feat: envFromSecrets array

bsgrigorov · bsgrigorov · commit 9c5c260f3e7d · 2026-02-16T14:06:17.000-08:00
diff --git a/charts/app-full/Chart.lock b/charts/app-full/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
   version: 1.0.0
 - name: app-starter
   repository: file://../app-starter
-  version: 1.3.0
+  version: 1.4.0
 - name: app-extensions
   repository: file://../app-extensions
   version: 1.2.1
 - name: platform-extensions
   repository: file://../platform-extensions
   version: 1.5.0
-digest: sha256:2b4a45f45f03766e4910a758ddfdb6f6dc9f738fec7681de4579fa57d7403d8b
-generated: "2026-02-06T22:31:29.709009-08:00"
+digest: sha256:c58ac50ea4a7687d87c5a283a36f2f2ebcd0f19661462e80a8b073cac21c4ff6
+generated: "2026-02-16T13:46:06.538848-08:00"
diff --git a/charts/app-full/Chart.yaml b/charts/app-full/Chart.yaml
@@ -33,7 +33,7 @@ dependencies:
 
   # Core workload chart - always enabled
   - name: app-starter
-    version: "1.3.0"
+    version: "1.4.0"
     repository: "file://../app-starter"
     condition: app-starter.enabled
 
diff --git a/charts/app-full/test-values/02-app-with-secrets.yaml b/charts/app-full/test-values/02-app-with-secrets.yaml
@@ -20,7 +20,7 @@ app-starter:
       ENVIRONMENT: production
 
     # Reference secrets created by app-extensions
-    envFromSecretName: api-secrets
+    envFromSecrets: [api-secrets]
 
     resources:
       requests:
diff --git a/charts/app-full/test-values/05-full-featured.yaml b/charts/app-full/test-values/05-full-featured.yaml
@@ -45,7 +45,7 @@ app-starter:
           fieldRef:
             fieldPath: metadata.namespace
 
-    envFromSecretName: enterprise-app-secrets
+    envFromSecrets: [enterprise-app-secrets]
 
     resources:
       requests:
diff --git a/charts/app-full/values.yaml b/charts/app-full/values.yaml
@@ -66,6 +66,9 @@ app-starter:
     #         key: host
 
     # Environment variables from ConfigMaps/Secrets (entire contents)
+    # envFrom: []  # raw list (configMapRef/secretRef)
+    # envFromSecrets: []   # secret names (same namespace); e.g. [app-secrets]
+    # envFromConfigmaps: [] # configmap names; e.g. [app-config]
     # envFrom:
     #   - configMapRef:
     #       name: app-config
diff --git a/charts/app-starter/Chart.yaml b/charts/app-starter/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: app-starter
 description: A streamlined, extensible Helm chart for deploying applications on Kubernetes
 type: application
-version: 1.3.0
+version: 1.4.0
 appVersion: "1.0.0"
 kubeVersion: ">=1.22.0-0"
 home: https://github.com/synkube/
diff --git a/charts/app-starter/README.md b/charts/app-starter/README.md
@@ -79,7 +79,7 @@ container:
   envMap:
     LOG_LEVEL: info
     ENVIRONMENT: production
-  envFromSecretName: api-secrets
+  envFromSecrets: [api-secrets]
   resources:
     requests:
       cpu: 200m
@@ -146,7 +146,7 @@ container:
     PORT: "8080"
 
   # Load all keys from ConfigMap/Secret
-  envFromSecretName: my-secret
+  envFromSecrets: [my-secret]
   envFromConfigmaps: [shared-config]
 ```
 
diff --git a/charts/app-starter/docs/CONFIGURATION.md b/charts/app-starter/docs/CONFIGURATION.md
@@ -173,7 +173,7 @@ container:
 
   # Load all keys from ConfigMap/Secret as env vars
   envFrom: []
-  envFromSecretName: ""
+  envFromSecrets: []
   envFromConfigmaps: []
 
   # Probes
@@ -228,7 +228,8 @@ container:
     - app-config
 
   # Load all keys from Secret as env vars
-  envFromSecretName: my-secret
+  envFromSecrets:
+    - my-secret
 ```
 
