Skip to content

Commit f8f7dcf

Browse files
PabloCastellanoPabloCastellano
committed
refactor: move secrets to secretEnv
1 parent cc40614 commit f8f7dcf

18 files changed

+239
-224
lines changed

‎charts/blobscan-api/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ icon: https://raw.githubusercontent.com/Blobscan/blobscan/main/.github/assets/lo
66
sources:
77
- https://github.com/blobscan/blobscan/
88
type: application
9-
version: 0.4.8
9+
version: 0.5.0
1010
maintainers:
1111
- name: PabloCastellano
1212
email: [email protected]

‎charts/blobscan-api/README.md

+14-14
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
# blobscan-api
33

4-
![Version: 0.4.8](https://img.shields.io/badge/Version-0.4.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
4+
![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
55

66
Blobscan API
77

@@ -41,15 +41,11 @@ Blobscan API
4141
| config.BLOBSCAN_API_BASE_URL | string | `"http://blobscan-api:3001"` | Base URL for the Blobscan API service |
4242
| config.BLOBSCAN_API_PORT | int | `3001` | Port on which the Blobscan API service listens |
4343
| config.CHAIN_ID | string | `"1"` | Ethereum network chain ID (1 for mainnet) |
44-
| config.DATABASE_URL | string | `"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?pgbouncer=true&sslmode=require"` | PostgreSQL connection string for the main database connection |
45-
| config.DIRECT_URL | string | `"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?sslmode=require"` | Direct PostgreSQL connection string, used for Prisma direct database access |
4644
| config.ETH_PRICE_SYNCER_CHAIN_ID | string | `"137"` | ID of the chain where price feed contract is deployed on |
47-
| config.ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL | string | `"http://polygon-rpc:8545"` | RPC endpoint for the chain specified in ETH_PRICE_SYNCER_CHAIN_ID |
4845
| config.ETH_PRICE_SYNCER_CRON_PATTERN | string | `"* * * * *"` | Cron pattern for the job that periodically stores ETH price in database |
49-
| config.ETH_PRICE_SYNCER_ENABLED | string | `"false"` | Enable the ETH price syncer job |
46+
| config.ETH_PRICE_SYNCER_ENABLED | bool | `false` | Enable the ETH price syncer job |
5047
| config.ETH_PRICE_SYNCER_ETH_USD_PRICE_FEED_CONTRACT_ADDRESS | string | `"0xF9680D99D6C9589e2a93a78A04A279e509205945"` | Contract address for the Chainlink ETH/USD price feed on the specified chain |
51-
| config.ETH_PRICE_SYNCER_TIME_TOLERANCE | int | `3600` | Maximum allowed age (in seconds) of the fetched price before it's considered stale |
52-
| config.GOOGLE_SERVICE_KEY | string | `""` | Google Cloud service account key for authentication (JSON format) |
48+
| config.ETH_PRICE_SYNCER_TIME_TOLERANCE | int | `60` | Maximum allowed age (in seconds) of the fetched price before it's considered stale |
5349
| config.GOOGLE_STORAGE_BUCKET_NAME | string | `""` | Google Cloud Storage bucket name for blob data storage |
5450
| config.GOOGLE_STORAGE_ENABLED | string | `"false"` | Enable Google Cloud Storage for blob data |
5551
| config.GOOGLE_STORAGE_PROJECT_ID | string | `""` | Google Cloud project ID for blob data storage |
@@ -58,16 +54,10 @@ Blobscan API
5854
| config.NETWORK_NAME | string | `"mainnet"` | Ethereum network name (mainnet, holesky, sepolia, gnosis) |
5955
| config.OTEL_EXPORTER_OTLP_ENDPOINT | string | `"http://localhost:4318"` | Endpoint URL for OpenTelemetry data export |
6056
| config.OTEL_EXPORTER_OTLP_PROTOCOL | string | `"http/protobuf"` | Protocol used for OpenTelemetry data export |
61-
