Helm chart: add support for export.stdout.envFromSecrets to inject environment variables from Kubernetes secrets #4025

Bagautdino · 2025-08-20T14:06:59Z

This PR extends the Helm chart for Tetragon by adding support for envFromSecrets in the export.stdout template. This allows injecting environment variables from Kubernetes secrets using the envFrom field.

The implementation checks for the presence of .Values.export.stdout.envFromSecrets, and if present, renders the corresponding envFrom entries as secretRef definitions. This is useful when multiple environment variables need to be sourced from secrets without specifying each variable explicitly.

This change is backward-compatible and does not affect existing configurations that do not use envFromSecrets.

Bagautdino · 2025-08-21T08:38:14Z

@olsajiri

olsajiri · 2025-08-25T11:10:13Z

cc @mtardy @kkourt thanks

kkourt

Thanks!

Can you please provide an example of how this is meant to be used in the commit message? Please include both newly introduced configuration values (extraenvFrom and enfFromSecrets). Also, shouldn't we update values.yaml accordingly?

kkourt · 2025-08-25T11:39:22Z

install/kubernetes/tetragon/templates/_container_export_stdout.tpl

  image: "{{ if .Values.export.stdout.image.override }}{{ .Values.export.stdout.image.override }}{{ else }}{{ .Values.export.stdout.image.repository }}:{{ .Values.export.stdout.image.tag }}{{ end }}"
  imagePullPolicy: {{ .Values.imagePullPolicy }}
  terminationMessagePolicy: FallbackToLogsOnError
+


nit: empty newline

Also, this was not resolved.

This has been fixed in the latest commit. Please take a look.

032fc63

Please don't introduce changes that are negated at later commits. This makes history difficult to read.
Instead, please squash the changes from my feedback into the relevant original commits. (git rebase --interactive using the squash and fixup actions should help).

Sorry about the extra commits earlier - I wasn’t aware of the best practice here. I’ve now squashed everything into a single commit with an updated message and examples. Hopefully the history looks clean now. Please let me know if there are any other issues I should fix. Thanks again for your guidance! @kkourt

Bagautdino · 2025-08-25T19:51:32Z

Thanks @kkourt @mtardy @olsajiri !
I’ve addressed the feedback:

Amended the commit message to include concrete usage examples for both export.stdout.extraEnvFrom and export.stdout.envFromSecrets (see below).
Updated values.yaml with defaults and inline docs for both options.
Fixed nit.

Usage examples (also included in the commit message):

values.yaml

export:
  stdout:
    # Add specific env vars
    extraEnv:
      - name: LOG_LEVEL
        value: info

    # Pull multiple variables from ConfigMap/Secret via envFrom
    extraEnvFrom:
      - configMapRef:
          name: fluent-bit-config

    # Convenience for Secret envFrom; accepts strings or objects
    envFromSecrets:
      - opensearch-credentials              # simple form
      - name: optional-secret               # object form
        optional: true

Rendered container snippet

env:
  - name: LOG_LEVEL
    value: info
envFrom:
  - configMapRef:
      name: fluent-bit-config
  - secretRef:
      name: opensearch-credentials
  - secretRef:
      name: optional-secret
      optional: true

Motivation: I ran into this need while wiring Tetragon’s stdout exporter to ship logs to OpenSearch via Fluent Bit. I had to inject multiple credentials (e.g., OPENSEARCH_USERNAME / OPENSEARCH_PASSWORD) from a Kubernetes Secret without enumerating each key. Supporting envFrom and the envFromSecrets lets us mount the whole secret cleanly and keeps sensitive values out of plain values files.

kkourt · 2025-08-27T11:56:36Z

Amended the commit message to include concrete usage examples for both export.stdout.extraEnvFrom and export.stdout.envFromSecrets (see below).

As far as I can see, the commit messages are still empty.

netlify · 2025-08-27T14:39:10Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`d6927e4`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/68ed2103d2ff6700081c666b
😎 Deploy Preview	https://deploy-preview-4025--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Bagautdino · 2025-08-27T14:42:29Z

Amended the commit message to include concrete usage examples for both export.stdout.extraEnvFrom and export.stdout.envFromSecrets (see below).