 **Merge Order**: `env` → `envMap` → `extraEnv` (last wins for duplicates)
diff --git a/charts/app-starter/templates/deployment.yaml b/charts/app-starter/templates/deployment.yaml
@@ -84,16 +84,18 @@ spec:
           env:
             {{- include "app-starter.mergedEnv" . | nindent 12 }}
           {{- end }}
-          {{- if or .Values.container.envFrom .Values.container.envFromSecretName .Values.container.envFromConfigmaps }}
+          {{- if or .Values.container.envFrom .Values.container.envFromSecrets .Values.container.envFromConfigmaps }}
           envFrom:
             {{- with .Values.container.envFrom }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
-            {{- if .Values.container.envFromSecretName  }}
+            {{- if .Values.container.envFromSecrets }}
+            {{- range .Values.container.envFromSecrets }}
             - secretRef:
-                name: {{ .Values.container.envFromSecretName }}
+                name: {{ . | quote }}
+            {{- end }}
             {{- end }}
-            {{- if .Values.container.envFromConfigmaps  }}
+            {{- if .Values.container.envFromConfigmaps }}
             {{- range .Values.container.envFromConfigmaps }}
             - configMapRef:
                 name: {{ . | quote }}
diff --git a/charts/app-starter/templates/statefullset.yaml b/charts/app-starter/templates/statefullset.yaml
@@ -87,16 +87,18 @@ spec:
           env:
             {{- include "app-starter.mergedEnv" . | nindent 12 }}
           {{- end }}
-          {{- if or .Values.container.envFrom .Values.container.envFromSecretName .Values.container.envFromConfigmaps }}
+          {{- if or .Values.container.envFrom .Values.container.envFromSecrets .Values.container.envFromConfigmaps }}
           envFrom:
             {{- with .Values.container.envFrom }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
-            {{- if .Values.container.envFromSecretName  }}
+            {{- if .Values.container.envFromSecrets }}
+            {{- range .Values.container.envFromSecrets }}
             - secretRef:
-                name: {{ .Values.container.envFromSecretName }}
+                name: {{ . | quote }}
+            {{- end }}
             {{- end }}
-            {{- if .Values.container.envFromConfigmaps  }}
+            {{- if .Values.container.envFromConfigmaps }}
             {{- range .Values.container.envFromConfigmaps }}
             - configMapRef:
                 name: {{ . | quote }}
diff --git a/charts/app-starter/test-values/10-env-merging.yaml b/charts/app-starter/test-values/10-env-merging.yaml
@@ -75,7 +75,7 @@ secrets:
   DB_PASSWORD: "secret-db-password"
 
 # Load all keys from a secret as env vars
-envFromSecretName: app-secrets
+envFromSecrets: [app-secrets]
 
 # Load from multiple ConfigMaps
 envFromConfigmaps:
diff --git a/charts/app-starter/test-values/13-secret-and-config-mounts.yaml b/charts/app-starter/test-values/13-secret-and-config-mounts.yaml
@@ -84,7 +84,7 @@ secretMounts:
     fileName: tls.key
 
 # Also load API_KEY as env var
-envFromSecretName: test-app-starter
+envFromSecrets: [test-app-starter]
 
 service:
   type: ClusterIP
diff --git a/charts/app-starter/test-values/README.md b/charts/app-starter/test-values/README.md
@@ -108,7 +108,7 @@ The test script automatically discovers all `.yaml` and `.yml` files in this dir
 - container.envMap (map format)
 - container.extraEnv (override format)
 - Env var precedence and merging
-- envFromSecretName and envFromConfigmaps
+- envFromSecrets and envFromConfigmaps
 - Secrets as environment variables
 
 ### 11-deployment-with-pvc.yaml
@@ -140,7 +140,7 @@ The test script automatically discovers all `.yaml` and `.yml` files in this dir
 - configMaps file mounting (multiple files)
 - Custom volumes (emptyDir with size limits)
 - container.volumes and volumeMounts
-- envFromSecretName for env vars
+- envFromSecrets for env vars
 - Multiple mount paths
 
 ### 14-statefulset-advanced.yaml
diff --git a/charts/app-starter/values.yaml b/charts/app-starter/values.yaml
@@ -124,9 +124,13 @@ container:
   #   - secretRef:
   #       name: my-secret
 
-  # -- Use envFromSecretName to load all Secret data as env vars
-  envFromSecretName: ""
-  # envFromSecretName: my-secret
+  # -- Load env vars from Secrets (all keys from each secret).
+  # Secrets must exist in the same namespace as the workload (K8s does not support cross-namespace secretRef).
+  # For secrets in other namespaces, sync them into the app namespace (e.g. ExternalSecret, reflector).
+  envFromSecrets: []
+  # envFromSecrets:
+  #   - my-secret
+  #   - api-secrets
 
   # -- Load env vars from ConfigMaps
   envFromConfigmaps: []