| config.OTLP_AUTH_PASSWORD | string | `""` | Password for OpenTelemetry authentication |
62-
| config.OTLP_AUTH_USERNAME | string | `""` | Username for OpenTelemetry authentication |
6357
| config.POSTGRES_STORAGE_ENABLED | string | `"true"` | Enable PostgreSQL storage for blob data |
64-
| config.REDIS_URI | string | `"redis://blobscan-redis-master:6379/1"` | Redis connection URI for caching and queue management |
65-
| config.SECRET_KEY | string | `"supersecret"` | Secret key used for session management and encryption |
66-
| config.SENTRY_DSN_API | string | `""` | Sentry DSN for API |
6758
| config.SWARM_BATCH_ID | string | `""` | Swarm batch ID for blob data storage in Swarm network |
6859
| config.SWARM_STORAGE_ENABLED | string | `"false"` | Enable Swarm decentralized storage for blob data |
6960
| config.TRACES_ENABLED | string | `"false"` | Enable distributed tracing |
70-
| config.WEAVEVM_API_KEY | string | `""` | API key for WeaveVM integration |
7161
| containerSecurityContext | object | See `values.yaml` | The security context for containers |
7262
| customArgs | list | `[]` | Custom args for the blobscan-api container |
7363
| customCommand | list | `[]` | Command replacement for the blobscan-api container |
@@ -99,7 +89,17 @@ Blobscan API
9989
| readinessProbe | object | See `values.yaml` | Readiness probe |
10090
| replicas | int | `1` | Number of replicas |
10191
| resources | object | `{}` | Resource requests and limits |
102-
| secretEnv | object | `{}` | Secret env variables injected via a created secret |
92+
| secretEnv | object | `{"DATABASE_URL":"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?pgbouncer=true&sslmode=require","DIRECT_URL":"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?sslmode=require","ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL":"http://polygon-rpc:8545","GOOGLE_SERVICE_KEY":"","OTLP_AUTH_PASSWORD":"","OTLP_AUTH_USERNAME":"","REDIS_URI":"redis://blobscan-redis-master:6379/1","SECRET_KEY":"supersecret","SENTRY_DSN_API":"","WEAVEVM_API_KEY":""}` | Secret env variables injected via a created secret |
93+
| secretEnv.DATABASE_URL | string | `"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?pgbouncer=true&sslmode=require"` | PostgreSQL connection string for the main database connection |
94+
| secretEnv.DIRECT_URL | string | `"postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?sslmode=require"` | Direct PostgreSQL connection string, used for Prisma direct database access |
95+
| secretEnv.ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL | string | `"http://polygon-rpc:8545"` | RPC endpoint for the chain specified in ETH_PRICE_SYNCER_CHAIN_ID |
96+
| secretEnv.GOOGLE_SERVICE_KEY | string | `""` | Google Cloud service account key for authentication (JSON format) |
97+
| secretEnv.OTLP_AUTH_PASSWORD | string | `""` | Password for OpenTelemetry authentication |
98+
| secretEnv.OTLP_AUTH_USERNAME | string | `""` | Username for OpenTelemetry authentication |
99+
| secretEnv.REDIS_URI | string | `"redis://blobscan-redis-master:6379/1"` | Redis connection URI for caching and queue management |
100+
| secretEnv.SECRET_KEY | string | `"supersecret"` | Secret key used for session management and encryption |
101+
| secretEnv.SENTRY_DSN_API | string | `""` | Sentry DSN for API |
102+
| secretEnv.WEAVEVM_API_KEY | string | `""` | API key for WeaveVM integration |
103103
| securityContext | object | See `values.yaml` | The security context for pods |
104104
| service.type | string | `"ClusterIP"` | Service type |
105105
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |

‎charts/blobscan-api/templates/_helpers.tpl

+16
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,17 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4242
app.kubernetes.io/managed-by: {{ .Release.Service }}
4343
{{- end }}
4444

45+
46+
{{- define "bullmq.labels" -}}
47+
helm.sh/chart: {{ include "blobscan.chart" . }}
48+
{{ include "bullmq.selectorLabels" . }}
49+
{{- if .Chart.AppVersion }}
50+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
51+
{{- end }}
52+
app.kubernetes.io/managed-by: {{ .Release.Service }}
53+
{{- end }}
54+
55+
4556
{{/*
4657
Selector labels
4758
*/}}
@@ -50,6 +61,11 @@ app.kubernetes.io/name: {{ include "blobscan.name" . }}
5061
app.kubernetes.io/instance: {{ .Release.Name }}
5162
{{- end }}
5263

64+
{{- define "bullmq.selectorLabels" -}}
65+
app.kubernetes.io/name: bullmq-exporter
66+
app.kubernetes.io/instance: {{ .Release.Name }}
67+
{{- end }}
68+
5369
{{/*
5470
Create the name of the service account to use
5571
*/}}

‎charts/blobscan-api/templates/bullmq-exporter-deployment.yaml

+8-8
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,18 @@
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
5-
name: {{ include "blobscan.fullname" . }}-bullmq-exporter
5+
name: bullmq-exporter
66
labels:
7-
{{- include "blobscan.labels" . | nindent 4 }}
8-
app.kubernetes.io/component: bullmq-exporter
7+
{{- include "bullmq.labels" . | nindent 4 }}
98
spec:
109
replicas: 1
1110
selector:
1211
matchLabels:
13-
{{- include "blobscan.selectorLabels" . | nindent 6 }}
14-
app.kubernetes.io/component: bullmq-exporter
12+
{{- include "bullmq.selectorLabels" . | nindent 6 }}
1513
template:
1614
metadata:
1715
labels:
18-
{{- include "blobscan.selectorLabels" . | nindent 8 }}
19-
app.kubernetes.io/component: bullmq-exporter
16+
{{- include "bullmq.selectorLabels" . | nindent 8 }}
2017
annotations:
2118
{{- with .Values.bullmqExporter.podAnnotations }}
2219
{{- toYaml . | nindent 8 }}
@@ -39,7 +36,10 @@ spec:
3936
protocol: TCP
4037
env:
4138
- name: REDIS_URI
42-
value: {{ .Values.config.REDIS_URI | quote }}
39+
valueFrom:
40+
secretKeyRef:
41+
name: {{ include "blobscan.fullname" . }}-env
42+
key: REDIS_URI
4343
- name: REDIS_DB
4444
value: {{ .Values.bullmqExporter.databaseMapping | quote }}
4545
{{- with .Values.bullmqExporter.resources }}

‎charts/blobscan-api/templates/bullmq-exporter-service.yaml

+3-5
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,9 @@
22
apiVersion: v1
33
kind: Service
44
metadata:
5-
name: {{ include "blobscan.fullname" . }}-bullmq-exporter
5+
name: bullmq-exporter
66
labels:
7-
{{- include "blobscan.labels" . | nindent 4 }}
8-
app.kubernetes.io/component: bullmq-exporter
7+
{{- include "bullmq.labels" . | nindent 4 }}
98
spec:
109
type: ClusterIP
1110
ports:
@@ -14,6 +13,5 @@ spec:
1413
protocol: TCP
1514
name: metrics
1615
selector:
17-
{{- include "blobscan.selectorLabels" . | nindent 4 }}
18-
app.kubernetes.io/component: bullmq-exporter
16+
{{- include "bullmq.selectorLabels" . | nindent 4 }}
1917
{{- end }}

‎charts/blobscan-api/templates/bullmq-servicemonitor.yaml

+3-4
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
apiVersion: monitoring.coreos.com/v1
33
kind: ServiceMonitor
44
metadata:
5-
name: {{ include "blobscan.fullname" . }}-bullmq
5+
name: bullmq-exporter
66
{{- if .Values.bullmqExporter.serviceMonitor.namespace }}
77
namespace: {{ .Values.bullmqExporter.serviceMonitor.namespace }}
88
{{- end }}
99
labels:
10-
{{- include "blobscan.labels" . | nindent 4 }}
10+
{{- include "bullmq.labels" . | nindent 4 }}
1111
{{- if .Values.bullmqExporter.serviceMonitor.labels }}
1212
{{- toYaml .Values.bullmqExporter.serviceMonitor.labels | nindent 4 }}
1313
{{- end }}
@@ -36,8 +36,7 @@ spec:
3636
jobLabel: "{{ .Release.Name }}-bullmq"
3737
selector:
3838
matchLabels:
39-
{{- include "blobscan.selectorLabels" . | nindent 6 }}
40-
app.kubernetes.io/component: bullmq-exporter
39+
{{- include "bullmq.selectorLabels" . | nindent 6 }}
4140
namespaceSelector:
4241
matchNames:
4342
- {{ .Release.Namespace }}

