Create Secrets

To run the Helm chart correctly, create a pair of secrets of different types.

Docker config

A secret of type kubernetes.io/dockerconfigjson is used to pull private Docker images.

  1. Get registry credentials (a token with pull rights).

  2. Create the secret in target namespace:

    kubectl create secret docker-registry regcred \
  --namespace <your-namespace> \
  --docker-server=<REGISTRY_URL> \
  --docker-username=<USERNAME> \
  --docker-password=<PASSWORD_OR_TOKEN> \
  --docker-email=<EMAIL>

You can set the secret name via imagePullSecret in values.yaml.

Behavior is controlled by:

Variable

Value

Description

secrets.create

Default: true

If true, Helm creates Secret automatically from values.yaml.

secrets.name

Default: <release-name>-app-secrets

Secret name used by services for sensitive variables. If secrets.create=false, create it in advance.

TLS certificates

Secrets of type kubernetes.io/tls are required for Ingress with TLS. For each host from values.yaml (ingress.host.GES_URL, ingress.host.PORTAL_URL, ingress.host.APP_URL), create a separate TLS secret.

  1. Prepare certificates (tls.key, tls.crt).

  2. Create secrets in target namespace (one per host):

    kubectl create secret tls <GES_SECRET> \
  --namespace <your-namespace> \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key
    kubectl create secret tls <PORTAL_SECRET> \
  --namespace <your-namespace> \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key
    kubectl create secret tls <APP_SECRET> \
  --namespace <your-namespace> \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key

    Where:

    • <GES_SECRET> — secret name, must match ingress.tls.GES_SECRET in values.yaml.

    • <PORTAL_SECRET> — secret name for ingress.tls.PORTAL_SECRET.

    • <APP_SECRET> — secret name for ingress.tls.APP_SECRET.

  3. Ensure the hosts in the certificates match the values in values.yaml:

    ingress:
  enabled: true
  tls:
    enabled: true
    GES_SECRET: ges-tls
    PORTAL_SECRET: portal-tls
    APP_SECRET: app-tls
  host:
    GES_URL: ges.example.com
    PORTAL_URL: portal.example.com
    APP_URL: app.example.com

Check

kubectl get secrets -n <your-namespace>

TLS secrets must be kubernetes.io/tls, docker secret must be kubernetes.io/dockerconfigjson.