Remove secrets from kubernetes

.github/workflows/deploy-to-k8s.yml

@@ -251,6 +251,10 @@ jobs:
             echo "NAMESPACE=production" >> $GITHUB_ENV
             echo "IMAGE_TAG=latest" >> $GITHUB_ENV
             echo "VALUES_FILE=./infrastructure/whiteboard-app/production.values.yaml" >> $GITHUB_ENV
+            KEYCLOAK_CLIENT_SECRET="${{ secrets.PRODUCTION_KEYCLOAK_CLIENT_SECRET }}"
+            NEXTAUTH_SECRET="${{ secrets.PRODUCTION_NEXTAUTH_SECRET }}"
+            POSTGRESQL_SECRET="${{ secrets.PRODUCTION_DB_PASSWORD }}"
+            KEYCLOAK_SECRET="${{ secrets.PRODUCTION_KEYCLOAK_SECRET }}"
           elif [[ "$BRANCH" == "develop" ]]; then
             CLIENT_URL=staging.whiteboard.student.k8s.aet.cit.tum.de
             SERVER_URL=staging.api.whiteboard.student.k8s.aet.cit.tum.de
@@ -260,6 +264,10 @@ jobs:
             echo "NAMESPACE=staging" >> $GITHUB_ENV
             echo "IMAGE_TAG=develop" >> $GITHUB_ENV
             echo "VALUES_FILE=./infrastructure/whiteboard-app/staging.values.yaml" >> $GITHUB_ENV
+            KEYCLOAK_CLIENT_SECRET="${{ secrets.STAGING_KEYCLOAK_CLIENT_SECRET }}"
+            NEXTAUTH_SECRET="${{ secrets.STAGING_NEXTAUTH_SECRET }}"
+            POSTGRESQL_SECRET="${{ secrets.STAGING_DB_PASSWORD }}"
+            KEYCLOAK_SECRET="${{ secrets.STAGING_KEYCLOAK_SECRET }}"
           else
             BRANCH_SAFE=${BRANCH//\//-}
             CLIENT_URL=$BRANCH_SAFE.whiteboard.student.k8s.aet.cit.tum.de
@@ -270,6 +278,10 @@ jobs:
             echo "NAMESPACE=$BRANCH_SAFE" >> $GITHUB_ENV
             echo "IMAGE_TAG=$BRANCH_SAFE" >> $GITHUB_ENV
             echo "VALUES_FILE=./infrastructure/whiteboard-app/pullrequest.values.yaml" >> $GITHUB_ENV
+            KEYCLOAK_CLIENT_SECRET="${{ secrets.PR_KEYCLOAK_CLIENT_SECRET }}"
+            NEXTAUTH_SECRET="${{ secrets.PR_NEXTAUTH_SECRET }}"
+            POSTGRESQL_SECRET="${{ secrets.PR_DB_PASSWORD }}"
+            KEYCLOAK_SECRET="${{ secrets.PR_KEYCLOAK_SECRET }}"
           fi
 
           echo "CLIENT_URL=$CLIENT_URL" >> $GITHUB_ENV
@@ -278,6 +290,10 @@ jobs:
           echo "GENAI_URL=$GENAI_URL" >> $GITHUB_ENV
           echo "OPEN_WEB_UI_API_KEY=${{ secrets.OPEN_WEB_UI_API_KEY }}" >> $GITHUB_ENV
           echo "REALTIME_URL=$REALTIME_URL" >> $GITHUB_ENV
+          echo "KEYCLOAK_CLIENT_SECRET=$KEYCLOAK_CLIENT_SECRET" >> $GITHUB_ENV
+          echo "NEXTAUTH_SECRET=$NEXTAUTH_SECRET" >> $GITHUB_ENV
+          echo "POSTGRESQL_SECRET=$POSTGRESQL_SECRET" >> $GITHUB_ENV
+          echo "KEYCLOAK_SECRET=$KEYCLOAK_SECRET" >> $GITHUB_ENV
 
           echo "CLIENT_URL=$CLIENT_URL" >> $GITHUB_OUTPUT
           echo "SERVER_URL=$SERVER_URL" >> $GITHUB_OUTPUT
@@ -329,7 +345,12 @@ jobs:
             --set auth.url="${{ env.AUTH_URL }}" \
             --set genai.url="${{ env.GENAI_URL }}" \
             --set genai.apiKey="${{ env.OPEN_WEB_UI_API_KEY }}" \
-            --set realtime.url="${{ env.REALTIME_URL }}"
+            --set realtime.url="${{ env.REALTIME_URL }}" \
+            --set keycloak.clientSecret="${{ env.KEYCLOAK_CLIENT_SECRET }}" \
+            --set nextauth.secret="${{ env.NEXTAUTH_SECRET }}" \
+            --set postgresql.auth.postgresPassword="${{ env.POSTGRESQL_SECRET }}" \
+            --set keycloak.externalDatabase.password="${{ env.POSTGRESQL_SECRET }}" \
+            --set keycloak.auth.adminPassword="${{ env.KEYCLOAK_SECRET }}" \
 
