How do I use secretName with storage configuration?

To use

secretName

with Flyte's storage configuration, create a Kubernetes Secret containing your storage credentials (e.g., S3 access and secret keys), then set the

storage.secretName

field in your Helm values file to reference this secret. This ensures sensitive values are not exposed in plain text in configuration files. The referenced secret will be mounted into the Flyte pods and used for storage authentication, as shown in the Flyte Helm values and deployment templates. For example, after creating your secret with

kubectl create secret generic my-storage-secret ...

, set

storage.secretName: my-storage-secret

in your values file. This approach is recommended for secure storage credential management (issue discussion, pull request). Would you like more detail or a step-by-step example? Sources: - Flyte Helm values.yaml (storage.secretName) - Flyte admin deployment.yaml (secretName usage) - Flyte issue #6394 - Flyte pull request #3807 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

give a more detailed step-by-step example

Certainly! Here’s a step-by-step example for using

secretName

with Flyte’s storage configuration: 1. Create a Kubernetes Secret with your storage credentials. Suppose you are using S3-compatible storage and need to provide

access_key

and `secret_key`:

kubectl create secret generic my-storage-secret \
  --from-literal=access_key=<YOUR_ACCESS_KEY> \
  --from-literal=secret_key=<YOUR_SECRET_KEY> \
  -n flyte

Replace

<YOUR_ACCESS_KEY>

and

<YOUR_SECRET_KEY>

with your actual credentials. The namespace (

-n flyte

) should match the namespace where Flyte is deployed. 2. Reference the secret in your Flyte Helm values file. In your

values.yaml

(or via Helm CLI), set the

storage.secretName

field:

storage:
  provider: s3
  secretName: my-storage-secret
  providerConfig:
    s3:
      endpoint: <S3_ENDPOINT>
      region: <S3_REGION>
      authType: accesskey

Replace

<S3_ENDPOINT>

and

<S3_REGION>

as appropriate. 3. Deploy or upgrade Flyte with the updated values. If you’re installing or upgrading Flyte, use:

helm upgrade --install flyte-core flyteorg/flyte-core -n flyte -f values.yaml

4. How it works: The Flyte deployment template will mount the referenced secret into the Flyte pods. The storage configuration will read the credentials from the secret, not from plain text in the config. 5. Verification: Check that the secret is mounted in the pod:

kubectl describe pod <flyte-pod-name> -n flyte

Look for a volume mount referencing

my-storage-secret

. This approach ensures your storage credentials are securely managed and not exposed in configuration files. Sources: - Flyte issue #6394 - Flyte pull request #3807 - Flyte deployment template 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 the values.yaml you provided are not for flyte-core. give me an example for flyte-cire

It seems likely that you meant "flyte-core" (not "flyte-cire"). For Flyte-core, the official Helm chart does not have a direct

storage.secretName

field, but you can securely provide storage credentials using Kubernetes Secrets and reference them in your configuration. The recommended approach is to create a Kubernetes Secret and then use the

inlineSecretRef

field in your

values.yaml

to merge the secret into Flyte's configuration, as described in Flyte PR #3807 and issue #6394. Example: 1. Create the secret:

kubectl create secret generic flyte-core-storage-secret \
  --from-literal=access_key_id=<YOUR_ACCESS_KEY> \
  --from-literal=secret_key=<YOUR_SECRET_KEY> \
  -n flyte

2. Create a YAML file for the secret config:

apiVersion: v1
kind: Secret
metadata:
  name: flyte-core-inline-config-secret
  namespace: flyte
type: Opaque
stringData:
  203-storage-secrets.yaml: |
    storage:
      stow:
        config:
          access_key_id: <YOUR_ACCESS_KEY>
          secret_key: <YOUR_SECRET_KEY>

Apply it with

kubectl apply -f <filename>.yaml

. 3. Reference the secret in your `values.yaml`:

configuration:
  inlineSecretRef: flyte-core-inline-config-secret
  storage:
    provider: s3
    providerConfig:
      s3:
        endpoint: <S3_ENDPOINT>
        region: <S3_REGION>
        authType: accesskey

This will merge your secret into the Flyte-core configuration at runtime, keeping credentials out of plain text config files. Sources: - Flyte PR #3807 - issue #6394 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 this configuration you are giving is for the

flyte-binary

helm chart. I want the

flyte-core

helm chart values

You are correct: the

inlineSecretRef

and direct secret merging approach is specific to the

flyte-binary

chart, not

flyte-core

. For the

flyte-core

Helm chart, you must create a Kubernetes Secret with your storage credentials and then reference those credentials in your storage configuration by mounting the secret into the appropriate Flyte component pods (such as FlyteAdmin, FlytePropeller, etc.) using the

extraEnvVarsSecret

or by customizing the deployment templates. There is no top-level

storage.secretName

or

inlineSecretRef

field in the

flyte-core

chart. Instead, you should: 1. Create a Kubernetes Secret:

kubectl create secret generic storage-secrets \
     --from-literal=access_key=<YOUR_ACCESS_KEY> \
     --from-literal=secret_key=<YOUR_SECRET_KEY> \
     -n flyte

2. Reference the secret in your values file using `extraEnvVarsSecret`: For example, in `values-eks.yaml`:

flyteadmin:
     extraEnvVarsSecret: storage-secrets
   flytepropeller:
     extraEnvVarsSecret: storage-secrets
   datacatalog:
     extraEnvVarsSecret: storage-secrets

3. Configure your storage provider in the same values file:

storage:
     provider: s3
     providerConfig:
       s3:
         endpoint: <S3_ENDPOINT>
         region: <S3_REGION>
         authType: accesskey

4. Update your Flyte deployment:

helm upgrade --install flyte flyteorg/flyte-core -n flyte -f values-eks.yaml

This method ensures your storage credentials are securely injected as environment variables into the Flyte components, and the storage configuration will pick them up at runtime. There is no direct

secretName

field for storage in the

flyte-core

chart as of now (issue #6394, issue #3769). Would you like a more detailed YAML example or further clarification? Sources: - Flyte issue #6394 - issue #3769 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 That is not true. The values.yaml file has a

storage.secretName

field

You are correct: the

flyte-core

Helm chart’s

values.yaml

does include a

storage.secretName

field. This field allows you to specify the name of a Kubernetes Secret containing your storage credentials, which will be mounted into the relevant Flyte pods (see values.yaml reference). Example usage: 1. Create the secret:

kubectl create secret generic my-storage-secret \
     --from-literal=access_key=<YOUR_ACCESS_KEY> \
     --from-literal=secret_key=<YOUR_SECRET_KEY> \
     -n flyte

2. Configure your `values.yaml`:

storage:
     bucketName: my-s3-bucket
     type: s3
     secretName: my-storage-secret
     s3:
       authType: accesskey
       endpoint: <S3_ENDPOINT>
       region: <S3_REGION>

3. Deploy or upgrade Flyte:

helm upgrade --install flyte-core flyteorg/flyte-core -n flyte -f values.yaml

This will mount the secret into the Flyte pods, and the storage configuration will use the credentials from the secret (see README.md reference). Sources: - see values.yaml reference 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.