<p>Here's what I'd try to do:</p>
<ol>
<li>Move the environment variables to .env file, which can be read by the Python application e.g. by <a href="https://pypi.org/project/python-dotenv/" rel="nofollow noreferrer">python-dotenv</a> and make this file the single source of truth. Depending on the info you keep in the .env file, you could have one committed to the repo (.env), which doesn't contain any sensitive info, second one .env.local, being .gitignored, containing sensitive data.</li>
<li>Write a simple <a href="https://pre-commit.com/" rel="nofollow noreferrer">pre-commit hook</a> that would do two things:
<ol>
<li>patch the .values.yaml file using e.g. <a href="https://github.com/mikefarah/yq" rel="nofollow noreferrer">yq</a> with values from the .env file (which can be sources in a bash script),</li>
<li>utilize GitHub CLI and <a href="https://cli.github.com/manual/gh_secret_set" rel="nofollow noreferrer">set the secrets</a>, again using the .env file.</li>
</ol>
</li>
</ol>
<p>The script that would be run by the pre-commit hook could be externalized to <code>bin/</code> so you can run it on-demand, without having to commit the code.</p>

CC BY-SA 4.0
2022-03-28T12:04:30.137Z
2022-03-28T13:51:04.533Z
2022-03-28T13:51:04.533Z
David Lukac
<p>The process itself looks fine to me, what I would do is:</p>
<ol>
<li>Add a test in the last step that runs helm template on a few targets that may get this parameter, to verify it is not failing.</li>
<li>Add the parameter in a way that will not break the pipeline if it is missing, or put a default in the code that will not cause damage.</li>
</ol>

CC BY-SA 4.0
2022-02-26T08:31:58.040Z
2022-02-26T08:31:58.040Z
Avi
<p>I have a Rest API in Python that has several Configuration variables that are setup at startup time.</p>
<p>This variables are read from the environment variables of the host machine.</p>
<p>Our production environmant is on a kubernetes cluster that is deployed with github actions and a helm chart.</p>
<p>The problem I have is that whenever a new config variable is added. I have to add it in 3 places.</p>
<ol>
<li>On the actual python application code</li>
<li>On the helm chart's <code>values.yaml</code></li>
<li>On the github secrets of the repo so that during the deployment it sets the <code>values.yaml</code> with the value of the secret.</li>
</ol>
<p>How to manage it and make this process a bit less error prone? Since now it's very likely that somebody forgest to add the new config on any of the above 3 places and break the deploy pipeline.</p>

<configuration-management><secret-management>
How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets
Pablo Estrada
# How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets

(Asked by: username_0 on 2022-02-23)

I have a Rest API in Python that has several Configuration variables that are setup at startup time.

This variables are read from the environment variables of the host machine.

Our production environmant is on a kubernetes cluster that is deployed with github actions and a helm chart.

The problem I have is that whenever a new config variable is added. I have to add it in 3 places.

1. On the actual python application code
2. On the helm chart's `values.yaml`
3. On the github secrets of the repo so that during the deployment it sets the `values.yaml` with the value of the secret.

How to manage it and make this process a bit less error prone? Since now it's very likely that somebody forgest to add the new config on any of the above 3 places and break the deploy pipeline.

**Tags:** configuration-management, secret-management


---

## 2 answers

### Answer by username_1 on 2022-03-28. Score: 1

Here's what I'd try to do:

1. Move the environment variables to .env file, which can be read by the Python application e.g. by [python-dotenv](https://pypi.org/project/python-dotenv/) and make this file the single source of truth. Depending on the info you keep in the .env file, you could have one committed to the repo (.env), which doesn't contain any sensitive info, second one .env.local, being .gitignored, containing sensitive data.
2. Write a simple [pre-commit hook](https://pre-commit.com/) that would do two things:
   1. patch the .values.yaml file using e.g. [yq](https://github.com/mikefarah/yq) with values from the .env file (which can be sources in a bash script),
   2. utilize GitHub CLI and [set the secrets](https://cli.github.com/manual/gh_secret_set), again using the .env file.

The script that would be run by the pre-commit hook could be externalized to `bin/` so you can run it on-demand, without having to commit the code.


---

### Answer by username_2 on 2022-02-26. Score: 1

The process itself looks fine to me, what I would do is:

1. Add a test in the last step that runs helm template on a few targets that may get this parameter, to verify it is not failing.
2. Add the parameter in a way that will not break the pipeline if it is missing, or put a default in the code that will not cause damage.


---