   comment-pr:
     needs: deploy

infrastructure/whiteboard-app/production.values.yaml

@@ -10,11 +10,11 @@ client:
   replicaCount: 1
   env:
     - name: KEYCLOAK_CLIENT_SECRET
-      value: SXiMvr1GG10bk2J63ODZC9SOaoAZ4dbe
+      value: '{{ .Values.keycloak.clientSecret }}'
     - name: NEXTAUTH_URL
       value: https://whiteboard.student.k8s.aet.cit.tum.de/api/auth/
     - name: NEXTAUTH_SECRET
-      value: feZJWB3mcQ93VBmqHKQI5er5NEIxcDPb3wtT/KaLB9s=
+      value: '{{ .Values.nextauth.secret }}'
     - name: KEYCLOAK_CLIENT_ID
       value: webclient
     - name: KEYCLOAK_ISSUER
@@ -41,7 +41,7 @@ server:
     - name: DB_USER
       value: postgres
     - name: DB_PASSWORD
-      value: postgres
+      value: '{{ .Values.postgresql.auth.postgresPassword }}'
     - name: ALLOWED_ORIGIN
       value: "https://whiteboard.student.k8s.aet.cit.tum.de"
     - name: IDP_INTERNAL_URI
@@ -69,12 +69,11 @@ realtime:
   replicaCount: 1
 
 postgresql:
+  auth:
+    username: postgres
+    postgresPassword: ""
   primary:
     extraEnvVars:
-      - name: POSTGRES_USER
-        value: postgres
-      - name: POSTGRES_PASSWORD
-        value: password
       - name: POSTGRES_MULTIPLE_DATABASES
         value: "main,keycloak"
     extraVolumes:
@@ -90,13 +89,13 @@ keycloak:
     enabled: false
   auth:
     adminUser: admin
-    adminPassword: password
+    adminPassword: ""
   postgresql:
     enabled: false
   externalDatabase:
     host: '{{ printf "%s-postgresql" .Release.Name }}'
     user: postgres
-    password: password
+    password: ""
     database: keycloak
     port: 5432
   extraEnvVars:

infrastructure/whiteboard-app/pullrequest.values.yaml

@@ -10,11 +10,11 @@ client:
   replicaCount: 1
   env:
     - name: KEYCLOAK_CLIENT_SECRET
-      value: SXiMvr1GG10bk2J63ODZC9SOaoAZ4dbe
+      value: '{{ .Values.keycloak.clientSecret }}'
     - name: NEXTAUTH_URL
       value: 'https://{{ .Values.client.url }}/api/auth/'
     - name: NEXTAUTH_SECRET
-      value: feZJWB3mcQ93VBmqHKQI5er5NEIxcDPb3wtT/KaLB9s=
+      value: '{{ .Values.nextauth.secret }}'
     - name: KEYCLOAK_CLIENT_ID
       value: webclient
     - name: KEYCLOAK_ISSUER
@@ -41,7 +41,7 @@ server:
     - name: DB_USER
       value: postgres
     - name: DB_PASSWORD
-      value: password
+      value: '{{ .Values.postgresql.auth.postgresPassword }}'
     - name: ALLOWED_ORIGIN
       value: 'https://{{ .Values.client.url }}'
     - name: IDP_INTERNAL_URI
@@ -69,12 +69,11 @@ realtime:
   replicaCount: 1
 
 postgresql:
+  auth:
+    username: postgres
+    postgresPassword: ""
   primary:
     extraEnvVars:
-      - name: POSTGRES_USER
-        value: postgres
-      - name: POSTGRES_PASSWORD
-        value: password
       - name: POSTGRES_MULTIPLE_DATABASES
         value: "main,keycloak"
     extraVolumes:
@@ -94,13 +93,13 @@ keycloak:
     enabled: false
   auth:
     adminUser: admin
-    adminPassword: password
+    adminPassword: ""
   postgresql:
     enabled: false
   externalDatabase:
     host: '{{ printf "%s-postgresql" .Release.Name }}'
     user: postgres
-    password: password
+    password: ""
     database: keycloak
     port: 5432
   extraEnvVars:

infrastructure/whiteboard-app/staging.values.yaml

@@ -10,11 +10,11 @@ client:
   replicaCount: 1
   env:
     - name: KEYCLOAK_CLIENT_SECRET
-      value: SXiMvr1GG10bk2J63ODZC9SOaoAZ4dbe
+      value: '{{ .Values.keycloak.clientSecret }}'
     - name: NEXTAUTH_URL
       value: https://staging.whiteboard.student.k8s.aet.cit.tum.de/api/auth/
     - name: NEXTAUTH_SECRET
-      value: feZJWB3mcQ93VBmqHKQI5er5NEIxcDPb3wtT/KaLB9s=
+      value: '{{ .Values.nextauth.secret }}'
     - name: KEYCLOAK_CLIENT_ID
       value: webclient
     - name: KEYCLOAK_ISSUER
@@ -41,7 +41,7 @@ server:
     - name: DB_USER
       value: postgres
     - name: DB_PASSWORD
-      value: password
+      value: '{{ .Values.postgresql.auth.postgresPassword }}'
     - name: ALLOWED_ORIGIN
       value: "https://staging.whiteboard.student.k8s.aet.cit.tum.de"
     - name: IDP_INTERNAL_URI
@@ -69,12 +69,11 @@ realtime:
   replicaCount: 1
 
 postgresql:
+  auth:
+    username: postgres
+    postgresPassword: ""
   primary:
     extraEnvVars:
-      - name: POSTGRES_USER
-        value: postgres
-      - name: POSTGRES_PASSWORD
-        value: password
       - name: POSTGRES_MULTIPLE_DATABASES
         value: "main,keycloak"
     extraVolumes:
@@ -90,13 +89,13 @@ keycloak:
     enabled: false
   auth:
     adminUser: admin
-    adminPassword: password
+    adminPassword: ""
   postgresql:
     enabled: false
   externalDatabase:
     host: '{{ printf "%s-postgresql" .Release.Name }}'
     user: postgres
-    password: password
+    password: ""
     database: keycloak
     port: 5432
   extraEnvVars: