecar.image.tag` | GeoIP update sidecar image tag. | `"7.1.1"` |
| `graylog.config.geolocation.sidecar.resources.requests.cpu` | GeoIP update sidecar CPU request. | `100m` |
| `graylog.config.geolocation.sidecar.resources.requests.memory` | GeoIP update sidecar memory request. | `128Mi` |
| `graylog.config.geolocation.sidecar.resources.limits.cpu` | GeoIP update sidecar CPU limit. | `500m` |
| `graylog.config.geolocation.sidecar.resources.limits.memory` | GeoIP update sidecar memory limit. | `256Mi` |
| `graylog.config.geolocation.sidecar.securityContext` | GeoIP update sidecar security context. The `geoipupdate` image needs root, so the default sets `runAsUser: 0` and `runAsNonRoot: false`, and drops all capabilities. | See `values.yaml` |
| `graylog.config.geolocation.maxmindGeoIp.enabled` | Wire MaxMind credentials into the chart-managed Secret. | `true` |
| `graylog.config.geolocation.maxmindGeoIp.existingSecret` | Secret with the MaxMind credentials, read by the sidecar. | `""` |
| `graylog.config.geolocation.maxmindGeoIp.accountIdKey` | Key in `existingSecret` holding the account ID. | `GEO_IP_MAXMIND_ACCOUNT_ID` |
| `graylog.config.geolocation.maxmindGeoIp.licenseKeyKey` | Key in `existingSecret` holding the license key. | `GEO_IP_MAXMIND_LICENSE_KEY` |
| `graylog.config.geolocation.maxmindGeoIp.accountId` | MaxMind Account ID (inline; wins over `existingSecret`). | |
| `graylog.config.geolocation.maxmindGeoIp.licenseKey` | MaxMind License Key (inline; wins over `existingSecret`). | |
| `graylog.config.geolocation.maxmindGeoIp.editionIds` | Space-separated MaxMind database editions to download. | `"GeoLite2-City GeoLite2-ASN"` |
| `graylog.config.geolocation.sidecar.enabled` | Enable the GeoIP update sidecar container. | `true` |
| `graylog.config.geolocation.sidecar.schedule` | Cron schedule for GeoIP database updates. | `"0 0 * * *"` |
| `graylog.config.geolocation.sidecar.image.repository` | Image repository for the GeoIP updater. | `"maxmindinc/geoipupdate"` |
| `graylog.config.geolocation.sidecar.image.tag` | Image tag for the GeoIP updater. | `"v7.1.1"` |
| `graylog.config.geolocation.sidecar.image.imagePullPolicy` | Pull policy for the GeoIP updater image. | `IfNotPresent` |
| `graylog.config.geolocation.sidecar.image.imagePullSecrets` | Pull secrets for the GeoIP updater image. | `[]` |
| `graylog.config.geolocation.sidecar.resources` | Resource requests/limits for the sidecar. | see `values.yaml` |
| `graylog.config.geolocation.sidecar.securityContext` | Container securityContext for the sidecar (runs as root). | see `values.yaml` |
| `graylog.config.geolocation.mmdbSources.city.url` | GeoLite2-City.mmdb URL (only for initial asset fetch). | |
| `graylog.config.geolocation.mmdbSources.city.checksum` | GeoLite2-City.mmdb checksum (only for initial asset fetch). | |
| `graylog.config.geolocation.mmdbSources.asn.url` | GeoLite2-ASN.mmdb URL (only for initial asset fetch). | |
Expand Down
3 changes: 3 additions & 0 deletions charts/graylog/templates/config/secret/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,9 @@ data:
{{- if .Values.graylog.config.tls.enabled }}
GRAYLOG_HTTP_TLS_KEY_PASSWORD: {{ .Values.graylog.config.tls.keyPassword | b64enc | quote }}
{{- end }}
{{/* Inline MaxMind credentials only. With maxmindGeoIp.existingSecret (and no
inline credentials) the sidecar reads that Secret directly and nothing is
stored here -- an external primary Secret is never expected to carry them. */}}
{{- if and .Values.graylog.config.geolocation.enabled .Values.graylog.config.geolocation.maxmindGeoIp.enabled .Values.graylog.config.geolocation.maxmindGeoIp.accountId .Values.graylog.config.geolocation.maxmindGeoIp.licenseKey }}
GEO_IP_MAXMIND_ACCOUNT_ID: {{ .Values.graylog.config.geolocation.maxmindGeoIp.accountId | b64enc | quote }}
GEO_IP_MAXMIND_LICENSE_KEY: {{ .Values.graylog.config.geolocation.maxmindGeoIp.licenseKey | b64enc | quote }}
Expand Down
32 changes: 23 additions & 9 deletions charts/graylog/templates/workload/containers/_geoip-sidecar.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,28 @@ Volume mounts assume the following volumes are defined in the pod:
*/}}
