I really appreciate the kubernetes tutorial https://www.prisma.io/tutorials/deploy-prisma-to-kubernetes-ct13/. Only thing that troubles me (so far...) as a Kubernetes newbie is how to inject secrets / env vars into teh PRISMA_CONFIG part of the configMap i.e. :

apiVersion: v1
kind: ConfigMap
metadata:
  name: prisma-configmap
  namespace: prisma
  labels:
    stage: production
    name: prisma
    app: prisma
data:
  PRISMA_CONFIG: |
    port: 4466
    # uncomment the next line and provide the env var PRISMA_MANAGEMENT_API_SECRET=my-secret to activate cluster security
    # managementApiSecret: my-secret
    databases:
      default:
        connector: mysql
        host: database
        port: 3306
        user: root
        password: prisma
        migrations: true

i.e. if I had a secret or an env var e.g. in .env file describing my db password how do I then inject that into the configMAP?

Hi i am also a k8s newbie but as of my understanding of configmaps I guess they are just like env files which contains your secrets and see no point of mapping I maybe totally wrong

i follow the docs as well 🙂 My question is more in line with how to represent the PRISMA_CONFIG with k8s secrets e.g. something like

PRISMA_CONFIG: |
    port: DB_PORT
      valueFrom:
        secretKeyRef:
          name: onlaw
          key: DB_PORT

I guess there are some predefined env that prisma reads when PRISMA_CONFIG is not present

I hope you are right. Currently my plan is to inject secrets as environment vars in the deployment and then us ${} notation in the configmap for PRISMA_CONFIG 🙂 If my kids stay a sleep I report back in a few minutes 🙂

I guess you need to write a bash script or something now

would be great. I am building a stack with prisma and yoga server. So I would prefer to keep all settings in one place, preferably in the .env file. I manage to creat secrets and/or configmaps from the .env file using

--from-env-file

but I cannot figure out how to use em in the PRISMA_CONFIG yaml scalar block

Hee, I used terraform to inject the variables. The container definition looks like this:

resource "aws_ecs_task_definition" "prod-prisma" {
  family = "prod-prisma"

  container_definitions = <<DEFINITION
[
  {
    "name": "prisma-prod",
    "cpu": 256,
    "memory": 512,
    "environment": [{
      "name": "PRISMA_CONFIG",
      "value": "managementApiSecret: ${var.prod-PRISMA_MANAGEMENT_API_SECRET}\nport: 4466\ndatabases:\n  default:\n    connector: postgres\n    migrations: true\n    host: ${var.prod-PRISMA_DB_HOST}\n    port: 5432\n    user: ${var.prod-PRISMA_DB_USERNAME}\n    password: ${var.prod-PRISMA_DB_PASSWORD}"
    }],
    "essential": true,
    "image": "<http://registry.hub.docker.com/prismagraphql/prisma:1.16|registry.hub.docker.com/prismagraphql/prisma:1.16>",
    "dockerLabels": {
      "STAGE": "prod"
    },
    "portMappings": [
      {
        "hostPort": 4466,
        "protocol": "tcp",
        "containerPort": 4466
      }
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/prisma-prod",
        "awslogs-region": "us-east-1",
        "awslogs-stream-prefix": "ecs"
      }
    }
  }
]
DEFINITION
}

@Michiel Westerbeek I am not sure it helps 🙂 I posted a new message just now 🙂

Hee, it’s terraform doing string replacement. Prisma doesn’t do variables at all, it should have the real values in the env variable. (I’ll read your other message)

oh so the reason why string replacement works in e.g. databases -> default->user when using docker-compose is that docker does the string replacement i suppose?

Terraform is a separate service from hashicorp I guess. @yolen did you tried exploring some of predefined env varibales

I think so yeah, try to not see the PRISMA_CONFIG as the same yaml as your kubernetes config. So in the configmap, see it as a string

...which makes it difficult to build the PRISMA_CONFIG env var with injected env vars

I don't know kubernetes config, but probably there is a way to append variables in a string?

I see it as a string but i need to inject other env vars (or secrets or configmap entries) into the PRISMA_CONFIG env var string excatly as you do using terraform

In the example you just posted it's still "data: PRISMA_CONFIG: | port: penis managementApiSecret: ${PRISMA_MANAGEMENT_API_SECRET}horse databases:"

... only if k8s supports somethign special like docker does

and from my understanding you don't want to put secrets in the configmap.yml right?

@yolen I have seen the cli suggesting me to define management secret

you are right but at some stages if you store the e.g. prisma_secret in a k8s secret you need to add it to the PRISMA_CONFIG string unless there are other ways as @Harshit suggests

Probably if this is adds reading some default from env can help

exactly

mm yeah, for my case I don't store the secrets in a special way, they're just variables that get replaced. If you would want that, that's more difficult I guess

But not everyone uses terraform

So what "we" need is to replace PRISMA_CONFIG with environment variables such as DB_DEFAULT_CONNECTOR etc

I guess that way we can use config maps

yes 🙂

Yeah, more clear env vars would be better than PRISMA_CONFIG. I saw a discussion about it somewhere on the forum

Now only Kelsey Hightower can help us 😂😂

yaml is probably more "flexible", but it makes things more difficult

I still do not understand why it works for me when m,y ports are obviously wrong? Did i unintentionally use names for my env vars that are the same as undocumented ones used by prisma? e.g. I define PRISMA_HOST_PORT

😂

I actuallytrie to run with helm but I paused it because I could not see any real benefit 🙂 and I was worried about tiller to be installed etc.

Ya that would be good I guess

thanks for the link. I looked at thishttps://github.com/akoenig/helm-prisma

Ya always look helm chart repo before sending

i go helmy then