Can I provide my oidc client secret as a kubernetes secret instead of specifying its value in the

values.yaml

file?

Yes, you can provide your OIDC client secret as a Kubernetes Secret instead of specifying it directly in the

values.yaml

file. In the Flyte Helm chart, you can create a Kubernetes Secret containing your OIDC client secret and then reference it using the

configuration.auth.clientSecretsExternalSecretRef

field in your

values.yaml

. This approach keeps sensitive values out of your configuration files and leverages Kubernetes' secret management capabilities. For example:

configuration:
  auth:
    clientSecretsExternalSecretRef: flyte-binary-client-secrets-external-secret

You must first create the secret in your namespace, e.g.:

kubectl create secret -n flyte generic flyte-binary-client-secrets-external-secret --from-literal=oidc_client_secret=<OIDC_CLIENT_SECRET>

According to Add support for leveraging pre-created secrets in flyte-binary helm chart, this method is supported and recommended for managing sensitive configuration like OIDC client secrets. Would you like more detail on how to set this up? Sources: - Add support for leveraging pre-created secrets in flyte-binary helm chart 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 I use

flyte-core

helm chart, not

flyte-binary

For the

flyte-core

Helm chart, you can also provide your OIDC client secret as a Kubernetes Secret rather than specifying it in

values.yaml

. Set

secrets.adminOauthClientCredentials.enabled: true

and leave

clientSecret

as

null

or unset, then manually create the

flyte-secret-auth

secret in your namespace. The chart will mount this secret for use by Flyte components. This is documented in the chart and confirmed in Fix mounting secrets. Example in `values.yaml`:

secrets:
  adminOauthClientCredentials:
    enabled: true
    clientSecret: null
    clientId: "flytepropeller"

Then create the secret:

kubectl create secret generic flyte-secret-auth --from-literal=client_secret=<OIDC_CLIENT_SECRET> -n flyte

Would you like a step-by-step guide for this setup? Sources: - Fix mounting secrets - charts/flyte-core/templates/common/secret-auth.yaml - charts/flyte-core/values-keycloak-idp-flyteclients-without-browser.yaml 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.