{{- define "graylog.geolocation.sidecar" }}
{{- if and .Values.graylog.config.geolocation.enabled .Values.graylog.config.geolocation.sidecar.enabled }}
{{- if not .Values.global.existingSecretName }}
{{- if or (empty .Values.graylog.config.geolocation.maxmindGeoIp.accountId) (empty .Values.graylog.config.geolocation.maxmindGeoIp.licenseKey) }}
{{- fail "GeoIP sidecar is enabled but MaxMind credentials are not provided. Set graylog.config.geolocation.maxmindGeoIp.accountId and licenseKey, or provide global.existingSecretName with GEO_IP_MAXMIND_ACCOUNT_ID and GEO_IP_MAXMIND_LICENSE_KEY keys." }}
{{- $maxmind := .Values.graylog.config.geolocation.maxmindGeoIp }}
{{/* Inline credentials only reach a Secret when maxmindGeoIp.enabled is true. */}}
{{- $inline := and $maxmind.enabled $maxmind.accountId $maxmind.licenseKey }}
{{- if and $inline .Values.global.existingSecretName }}
{{- fail "graylog.config.geolocation.maxmindGeoIp.accountId/licenseKey cannot be used with global.existingSecretName -- the chart manages no Secret to store them in. Put the MaxMind credentials in their own Secret and reference it with graylog.config.geolocation.maxmindGeoIp.existingSecret." }}
{{- end }}
{{- if not (or $inline $maxmind.existingSecret) }}
{{- fail "GeoIP sidecar is enabled but MaxMind credentials are not provided. Set graylog.config.geolocation.maxmindGeoIp.accountId and licenseKey, or point graylog.config.geolocation.maxmindGeoIp.existingSecret at a Secret holding them (see examples/graylog-geoip-secret.yaml)." }}
{{- end }}
{{/* Inline credentials live in the chart-managed Secret; otherwise read the external one. */}}
{{- $credsSecret := $maxmind.existingSecret }}
{{- $accountIdKey := $maxmind.accountIdKey | default "GEO_IP_MAXMIND_ACCOUNT_ID" }}
{{- $licenseKeyKey := $maxmind.licenseKeyKey | default "GEO_IP_MAXMIND_LICENSE_KEY" }}
{{- if $inline }}
{{- $credsSecret = include "graylog.secretsName" . }}
{{- $accountIdKey = "GEO_IP_MAXMIND_ACCOUNT_ID" }}
{{- $licenseKeyKey = "GEO_IP_MAXMIND_LICENSE_KEY" }}
{{- end }}
{{- $image := .Values.graylog.config.geolocation.sidecar.image }}
- name: geoip-updater
image: "{{ .Values.graylog.config.geolocation.sidecar.image.repository }}/{{ .Values.graylog.config.geolocation.sidecar.image.name }}:{{ .Values.graylog.config.geolocation.sidecar.image.tag }}"
imagePullPolicy: {{ .Values.graylog.image.imagePullPolicy }}
image: "{{ $image.repository }}{{ with $image.name }}/{{ . }}{{ end }}:{{ $image.tag }}"
imagePullPolicy: {{ $image.imagePullPolicy | default .Values.graylog.image.imagePullPolicy }}
{{- with .Values.graylog.config.geolocation.sidecar.securityContext }}
securityContext:
{{- toYaml . | nindent 4 }}
Expand All @@ -29,13 +43,13 @@ Volume mounts assume the following volumes are defined in the pod:
- name: GEOIPUPDATE_ACCOUNT_ID
valueFrom:
secretKeyRef:
name: {{ include "graylog.secretsName" . }}
key: GEO_IP_MAXMIND_ACCOUNT_ID
name: {{ $credsSecret }}
key: {{ $accountIdKey }}
- name: GEOIPUPDATE_LICENSE_KEY
valueFrom:
secretKeyRef:
name: {{ include "graylog.secretsName" . }}
key: GEO_IP_MAXMIND_LICENSE_KEY
name: {{ $credsSecret }}
key: {{ $licenseKeyKey }}
- name: GEOIPUPDATE_EDITION_IDS
value: "{{ .Values.graylog.config.geolocation.maxmindGeoIp.editionIds }}"
- name: GEOIPUPDATE_FREQUENCY
Expand Down
7 changes: 6 additions & 1 deletion charts/graylog/templates/workload/statefulsets/graylog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,12 @@ spec:
{{- if not (kindIs "invalid" .Values.graylog.terminationGracePeriodSeconds) }}
terminationGracePeriodSeconds: {{ .Values.graylog.terminationGracePeriodSeconds | int }}
{{- end }}
{{- with .Values.graylog.image.imagePullSecrets | default .Values.global.imagePullSecrets }}
{{- $pullSecrets := (.Values.graylog.image.imagePullSecrets | default .Values.global.imagePullSecrets) | default list }}
{{- $geolocation := .Values.graylog.config.geolocation }}
{{- if and $geolocation.enabled $geolocation.sidecar.enabled $geolocation.sidecar.image.imagePullSecrets }}
{{- $pullSecrets = concat $pullSecrets $geolocation.sidecar.image.imagePullSecrets | uniq }}
{{- end }}
{{- with $pullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
Expand Down
Loading
Loading