As far as I can see, the commit messages are still empty.
👌👌👌👌👌

kkourt

Changes LGTM, thanks!

AFAICT, the CI faiure is because you need to include the doc changes in the commit. That is, run:

make -C install/kubernetes

And squash the relevant changes in your commit.

@mtardy can you also have a look?

kkourt

Changing this to Request changes, until the CI is fixed so that it's not merged by mistake.

Bagautdino · 2025-10-09T18:12:30Z

sorry guys! thanks i did it. i hope...

kkourt

LGTM, thanks!
@mtardy can you also take a look?

mtardy

lgtm overall, I haven't tested it manually though to make sure each of these work! Just a minor nit

install/kubernetes/tetragon/templates/_container_export_stdout.tpl

This commit extends the Helm chart for Tetragon by adding support for envFrom in the export.stdout template. Specifically: - export.stdout.extraEnvFrom: allows referencing ConfigMaps/Secrets via envFrom. - export.stdout.envFromSecrets: convenience for Secrets only, accepts strings or objects. Usage examples: values.yaml ----------- export: stdout: # Add specific env vars extraEnv: - name: LOG_LEVEL value: info # Pull multiple variables from ConfigMap/Secret via envFrom extraEnvFrom: - configMapRef: name: fluent-bit-config # Convenience for Secret envFrom envFromSecrets: - opensearch-credentials - name: optional-secret optional: true Rendered container ------------------ env: - name: LOG_LEVEL value: info envFrom: - configMapRef: name: fluent-bit-config - secretRef: name: opensearch-credentials - secretRef: name: optional-secret optional: true Signed-off-by: Bagautdino <[email protected]>

Bagautdino requested a review from a team as a code owner August 20, 2025 14:07

Bagautdino requested a review from olsajiri August 20, 2025 14:07

kkourt reviewed Aug 25, 2025

View reviewed changes

mtardy added the release-note/minor This PR introduces a minor user-visible change label Aug 25, 2025

Bagautdino force-pushed the main branch from 12e41d2 to 032fc63 Compare August 27, 2025 14:38

Bagautdino force-pushed the main branch from 032fc63 to a57e57d Compare August 28, 2025 20:30

Bagautdino requested a review from kkourt September 10, 2025 14:27

Bagautdino force-pushed the main branch 2 times, most recently from 6ec75ef to ce44d0b Compare September 22, 2025 15:59

kkourt approved these changes Oct 6, 2025

View reviewed changes

kkourt self-requested a review October 6, 2025 12:52

kkourt requested changes Oct 6, 2025

View reviewed changes

Bagautdino force-pushed the main branch from ce44d0b to e3f78dd Compare October 9, 2025 18:03

kkourt approved these changes Oct 13, 2025

View reviewed changes

kkourt requested review from mtardy and removed request for olsajiri October 13, 2025 07:10

mtardy approved these changes Oct 13, 2025

View reviewed changes

install/kubernetes/tetragon/templates/_container_export_stdout.tpl Outdated Show resolved Hide resolved

Bagautdino force-pushed the main branch from e3f78dd to d6927e4 Compare October 13, 2025 15:55

mtardy merged commit c654702 into cilium:main Oct 13, 2025
52 checks passed

Helm chart: add support for export.stdout.envFromSecrets to inject environment variables from Kubernetes secrets #4025

Helm chart: add support for export.stdout.envFromSecrets to inject environment variables from Kubernetes secrets #4025

Uh oh!

Conversation

Bagautdino commented Aug 20, 2025

Uh oh!

Bagautdino commented Aug 21, 2025

Uh oh!

olsajiri commented Aug 25, 2025

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

kkourt Aug 25, 2025

Choose a reason for hiding this comment

Uh oh!

kkourt Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

Bagautdino Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kkourt Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Bagautdino Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Bagautdino commented Aug 25, 2025

Uh oh!

kkourt commented Aug 27, 2025

Uh oh!

netlify bot commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

Bagautdino commented Aug 27, 2025

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Bagautdino commented Oct 9, 2025

Uh oh!

kkourt left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Bagautdino Aug 28, 2025 •

edited

Loading

netlify bot commented Aug 27, 2025 •

edited

Loading

kkourt left a comment •

edited

Loading