‎charts/blobscan-api/templates/deployment.yaml

+5-29
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,6 @@ spec:
7676
env:
7777
- name: CHAIN_ID
7878
value: {{ .Values.config.CHAIN_ID | quote }}
79-
- name: DATABASE_URL
80-
value: {{ .Values.config.DATABASE_URL | quote }}
81-
- name: DIRECT_URL
82-
value: {{ .Values.config.DIRECT_URL | quote }}
83-
- name: REDIS_URI
84-
value: {{ .Values.config.REDIS_URI | quote }}
85-
- name: SECRET_KEY
86-
value: {{ .Values.config.SECRET_KEY | quote }}
8779
- name: NETWORK_NAME
8880
value: {{ .Values.config.NETWORK_NAME | quote }}
8981
- name: BLOBSCAN_API_BASE_URL
@@ -107,16 +99,6 @@ spec:
10799
value: {{ .Values.config.GOOGLE_STORAGE_BUCKET_NAME | quote }}
108100
- name: GOOGLE_STORAGE_PROJECT_ID
109101
value: {{ .Values.config.GOOGLE_STORAGE_PROJECT_ID | quote }}
110-
- name: GOOGLE_SERVICE_KEY
111-
value: {{ .Values.config.GOOGLE_SERVICE_KEY | quote }}
112-
{{- end }}
113-
{{- if .Values.config.OTLP_AUTH_USERNAME }}
114-
- name: OTLP_AUTH_USERNAME
115-
value: {{ .Values.config.OTLP_AUTH_USERNAME | quote }}
116-
{{- end }}
117-
{{- if .Values.config.OTLP_AUTH_PASSWORD }}
118-
- name: OTLP_AUTH_PASSWORD
119-
value: {{ .Values.config.OTLP_AUTH_PASSWORD | quote }}
120102
{{- end }}
121103
{{- if .Values.config.OTEL_EXPORTER_OTLP_PROTOCOL }}
122104
- name: OTEL_EXPORTER_OTLP_PROTOCOL
@@ -128,19 +110,15 @@ spec:
128110
{{- end }}
129111
- name: METRICS_ENABLED
130112
value: {{ .Values.config.METRICS_ENABLED | quote }}
113+
{{- if .Values.config.TRACES_ENABLED }}
131114
- name: TRACES_ENABLED
132115
value: {{ .Values.config.TRACES_ENABLED | quote }}
116+
{{- end }}
133117
- name: LOG_LEVEL
134118
value: {{ .Values.config.LOG_LEVEL | quote }}
135-
{{- if .Values.config.WEAVEVM_API_KEY }}
136-
- name: WEAVEVM_API_KEY
137-
value: {{ .Values.config.WEAVEVM_API_KEY | quote }}
138-
{{- end }}
119+
{{- if .Values.config.ETH_PRICE_SYNCER_ENABLED }}
139120
- name: ETH_PRICE_SYNCER_ENABLED
140121
value: {{ .Values.config.ETH_PRICE_SYNCER_ENABLED | quote }}
141-
{{- if .Values.config.ETH_PRICE_SYNCER_ENABLED }}
142-
- name: ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL
143-
value: {{ .Values.config.ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL | quote }}
144122
- name: ETH_PRICE_SYNCER_CRON_PATTERN
145123
value: {{ .Values.config.ETH_PRICE_SYNCER_CRON_PATTERN | quote }}
146124
- name: ETH_PRICE_SYNCER_CHAIN_ID
@@ -150,17 +128,15 @@ spec:
150128
- name: ETH_PRICE_SYNCER_TIME_TOLERANCE
151129
value: {{ .Values.config.ETH_PRICE_SYNCER_TIME_TOLERANCE | quote }}
152130
{{- end }}
153-
{{- if .Values.config.SENTRY_DSN_API }}
154-
- name: SENTRY_DSN_API
155-
value: {{ .Values.config.SENTRY_DSN_API | quote }}
156-
{{- end }}
157131

158132
{{- range $key, $value := .Values.secretEnv }}
133+
{{- if ne $value "" }}
159134
- name: {{ $key }}
160135
valueFrom:
161136
secretKeyRef:
162137
name: {{ include "blobscan.fullname" $ }}-env
163138
key: {{ $key }}
139+
{{- end }}
164140
{{- end }}
165141
{{- if .Values.extraEnv }}
166142
{{- toYaml .Values.extraEnv | nindent 12 }}

‎charts/blobscan-api/values.yaml

+23-24
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,27 @@ image:
1616
pullPolicy: IfNotPresent
1717

1818
# -- Secret env variables injected via a created secret
19-
secretEnv: {}
19+
secretEnv:
20+
# -- Redis connection URI for caching and queue management
21+
REDIS_URI: "redis://blobscan-redis-master:6379/1"
22+
# -- PostgreSQL connection string for the main database connection
23+
DATABASE_URL: "postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?pgbouncer=true&sslmode=require"
24+
# -- Direct PostgreSQL connection string, used for Prisma direct database access
25+
DIRECT_URL: "postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?sslmode=require"
26+
# -- Secret key used for session management and encryption
27+
SECRET_KEY: "supersecret"
28+
# -- Google Cloud service account key for authentication (JSON format)
29+
GOOGLE_SERVICE_KEY: ""
30+
# -- Username for OpenTelemetry authentication
31+
OTLP_AUTH_USERNAME: ""
32+
# -- Password for OpenTelemetry authentication
33+
OTLP_AUTH_PASSWORD: ""
34+
# -- API key for WeaveVM integration
35+
WEAVEVM_API_KEY: ""
36+
# -- RPC endpoint for the chain specified in ETH_PRICE_SYNCER_CHAIN_ID
37+
ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL: "http://polygon-rpc:8545"
38+
# -- Sentry DSN for API
39+
SENTRY_DSN_API: ""
2040

