From 1dcb9304672d43adddde242dea8957ca744fca9d Mon Sep 17 00:00:00 2001
From: Vincent Farroco <ecniiv@pm.me>
Date: Tue, 9 Dec 2025 15:25:17 +0100
Subject: [PATCH] [feat] helm-charts: add support for secrets

---
 helm-charts/doris/templates/doriscluster.yaml | 17 ++++++++++-
 helm-charts/doris/values.yaml                 | 28 +++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/helm-charts/doris/templates/doriscluster.yaml b/helm-charts/doris/templates/doriscluster.yaml
index 4cec9a4b..4715f75f 100644
--- a/helm-charts/doris/templates/doriscluster.yaml
+++ b/helm-charts/doris/templates/doriscluster.yaml
@@ -116,6 +116,10 @@ spec:
     hostAliases:
     {{- toYaml .Values.feSpec.hostAliases | nindent 4 }}
     {{- end }}
+    {{- if .Values.feSpec.secrets }}
+    secrets:
+    {{- toYaml .Values.feSpec.secrets | nindent 4 }}
+    {{- end }}
     {{- if .Values.feSpec.persistentVolumeClaim }}
     persistentVolumes:
     {{- template "doriscluster.fe.pvc" . }}
@@ -201,6 +205,10 @@ spec:
     hostAliases:
     {{- toYaml .Values.beSpec.hostAliases | nindent 4 }}
     {{- end }}
+    {{- if .Values.beSpec.secrets }}
+    secrets:
+    {{- toYaml .Values.beSpec.secrets | nindent 4 }}
+    {{- end }}
     {{- if .Values.beSpec.persistentVolumeClaim }}
     persistentVolumes:
     {{- template "doriscluster.be.pvc" . }}
@@ -289,7 +297,10 @@ spec:
     hostAliases:
     {{- toYaml .Values.cnSpec.hostAliases | nindent 4 }}
     {{- end }}
-
+    {{- if .Values.cnSpec.secrets }}
+    secrets:
+    {{- toYaml .Values.cnSpec.secrets | nindent 4 }}
+    {{- end }}
     {{- if .Values.cnSpec.persistentVolumeClaim }}
     persistentVolumes:
     {{- template "doriscluster.cn.pvc" . }}
@@ -371,6 +382,10 @@ spec:
     hostAliases:
     {{- toYaml .Values.brokerSpec.hostAliases | nindent 4 }}
     {{- end }}
+    {{- if .Values.brokerSpec.secrets }}
+    secrets:
+    {{- toYaml .Values.brokerSpec.secrets | nindent 4 }}
+    {{- end }}
     {{- if .Values.brokerSpec.persistentVolumeClaim }}
     persistentVolumes:
     {{- template "doriscluster.broker.pvc" . }}
diff --git a/helm-charts/doris/values.yaml b/helm-charts/doris/values.yaml
index 420fd601..7b81fa21 100644
--- a/helm-charts/doris/values.yaml
+++ b/helm-charts/doris/values.yaml
@@ -202,6 +202,13 @@ feSpec:
   # - ip: "127.0.0.2"
   #   hostnames:
   #   - "hostname2"
+  
+  # secrets allows mounting Kubernetes secrets into the pods
+  # Each secret must have a secretName (name of the secret in Kubernetes) and optionally a mountPath
+  secrets: []
+  # - secretName: my-secret
+  #   mountPath: /etc/doris
+  
   persistentVolumeClaim: {}
     # meta volume, mountPath is /opt/apache-doris/fe/doris-meta
     # metaPersistentVolume:
@@ -369,6 +376,13 @@ beSpec:
   # - ip: "127.0.0.2"
   #   hostnames:
   #   - "hostname2"
+  
+  # secrets allows mounting Kubernetes secrets into the pods
+  # Each secret must have a secretName (name of the secret in Kubernetes) and optionally a mountPath
+  secrets: []
+  # - secretName: my-secret
+  #   mountPath: /etc/doris
+  
   persistentVolumeClaim: {}
     # data volume, mountPath is /opt/apache-doris/be/storage
     # dataPersistentVolume:
@@ -537,6 +551,13 @@ cnSpec:
   # - ip: "127.0.0.2"
   #   hostnames:
   #   - "hostname2"
+  
+  # secrets allows mounting Kubernetes secrets into the pods
+  # Each secret must have a secretName (name of the secret in Kubernetes) and optionally a mountPath
+  secrets: []
+  # - secretName: my-secret
+  #   mountPath: /etc/doris
+  
   persistentVolumeClaim: {}
     # data volume, mountPath is /opt/apache-doris/be/storage
     # dataPersistentVolume:
@@ -698,6 +719,13 @@ brokerSpec:
   # - ip: "127.0.0.2"
   #   hostnames:
   #   - "hostname2"
+  
+  # secrets allows mounting Kubernetes secrets into the pods
+  # Each secret must have a secretName (name of the secret in Kubernetes) and optionally a mountPath
+  secrets: []
+  # - secretName: my-secret
+  #   mountPath: /etc/doris
+  
   persistentVolumeClaim: {}
     # logs volume, mountPath is /opt/apache-doris/apache_hdfs_broker/log
     # logsPersistentVolume: