mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-03-19 05:37:51 +08:00
3280772934
## Summary - Fix duplicate YAML mapping keys in `helm/templates/env.yaml` that cause deployment failures with strict YAML parsers ## Problem The `range` loop in `env.yaml` iterates over all `.Values.env` keys and emits them into a Secret. The exclusion filter skips host/port/user keys, but does **not** skip password keys (`MYSQL_PASSWORD`, `REDIS_PASSWORD`, `MINIO_PASSWORD`, `ELASTIC_PASSWORD`, `OPENSEARCH_PASSWORD`). These same keys are then explicitly defined again later in the template, producing duplicate YAML mapping keys. Go's `yaml.v3` (used by Flux's helm-controller for post-rendering) rejects duplicate keys per the YAML spec: ``` Helm install failed: yaml: unmarshal errors: mapping key "MINIO_PASSWORD" already defined mapping key "MYSQL_PASSWORD" already defined mapping key "REDIS_PASSWORD" already defined ``` Plain `helm install` does not surface this because Helm's internal parser (`yaml.v2`) silently accepts duplicate keys (last value wins). ## Fix Add password keys to the exclusion filter on line 12 so they are only emitted by their explicit definitions later in the template. Note: `MINIO_ROOT_USER` is intentionally **not** excluded — it is only emitted by the range loop and has no explicit definition elsewhere. Excluding it causes MinIO to crash with `Missing credential environment variable, "MINIO_ROOT_USER"`. ## Test plan - [ ] Deploy with Flux helm-controller (uses yaml.v3) — no duplicate key errors - [ ] Verify all passwords are present in the rendered Secret - [ ] Verify `MINIO_ROOT_USER` is present in the rendered Secret - [ ] Test with `DOC_ENGINE=elasticsearch` (ELASTIC_PASSWORD) - [ ] Test with `DOC_ENGINE=opensearch` (OPENSEARCH_PASSWORD) Fixes #13135
72 lines
3.3 KiB
YAML
72 lines
3.3 KiB
YAML
{{- /*
|
|
TODO: Split env vars into separate secrets so that each pod
|
|
only gets passed the secrets it really needs.
|
|
*/}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "ragflow.fullname" . }}-env-config
|
|
type: Opaque
|
|
stringData:
|
|
{{- range $key, $val := .Values.env }}
|
|
{{- if and $val (ne $key "MYSQL_HOST") (ne $key "MYSQL_PORT") (ne $key "MYSQL_USER") (ne $key "MYSQL_PASSWORD") (ne $key "MINIO_HOST") (ne $key "MINIO_PORT") (ne $key "MINIO_PASSWORD") (ne $key "REDIS_HOST") (ne $key "REDIS_PORT") (ne $key "REDIS_PASSWORD") (ne $key "ELASTIC_PASSWORD") (ne $key "OPENSEARCH_PASSWORD") }}
|
|
{{ $key }}: {{ quote $val }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- /*
|
|
Use host names derived from internal cluster DNS
|
|
*/}}
|
|
{{- if .Values.redis.enabled }}
|
|
REDIS_HOST: {{ printf "%s-redis.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
REDIS_PORT: "6379"
|
|
{{- else }}
|
|
REDIS_HOST: {{ required "env.REDIS_HOST is required when redis.enabled=false" .Values.env.REDIS_HOST | quote }}
|
|
REDIS_PORT: {{ default "6379" .Values.env.REDIS_PORT | quote }}
|
|
{{- end }}
|
|
{{- if .Values.mysql.enabled }}
|
|
MYSQL_HOST: {{ printf "%s-mysql.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
MYSQL_PORT: "3306"
|
|
{{- else }}
|
|
MYSQL_HOST: {{ required "env.MYSQL_HOST is required when mysql.enabled=false" .Values.env.MYSQL_HOST | quote }}
|
|
MYSQL_PORT: {{ default "3306" .Values.env.MYSQL_PORT | quote }}
|
|
MYSQL_USER: {{ default "root" .Values.env.MYSQL_USER | quote }}
|
|
{{- end }}
|
|
{{- if .Values.minio.enabled }}
|
|
MINIO_HOST: {{ printf "%s-minio.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
MINIO_PORT: "9000"
|
|
{{- else }}
|
|
MINIO_HOST: {{ default "" .Values.env.MINIO_HOST | quote }}
|
|
MINIO_PORT: {{ default "9000" .Values.env.MINIO_PORT | quote }}
|
|
{{- end }}
|
|
{{- /*
|
|
Fail if passwords are not provided in release values
|
|
*/}}
|
|
REDIS_PASSWORD: {{ default "" .Values.env.REDIS_PASSWORD }}
|
|
{{- /*
|
|
NOTE: MySQL uses MYSQL_ROOT_PASSWORD env var but Ragflow container expects
|
|
MYSQL_PASSWORD so we need to define both as the same value here.
|
|
*/}}
|
|
{{- with .Values.env.MYSQL_PASSWORD | required "MYSQL_PASSWORD is required" }}
|
|
MYSQL_PASSWORD: {{ . }}
|
|
MYSQL_ROOT_PASSWORD: {{ . }}
|
|
{{- end }}
|
|
{{- $minioPass := default "" .Values.env.MINIO_PASSWORD }}
|
|
MINIO_PASSWORD: {{ $minioPass }}
|
|
MINIO_ROOT_PASSWORD: {{ $minioPass }}
|
|
{{- /*
|
|
Only provide env vars for enabled doc engine
|
|
*/}}
|
|
{{- if eq .Values.env.DOC_ENGINE "elasticsearch" }}
|
|
ES_HOST: {{ printf "%s-es.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
ELASTIC_PASSWORD: {{ .Values.env.ELASTIC_PASSWORD | required "ELASTIC_PASSWORD is required" }}
|
|
{{- else if eq .Values.env.DOC_ENGINE "infinity" }}
|
|
INFINITY_HOST: {{ printf "%s-infinity.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
{{- else if eq .Values.env.DOC_ENGINE "opensearch" }}
|
|
OS_HOST: {{ printf "%s-opensearch.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
|
|
OS_PORT: "9201"
|
|
OPENSEARCH_PASSWORD: {{ .Values.env.OPENSEARCH_PASSWORD | required "OPENSEARCH_PASSWORD is required" }}
|
|
OPENSEARCH_INITIAL_ADMIN_PASSWORD: {{ .Values.env.OPENSEARCH_PASSWORD | required "OPENSEARCH_PASSWORD is required" }}
|
|
{{- else }}
|
|
{{ fail "env.DOC_ENGINE must be either 'elasticsearch', 'opensearch' or 'infinity'" }}
|
|
{{- end }}
|