Skip to content

Add additional secret volume mount #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bryanbellsmith merged 8 commits into from
Feb 9, 2026
Merged

Add additional secret volume mount #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1b683fe
Minor fix for image pull secret name for external secrets
bryanbellsmith Feb 6, 2026
b574f7e
moved all deployment values to a new deployment section
bryanbellsmith Feb 6, 2026
fe65858
Moved license and envvars into deployment section as well
bryanbellsmith Feb 6, 2026
e755368
Fixed limits and requests. Fixed secret name. Added additional volume…
bryanbellsmith Feb 6, 2026
d17ad64
Minor typos in readme
bryanbellsmith Feb 6, 2026
c15ee87
Bugfixes and minor typo fixes
bryanbellsmith Feb 6, 2026
36000ed
Added scheme to the probes
bryanbellsmith Feb 9, 2026
1f8db7a
Bump from 1.6.0 to 1.7.0 to prepare for release
bryanbellsmith Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: private-ai
description: A Helm chart that deploys the Private AI deidentification solution

version: 1.6.0
version: 1.7.0

# This is the default version deployed by the chart.
# However, this is simply a label - if you wish to change the version, update your values.yaml
Expand Down
17 changes: 10 additions & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,15 @@ kubectl create namespace private-ai

# Create a secret with your docker credentials from the customer portal
kubectl -n private-ai create secret docker-registry crprivateaiprod-creds \
--docker-server=crprivateaiprod.azurecr.io \
--docker-username=USERNAME \
--docker-password=PASSWORD
--docker-server=crprivateaiprod.azurecr.io \
--docker-username=USERNAME \
--docker-password=PASSWORD

# Login to the helm registry with your docker credentials
helm registry login crprivateaiprod.azurecr.io

# Create a custom values file for your specific installation
helm show values oci://crprivateaiprod.azurecr.io/helm/private-ai:1.6.0 > values.custom.yaml
helm show values oci://crprivateaiprod.azurecr.io/helm/private-ai:1.7.0 > values.custom.yaml

# Copy your license.json file contents and paste them into the license.data section of the values.custom.yaml file with single quotes surrounding, as per below
license:
Expand All @@ -40,7 +40,7 @@ helm upgrade --install \
private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \
--namespace private-ai \
-f values.custom.yaml \
--version 1.6.0
--version 1.7.0
```

## Testing
Expand Down Expand Up @@ -109,7 +109,7 @@ helm upgrade --install \
private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \
--namespace private-ai \
-f values.custom.yaml \
--version 1.6.0
--version 1.7.0
```

