feat: Add optional DB secret volume mount in Helm Chart#260
feat: Add optional DB secret volume mount in Helm Chart#260lachen-nv merged 3 commits intoNVIDIA:mainfrom
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
📝 WalkthroughWalkthroughThe PR updates Helm charts for the carbide-rest application to support database credentials via Kubernetes secrets. Changes include a chart version bump, conditional configuration handling in ConfigMap templates, volume mount additions in deployment manifests, new helper templates for credential secret management, and values.yaml additions to expose the Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment Tip CodeRabbit can use TruffleHog to scan for secrets in your code with verification capabilities.Add a TruffleHog config file (e.g. trufflehog-config.yml, trufflehog.yml) to your project to customize detectors and scanning behavior. The tool runs only when a config file is present. |
|
/ok to test 6e2bef5 |
🔐 TruffleHog Secret Scan✅ No secrets or credentials found! Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉 🕐 Last updated: 2026-03-16 12:59:41 UTC | Commit: 6e2bef5 |
🛡️ Vulnerability Scan🚨 Found 64 vulnerability(ies) Severity Breakdown:
🔗 View full details in Security tab 🕐 Last updated: 2026-03-16 12:59:53 UTC | Commit: 6e2bef5 |
lachen-nv
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
helm/charts/carbide-rest/charts/carbide-rest-api/templates/deployment.yaml (1)
91-96: Harden DB secret volume file permissions.Consider setting
defaultMode: 0400on the secret volume at Line 91–96 to reduce in-container secret readability scope.Proposed hardening patch
- name: db-creds secret: secretName: {{ .Values.secrets.dbCreds }} + defaultMode: 0400 items: - key: password path: password🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@helm/charts/carbide-rest/charts/carbide-rest-api/templates/deployment.yaml` around lines 91 - 96, The secret volume mount defined under the secret block that uses .Values.secrets.dbCreds (the secretName with items key: password path: password) should set defaultMode: 0400 to restrict in-container file permissions; update the secret section in the deployment template to add defaultMode: 0400 (octal) alongside secretName and items so the rendered secret file is readable only by the container owner.helm/charts/carbide-rest/charts/carbide-rest-api/templates/configmap.yaml (1)
11-18: Consider extracting shared DB config-morph logic into a helper template.Line 11–18 is correct, but this logic now exists in both API and workflow configmaps; centralizing it would reduce drift risk on future changes.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@helm/charts/carbide-rest/charts/carbide-rest-api/templates/configmap.yaml` around lines 11 - 18, Duplicate DB config-morph logic (the deepCopy into $config, setting $config.db "passwordPath" and unsetting $config.db "password" using set/unset) appears in multiple configmap templates; extract this into a reusable helper template (e.g., define a named template like "carbide.dbConfig" in templates/_helpers.tpl) that accepts the chart context (or .Values.config and .Values.secrets.dbCreds) and returns the transformed config YAML, then replace the duplicated block in both carbide-rest-api and workflow configmap templates with an include call to that helper (ensuring you preserve the conditional on .Values.secrets.dbCreds and the use of toYaml | nindent 4 when rendering).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@helm/charts/carbide-rest/charts/carbide-rest-api/templates/configmap.yaml`:
- Around line 11-18: Duplicate DB config-morph logic (the deepCopy into $config,
setting $config.db "passwordPath" and unsetting $config.db "password" using
set/unset) appears in multiple configmap templates; extract this into a reusable
helper template (e.g., define a named template like "carbide.dbConfig" in
templates/_helpers.tpl) that accepts the chart context (or .Values.config and
.Values.secrets.dbCreds) and returns the transformed config YAML, then replace
the duplicated block in both carbide-rest-api and workflow configmap templates
with an include call to that helper (ensuring you preserve the conditional on
.Values.secrets.dbCreds and the use of toYaml | nindent 4 when rendering).
In `@helm/charts/carbide-rest/charts/carbide-rest-api/templates/deployment.yaml`:
- Around line 91-96: The secret volume mount defined under the secret block that
uses .Values.secrets.dbCreds (the secretName with items key: password path:
password) should set defaultMode: 0400 to restrict in-container file
permissions; update the secret section in the deployment template to add
defaultMode: 0400 (octal) alongside secretName and items so the rendered secret
file is readable only by the container owner.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: d681675b-7a35-4d82-8a12-7e09e9cea446
📒 Files selected for processing (9)
helm/charts/carbide-rest/Chart.yamlhelm/charts/carbide-rest/charts/carbide-rest-api/templates/configmap.yamlhelm/charts/carbide-rest/charts/carbide-rest-api/templates/deployment.yamlhelm/charts/carbide-rest/charts/carbide-rest-api/values.yamlhelm/charts/carbide-rest/charts/carbide-rest-workflow/templates/_helpers.tplhelm/charts/carbide-rest/charts/carbide-rest-workflow/templates/configmap.yamlhelm/charts/carbide-rest/charts/carbide-rest-workflow/templates/deployment-cloud-worker.yamlhelm/charts/carbide-rest/charts/carbide-rest-workflow/templates/deployment-site-worker.yamlhelm/charts/carbide-rest/charts/carbide-rest-workflow/values.yaml
thossain-nv
changed the title
| name: forge | ||
| user: forge | ||
| # -- Plain-text password. Ignored when secrets.dbCreds is set. | ||
| password: forge |
There was a problem hiding this comment.
We should probably remove this altogether?
There was a problem hiding this comment.
thanks @thossain-nv , I will check the scope for this change and send another PR.
helm/charts/carbide-rest/charts/carbide-rest-api/templates/configmap.yaml
Outdated
Show resolved
Hide resolved
lachen-nv
changed the title
2 participants
Description
Add secret-based DB password support to carbide-rest chart
Type of Change
Services Affected
Related Issues (Optional)
Breaking Changes
Testing
Additional Notes