2141
# -- Ports
2242
httpPort: 3001
@@ -30,14 +50,6 @@ args: []
3050
config:
3151
# -- Ethereum network chain ID (1 for mainnet)
3252
CHAIN_ID: "1"
33-
# -- PostgreSQL connection string for the main database connection
34-
DATABASE_URL: "postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?pgbouncer=true&sslmode=require"
35-
# -- Direct PostgreSQL connection string, used for Prisma direct database access
36-
DIRECT_URL: "postgresql://postgres:postgres@blobscan-blobscandb:5432/blobscan?sslmode=require"
37-
# -- Redis connection URI for caching and queue management
38-
REDIS_URI: "redis://blobscan-redis-master:6379/1"
39-
# -- Secret key used for session management and encryption
40-
SECRET_KEY: "supersecret"
4153
# -- Ethereum network name (mainnet, holesky, sepolia, gnosis)
4254
NETWORK_NAME: "mainnet"
4355
# -- Base URL for the Blobscan API service
@@ -56,14 +68,8 @@ config:
5668
GOOGLE_STORAGE_BUCKET_NAME: ""
5769
# -- Google Cloud project ID for blob data storage
5870
GOOGLE_STORAGE_PROJECT_ID: ""
59-
# -- Google Cloud service account key for authentication (JSON format)
60-
GOOGLE_SERVICE_KEY: ""
6171
# -- Swarm Bee node endpoint for decentralized storage
6272
BEE_ENDPOINT: "http://localhost:1633"
63-
# -- Username for OpenTelemetry authentication
64-
OTLP_AUTH_USERNAME: ""
65-
# -- Password for OpenTelemetry authentication
66-
OTLP_AUTH_PASSWORD: ""
6773
# -- Protocol used for OpenTelemetry data export
6874
OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
6975
# -- Endpoint URL for OpenTelemetry data export
@@ -72,25 +78,18 @@ config:
7278
METRICS_ENABLED: "true"
7379
# -- Enable distributed tracing
7480
TRACES_ENABLED: "false"
75-
# -- API key for WeaveVM integration
76-
WEAVEVM_API_KEY: ""
7781
# -- Log level (info, warning, error, debug)
7882
LOG_LEVEL: "info"
7983
# -- Enable the ETH price syncer job
80-
ETH_PRICE_SYNCER_ENABLED: "false"
84+
ETH_PRICE_SYNCER_ENABLED: false
8185
# -- Cron pattern for the job that periodically stores ETH price in database
8286
ETH_PRICE_SYNCER_CRON_PATTERN: "* * * * *"
8387
# -- ID of the chain where price feed contract is deployed on
8488
ETH_PRICE_SYNCER_CHAIN_ID: "137"
8589
# -- Contract address for the Chainlink ETH/USD price feed on the specified chain
8690
ETH_PRICE_SYNCER_ETH_USD_PRICE_FEED_CONTRACT_ADDRESS: "0xF9680D99D6C9589e2a93a78A04A279e509205945"
87-
# -- RPC endpoint for the chain specified in ETH_PRICE_SYNCER_CHAIN_ID
88-
ETH_PRICE_SYNCER_CHAIN_JSON_RPC_URL: "http://polygon-rpc:8545"
8991
# -- Maximum allowed age (in seconds) of the fetched price before it's considered stale
90-
ETH_PRICE_SYNCER_TIME_TOLERANCE: 3600
91-
92-
# -- Sentry DSN for API
93-
SENTRY_DSN_API: ""
92+
ETH_PRICE_SYNCER_TIME_TOLERANCE: 60
9493

9594
# -- Additional env variables
9695
extraEnv: []

‎charts/blobscan-indexer/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ icon: https://raw.githubusercontent.com/Blobscan/blobscan/main/.github/assets/lo
66
sources:
77
- https://github.com/blobscan/blobscan-indexer
88
type: application
9-
version: 0.2.11
9+
version: 0.3.0
1010
maintainers:
1111
- name: PabloCastellano
1212
email: [email protected]

0 commit comments

Comments
 (0)