Managing Secrets🔗

Lightrun requires various secrets for authentication, database access, message queues, and integrations. These secrets are managed under secrets and can either be deployed as part of this chart or managed externally.

Secrets Deployment Options🔗

If deploy_secrets: true, the Helm chart will create and manage secrets.
If deploy_secrets: false, secrets must be pre-created in Kubernetes. The chart will look for existing secrets:
- Backend secret: {{ .Release.name }}-backend
- Keycloak secret: {{ .Release.name }}-keycloak
- ClickHouse secret: {{ .Release.name }}-runtime-collector-clickhouse (when Runtime Collector is enabled and not using clickhouse.external.existingSecret)
- Runtime Collector gRPC secret: {{ .Release.name }}-runtime-collector-grpc (when Runtime Collector is enabled)

To use custom secret names, set:

general:
  deploy_secrets:
    existing_secrets:
      backend: ""
      keycloak: ""
      clickhouse: ""
      runtime_collector: ""

Note that this is only relevant when deploy_secrets: false.

[!WARNING] When managing secrets externally, ensure all required fields are present in both the backend and Keycloak secrets. See the secrets template for reference.

(This is relevant only when deploy_secrets: false.)

Mandatory Secret Fields🔗

When managing secrets externally, ensure the following fields are present in each secret (See the secrets template for reference).

Backend secret (`{{ .Release.name }}-backend`)🔗

Environment Variable	Description	Value Source
`SPRING_SECURITY_KEYCLOAK_CLI_PASSWORD`	Keycloak admin password	`secrets.keycloak.password`
`SPRING_MAIL_PASSWORD`	Mail server password	`secrets.defaults.mail_password`
`SPRING_FLYWAY_PASSWORD`	DB password	`secrets.db.password`
`SPRING_FLYWAY_USER`	DB user	`secrets.db.user`
`SPRING_DATASOURCE_USERNAME`	DB username	`secrets.db.user`
`SPRING_DATASOURCE_PASSWORD`	DB password	`secrets.db.password`
`KEYSTORE_PASSWORD`	Java Keystore password	`secrets.defaults.keystore_password`
`LICENSE_CONTENT`	Lightrun license content	`secrets.license.content`
`LICENSE_SIGNATURE`	Lightrun license signature	`secrets.license.signature`
`SPRING_RABBITMQ_USERNAME`	RabbitMQ username	`secrets.mq.user`
`SPRING_RABBITMQ_PASSWORD`	RabbitMQ password	`secrets.mq.password`
`encryption-key-0`	Backend encryption key (default)	`secrets.keysEncryption.userEncryptionKey`

Keycloak secret (`{{ .Release.name }}-keycloak`)🔗

Secret Key	Description	Value Source
`DB_PASSWORD`	Database password for Keycloak	`secrets.db.password`
`DB_USER`	Database username for Keycloak	`secrets.db.user`
`KEYCLOAK_PASSWORD`	Keycloak admin password	`secrets.keycloak.password`
`KEYCLOAK_USER`	Keycloak admin username	Fixed as `admin` in chart template; set same value when using external secret

ClickHouse secret (`{{ .Release.name }}-runtime-collector-clickhouse`)🔗

Required when Runtime Collector is enabled and credentials are not supplied via deployments.runtime_collector.clickhouse.external.existingSecret.

Secret Key	Description	Value Source
`CLICKHOUSE_PASSWORD`	ClickHouse password	`secrets.clickhouse.password` (local) or `deployments.runtime_collector.clickhouse.external.password` (external)
`CLICKHOUSE_USERNAME`	ClickHouse username	`secrets.clickhouse.user` (local) or `deployments.runtime_collector.clickhouse.external.username` (external)

Runtime Collector gRPC secret (`{{ .Release.name }}-runtime-collector-grpc`)🔗

Required when Runtime Collector is enabled. Shared by both gRPC directions: the backend authenticates to the runtime-collector server with it, and the runtime-collector authenticates to the backend's gRPC server with the same value.

Secret Key	Description	Value Source
`RUNTIME_COLLECTOR_GRPC_SECRET`	Shared secret authenticating gRPC calls between the backend and the Runtime Collector, in both directions	`secrets.runtime_collector.grpc_secret`

[!WARNING] For encryption keys, it's strongly recommended to provide them as external secrets rather than letting the chart manage them. See Encryption Keys Documentation for details.

Secrets Configuration🔗

Authentication and Access Secrets🔗

These secrets store authentication credentials for essential services.

secrets:
  keycloak:
    password: ""  # Keycloak admin password

  db:
    user: ""      # Database username
    password: ""  # Database password

  mq:
    user: ""      # Message queue username
    password: ""  # Message queue password

  clickhouse:
    user: ""      # ClickHouse username (used when Runtime Collector is enabled)
    password: ""  # ClickHouse password (used when Runtime Collector is enabled)

  runtime_collector:
    grpc_secret: ""  # Shared secret for backend <-> runtime-collector gRPC calls, both directions (used when Runtime Collector is enabled)

  redis:
    password: ""  # Redis authentication password

Note: Redis authentication requires deployments.redis.auth.enabled: true. Note: ClickHouse credentials apply when Runtime Collector is enabled with local ClickHouse.

License🔗

Lightrun requires specific secrets for licensing.

  license:
    content: ""    # Lightrun license file content
    signature: ""  # License signature

Integration and Default Credentials🔗

Some secrets are used for integrating with external services.

  defaults:
    mail_password: ""  # Password for mail server authentication
    keystore_password: ""  # Java Keystore password

    google_sso:
      client_id: ""      # (Optional) Google SSO Client ID
      client_secret: ""  # (Optional) Google SSO Client Secret

    datadog_api_key: ""  # (Optional) API key for Datadog integration
    mixpanel_token: ""   # (Optional) Token for Mixpanel analytics

Optional fields: If left empty, these values will not be included in the Kubernetes secret.

Container Image Registry Credentials🔗

  dockerhub_config:
    existingSecret: ""  # Use an existing secret if provided
    configContent: ""   # Create a new secret if `existingSecret` is empty

Refer to Container Image Registry Overview for a detailed explanation of how to configure dockerhub_config.

Last update: October 26, 2026