Search before asking
Description
#3658 added config providers, so a server.yaml value can be a ${directory:...} marker instead of a literal secret. But on Kubernetes, actually using that with our chart is still manual: you have to wire extraVolumes, mount the Secret, and hand-write the config.providers lines, including allowed.paths, which is easy to get wrong and is the security guard.
The chart should make this declarative: say which Secrets you want mounted (or injected as env), and get the provider config generated for you, with allowed.paths and the env allowlist derived from what you declared, so the guards are correct by construction and the rendered ConfigMap never contains secret material.
Willingness to contribute
Search before asking
Description
#3658 added config providers, so a server.yaml value can be a ${directory:...} marker instead of a literal secret. But on Kubernetes, actually using that with our chart is still manual: you have to wire extraVolumes, mount the Secret, and hand-write the config.providers lines, including allowed.paths, which is easy to get wrong and is the security guard.
The chart should make this declarative: say which Secrets you want mounted (or injected as env), and get the provider config generated for you, with allowed.paths and the env allowlist derived from what you declared, so the guards are correct by construction and the rendered ConfigMap never contains secret material.
Willingness to contribute