WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

2026-09-22 16:19:06 +08:00
commit f7fc992f57
3929 changed files with 1006607 additions and 0 deletions
@@ -0,0 +1,56 @@
+{{/*
+Copyright 2025 Tencent
+SPDX-License-Identifier: MIT
+
+Secrets for WeKnora components.
+
+IMPORTANT: For production deployments, use one of these approaches:
+1. Set values via --set flags during installation
+2. Use External Secrets Operator with cloud secret managers
+3. Use sealed-secrets for GitOps workflows
+4. Provide an existing secret via secrets.existingSecret
+*/}}
+{{- if not .Values.secrets.existingSecret }}
+{{/*
+Reuse the previously generated random keys on upgrade. Without this lookup,
+randAlphaNum would re-roll on every `helm upgrade` and rotate SYSTEM_AES_KEY,
+making any data encrypted with the old key unreadable
+(e.g. tenants.api_key would surface as enc:v1:... in the UI).
+*/}}
+{{- $secretName := include "weknora.secretName" . }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- $existingSystemKey := "" }}
+{{- if and $existing $existing.data }}
+  {{- if index $existing.data "SYSTEM_AES_KEY" }}
+    {{- $existingSystemKey = index $existing.data "SYSTEM_AES_KEY" | b64dec }}
+  {{- end }}
+{{- end }}
+{{- $systemAesKey := .Values.secrets.systemAesKey | default $existingSystemKey | default (randAlphaNum 32) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "weknora.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  # Database credentials
+  DB_USER: {{ .Values.secrets.dbUser | quote }}
+  DB_PASSWORD: {{ required "secrets.dbPassword is required" .Values.secrets.dbPassword | quote }}
+  DB_NAME: {{ .Values.secrets.dbName | quote }}
+  # Redis credentials
+  REDIS_USERNAME: {{ .Values.secrets.redisUsername | default "" | quote }}
+  REDIS_PASSWORD: {{ required "secrets.redisPassword is required" .Values.secrets.redisPassword | quote }}
+  # Application secrets
+  JWT_SECRET: {{ required "secrets.jwtSecret is required" .Values.secrets.jwtSecret | quote }}
+  # SYSTEM_AES_KEY 加密：tenants.api_key、模型 API key、向量库凭证、web search provider key、
+  # WeKnoraCloud.AppSecret 等。（TENANT_AES_KEY 已废弃：v0.4.0 起加密统一用 SYSTEM_AES_KEY，
+  # Go 主应用不再读取 TENANT_AES_KEY，已从 Secret 中移除。）
+  SYSTEM_AES_KEY: {{ $systemAesKey | quote }}
+  {{- if .Values.neo4j.enabled }}
+  # Neo4j credentials (for GraphRAG)
+  NEO4J_USERNAME: {{ .Values.neo4j.username | quote }}
+  NEO4J_PASSWORD: {{ required "neo4j.password is required when neo4j is enabled" .Values.neo4j.password | quote }}
+  {{- end }}
+{{- end }}