How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets

Question

I have a Rest API in Python that has several Configuration variables that are setup at startup time.

This variables are read from the environment variables of the host machine.

Our production environmant is on a kubernetes cluster that is deployed with github actions and a helm chart.

The problem I have is that whenever a new config variable is added. I have to add it in 3 places.

1. On the actual python application code
2. On the helm chart's values.yaml
3. On the github secrets of the repo so that during the deployment it sets the values.yaml with the value of the secret.

How to manage it and make this process a bit less error prone? Since now it's very likely that somebody forgest to add the new config on any of the above 3 places and break the deploy pipeline.

Answer 1

The process itself looks fine to me, what I would do is:

1. Add a test in the last step that runs helm template on a few targets that may get this parameter, to verify it is not failing.
2. Add the parameter in a way that will not break the pipeline if it is missing, or put a default in the code that will not cause damage.

Answer 2

Here's what I'd try to do:

1. Move the environment variables to .env file, which can be read by the Python application e.g. by python-dotenv and make this file the single source of truth. Depending on the info you keep in the .env file, you could have one committed to the repo (.env), which doesn't contain any sensitive info, second one .env.local, being .gitignored, containing sensitive data.
2. Write a simple pre-commit hook that would do two things:
   1. patch the .values.yaml file using e.g. yq with values from the .env file (which can be sources in a bash script),
   2. utilize GitHub CLI and set the secrets, again using the .env file.

The script that would be run by the pre-commit hook could be externalized to bin/ so you can run it on-demand, without having to commit the code.