Can't mix `yamlApplicationConfig` with `existingSecret`

[nnellanspdl]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here (legacy) and here
• I've tried installing latest charts and the issue still persists there
• I'm running a supported version of the application & chart which is listed here

Describe the bug (actual behavior)

I'm running the latest chart.

I'd like to keep all of my non-sensitive config in a values.yaml file and pass this to the Helm chart when installing. Inside my values.yaml I use the yamlApplicationConfig section for this to specify all my standard configuration: clusters, roles, auth, etc.

But for the sensitive values I don't want to put them in plain-text in my values.yaml file. So, I tried specifying existingSecret to point at a Kubernetes secret that contains sensitive values defined in environment variable form. For example: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG.

However, this is not working. When I specify both yamlApplicationConfig and existingSecret then I think only the second one is actually being applied, and not both like I was hoping.

Is there a way for me to do this?

Expected behavior

No response

Your installation details

Latest helm chart as of today.

Steps to reproduce

Deploy Helm chart using a values.yaml file that has both yamlApplicationConfig and existingSecret defined.

Screenshots

No response

Logs

No response

Additional context

No response

[Aaron-ML]

Also having this issue as well. Kind of painful for using secrets at the moment.

[BertelBB]

Hi, and FYI @Aaron-ML, there is a workaround that you can do. Kafka UI is a Java application and they support reading environment variables in the config files using the syntax ${ENV_NAME}. You can achieve using sensitive values in yamlApplicationConfig like so:

# values.yaml
env:
- name: KAFKA_USERNAME
  valueFrom:
    secretKeyRef:
      name: kafka-ui-sasl-auth
      key: username
- name: KAFKA_PASSWORD
  valueFrom:
    secretKeyRef:
      name: kafka-ui-sasl-auth
      key: password

yamlApplicationConfig:
  kafka:
    clusters:
    - bootstrapServers: kafka-controller-0.kafka-controller-headless:9092
      name: kafka
      properties:
        sasl.mechanism: PLAIN
        security.protocol: SASL_PLAINTEXT
        sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="${KAFKA_USERNAME}" password="${KAFKA_PASSWORD}";
      readOnly: false