### External Secrets Operator
Expand Down Expand Up @@ -269,11 +269,14 @@ Update your values.custom.yaml file to enable the external secrets operator, and
externalsecrets:
enabled: true
...
```

Proceed with installing the helm chart
```console
# Proceed with installing / upgrading private-ai via helm into the private-ai namespace
helm upgrade --install \
private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \
--namespace private-ai \
-f values.custom.yaml \
--version 1.6.0
--version 1.7.0
```
97 changes: 55 additions & 42 deletions templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ metadata:
labels:
{{- include "private-ai.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
replicas: {{ .Values.deployment.replicaCount }}
selector:
matchLabels:
{{- include "private-ai.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
{{- with .Values.deployment.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
Expand All @@ -22,33 +22,33 @@ spec:
{{- if .Values.externalsecrets.enabled }}
- name: {{ .Values.externalsecrets.dockercredential.name }}
{{- else }}
- name: {{ .Values.imagePullSecrets.name }}
- name: {{ .Values.deployment.imagePullSecrets.name }}
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
{{- if or .Values.limits.enabled .Values.requests.enabled .Values.gpuEnabled }}
image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag | default .Chart.AppVersion }}"
{{- if or .Values.deployment.limits.enabled .Values.deployment.requests.enabled .Values.deployment.gpuEnabled }}
resources:
{{- if or .Values.limits.enabled .Values.gpuEnabled }}
{{- if or .Values.deployment.limits.enabled .Values.deployment.gpuEnabled }}
limits:
{{- if .Values.gpuEnabled }}
{{- if .Values.deployment.gpuEnabled }}
nvidia.com/gpu: 1
{{- end }}
memory: {{ .Values.limits.memory }}
cpu: {{ .Values.limits.cpu }}
memory: {{ .Values.deployment.limits.memory }}
cpu: {{ .Values.deployment.limits.cpu }}
{{- end }}
{{- if .Values.requests.enabled}}
{{- if .Values.deployment.requests.enabled}}
requests:
memory: {{ .Values.requests.memory }}
cpu: {{ .Values.requests.cpu }}
memory: {{ .Values.deployment.requests.memory }}
cpu: {{ .Values.deployment.requests.cpu }}
{{- end }}
{{- end }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
imagePullPolicy: {{ .Values.deployment.image.pullPolicy }}
ports:
- name: http
containerPort: {{ .Values.service.targetPort }}
protocol: TCP
{{- with .Values.envVars }}
{{- with .Values.deployment.envVars }}
env:
{{- toYaml . | nindent 12 }}
{{- end }}
Expand All @@ -61,80 +61,93 @@ spec:
{{- end }}
optional: true
volumeMounts:
- name: {{ .Values.license.volumeMount }}
- name: {{ .Values.deployment.license.volumeMount }}
mountPath: /app/license
{{- if .Values.gpuEnabled }}
{{- if .Values.deployment.additionalMounts.enabled }}
{{- with .Values.deployment.additionalMounts.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.deployment.gpuEnabled }}
- name: dshm-volume
mountPath: /dev/shm
{{- end }}
{{- if .Values.livenessProbe.enabled }}
{{- if .Values.deployment.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /healthz
port: {{ .Values.service.targetPort }}
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
scheme: {{ .Values.deployment.livenessProbe.scheme }}
periodSeconds: {{ .Values.deployment.livenessProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.deployment.livenessProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.deployment.livenessProbe.timeoutSeconds }}
failureThreshold: {{ .Values.deployment.livenessProbe.failureThreshold }}
{{- end }}
{{- if .Values.startupProbe.enabled }}
{{- if .Values.deployment.startupProbe.enabled }}
startupProbe:
httpGet:
path: /healthz
port: {{ .Values.service.targetPort }}
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
scheme: {{ .Values.deployment.startupProbe.scheme }}
periodSeconds: {{ .Values.deployment.startupProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.deployment.startupProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.deployment.startupProbe.timeoutSeconds }}
failureThreshold: {{ .Values.deployment.startupProbe.failureThreshold }}
{{- end }}
{{- if .Values.readinessProbe.enabled }}
{{- if .Values.deployment.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /healthz
port: {{ .Values.service.targetPort }}
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
scheme: {{ .Values.deployment.readinessProbe.scheme }}
periodSeconds: {{ .Values.deployment.readinessProbe.periodSeconds }}
initialDelaySeconds: {{ .Values.deployment.readinessProbe.initialDelaySeconds }}
timeoutSeconds: {{ .Values.deployment.readinessProbe.timeoutSeconds }}
failureThreshold: {{ .Values.deployment.readinessProbe.failureThreshold }}
{{- end }}
volumes:
- name: {{ .Values.license.volumeMount }}
- name: {{ .Values.deployment.license.volumeMount }}
secret:
{{- if .Values.externalsecrets.enabled }}
secretName: {{ .Values.externalsecrets.license.name }}
{{- else }}
secretName: {{ .Values.license.name }}
secretName: {{ .Values.deployment.license.name }}
{{- end }}
{{- if .Values.gpuEnabled }}
{{- if .Values.deployment.additionalMounts.enabled }}
{{- with .Values.deployment.additionalMounts.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.deployment.gpuEnabled }}
- name: dshm-volume
emptyDir:
medium: Memory
{{- end }}

affinity:
{{- if .Values.nodeAffinity.enabled}}
{{- with .Values.nodeAffinity.values}}
{{- if .Values.deployment.nodeAffinity.enabled}}
{{- with .Values.deployment.nodeAffinity.values}}
nodeAffinity:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- end }}

{{- if .Values.podAntiAffinity.enabled}}
{{- with .Values.podAntiAffinity.values}}
{{- if .Values.deployment.podAntiAffinity.enabled}}
{{- with .Values.deployment.podAntiAffinity.values}}
podAntiAffinity:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- end }}

{{- if .Values.topologySpreadConstraints.enabled}}
{{- with .Values.topologySpreadConstraints.values}}
{{- if .Values.deployment.topologySpreadConstraints.enabled}}
{{- with .Values.deployment.topologySpreadConstraints.values}}
topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}

{{- if .Values.tolerations.enabled}}
{{- with .Values.tolerations.values}}
{{- if .Values.deployment.tolerations.enabled}}
{{- with .Values.deployment.tolerations.values}}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
Expand Down
4 changes: 2 additions & 2 deletions templates/external-secrets-operator/docker-creds-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: {{ .Values.imagePullSecrets.name }}
name: {{ .Values.externalsecrets.dockercredential.name }}

@a-guiducci a-guiducci Feb 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm guessing external secrets made the wild decision not to use any casing format for their values?

@bryanbellsmith bryanbellsmith Feb 9, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm, good point. We used to have the external secrets operator as a sub chart, and helm wouldn't support camel-case or dashes in subcharts without an alias, which I found a little flakey. I just left the section in the values the same name, but we can always switch it later to be consistent.

@a-guiducci a-guiducci Feb 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fine by me, no need to go fixing what isn't broken

{{- with .Values.externalsecrets.dockercredential.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
Expand All @@ -15,7 +15,7 @@ spec:
kind: SecretStore
refreshInterval: {{ .Values.externalsecrets.dockercredential.refreshInterval }}
target:
name: {{ .Values.imagePullSecrets.name }}
name: {{ .Values.externalsecrets.dockercredential.name }}
template:
type: kubernetes.io/dockerconfigjson
data:
Expand Down
6 changes: 3 additions & 3 deletions templates/license-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ .Values.license.name }}
{{- with .Values.license.annotations }}
name: {{ .Values.deployment.license.name }}
{{- with .Values.deployment.license.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
labels:
{{- include "private-ai.labels" . | nindent 4 }}
data:
license.json: |-
{{- .Values.license.data | b64enc | nindent 4 }}
{{- .Values.deployment.license.data | b64enc | nindent 4 }}
{{- end }}
Loading