Move appkey to secret

Move appkey to proper secret. Also support an existingSecret to allow managing the appkey outside on values.yaml.

.github/workflows/release.yml

@@ -7,6 +7,8 @@ jobs:
     if: github.ref == 'refs/heads/main'
     permissions:
       contents: write
+      packages: write
+
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -31,4 +33,22 @@ jobs:
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@v1.7.0
         env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      # see https://github.com/helm/chart-releaser/issues/183
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push charts to GHCR
+        run: |
+          shopt -s nullglob
+          for pkg in .cr-release-packages/*; do
+            if [ -z "${pkg:-}" ]; then
+              break
+            fi
+            helm push "${pkg}" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts"
+          done

charts/librenms/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: redis
   repository: https://charts.bitnami.com/bitnami
-  version: 20.11.2
+  version: 20.12.0
 - name: mysql
   repository: https://charts.bitnami.com/bitnami
-  version: 11.1.20
-digest: sha256:98e21356d5f7a0ae37cc2bcd0fe3b55ad80bb892e0ecee13551164ed5580f527
-generated: "2025-03-10T08:50:31.291990148Z"
+  version: 12.3.3
+digest: sha256:63e74f030c93f076a31e686b9efa0e1b126a3ea80445eaef8f95806c6e629913
+generated: "2025-04-15T12:49:29.451154869Z"

charts/librenms/Chart.yaml

@@ -2,17 +2,17 @@ apiVersion: v2
 name: librenms
 description: LibreNMS is an autodiscovering PHP/MySQL-based network monitoring system.
 type: application
-version: 3.19.0
-appVersion: "25.2.0"
+version: 4.0.3
+appVersion: "25.4.0"
 maintainers:
-  - name: jochbru
-    url: https://github.com/jochbru
+  - name: jacobw
+    url: https://github.com/jacobw
 dependencies:
   - name: redis
-    version: "~20.11.0"
+    version: "~20.12.0"
     repository: "https://charts.bitnami.com/bitnami"
     condition: redis.enabled
   - name: mysql
-    version: "~11.1.0"
+    version: "~12.3.0"
     repository: "https://charts.bitnami.com/bitnami"
     condition: mysql.enabled

charts/librenms/files/env

@@ -1 +0,0 @@
-APP_KEY={{.Values.librenms.appkey}}

charts/librenms/files/init.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 TARGET="/data/env-volume/env"
 echo "Target: $TARGET"
-cp /data/files/env $TARGET
-echo -e "\nNODE_ID=`hostname`" >> $TARGET
+echo "APP_KEY=$(cat /data/key/appkey)" > $TARGET
+echo "NODE_ID=$(hostname)" >> $TARGET
 
 cat $TARGET

charts/librenms/templates/_helpers.tpl

@@ -64,3 +64,14 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Create the name of the secret to use
+*/}}
+{{- define "librenms.secretName" -}}
+{{- if .Values.librenms.existingSecret -}}
+{{- .Values.librenms.existingSecret -}}
+{{- else -}}
+{{- .Release.Name -}}
+{{- end -}}
+{{- end -}}

charts/librenms/templates/librenms-configmap.yml

@@ -23,7 +23,5 @@ metadata:
 data:
   custom.php: |-
 {{ tpl (.Files.Get "files/custom.php") . | indent 4 }}
-  env: |-
-{{ tpl (.Files.Get "files/env") . | indent 4 }}
   init.sh: |-
-{{ tpl (.Files.Get "files/init.sh") . | indent 4 }}
+{{ .Files.Get "files/init.sh" | indent 4 }}

charts/librenms/templates/librenms-deployment.yml

@@ -19,6 +19,9 @@ spec:
       volumes:
       - name: env-volume
         emptyDir: {}
+      - name: key
+        secret:
+          secretName: {{ include "librenms.secretName" . }}
       - name: files
         configMap:
           name: {{ .Release.Name }}-files
@@ -33,6 +36,8 @@ spec:
           volumeMounts:
           - name: env-volume
             mountPath: /data/env-volume
+          - name: key
+            mountPath: /data/key
           - name: files
             mountPath: /data/files
       containers:

charts/librenms/templates/librenms-poller-ss.yml

@@ -20,6 +20,9 @@ spec:
       volumes:
       - name: env-volume
         emptyDir: {}
+      - name: key
+        secret:
+          secretName: {{ include "librenms.secretName" . }}
       - name: files
         configMap:
           name: {{ .Release.Name }}-files
@@ -33,6 +36,8 @@ spec:
           volumeMounts:
           - name: env-volume
             mountPath: /data/env-volume
+          - name: key
+            mountPath: /data/key
           - name: files
             mountPath: /data/files
       containers:

charts/librenms/templates/librenms-secret.yml

@@ -0,0 +1,10 @@
+{{- if not .Values.librenms.existingSecret }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}
+type: Opaque
+data:
+  appkey: {{ .Values.librenms.appkey | b64enc | quote }}
+{{- end }}

charts/librenms/values.yaml

@@ -6,12 +6,16 @@ librenms:
     # -- repository is the image repository to pull from.
     repository: librenms/librenms
     # -- tag is image tag to pull.
-    tag: 25.2.0
+    tag: 25.4.0
 
   # -- Laravel appkey used by LibreNMS, this should be generated by you and is a
   # required setting. See the README for more information
   appkey:
 
+  # -- Existing secret name to use for appkey
+  # Must have the key 'appkey' as above
+  existingSecret: false
+
   # -- Timezone used by librenms for communication with RRD cached
   timezone: UTC