Configure Redfish Secrets

Configure Redfish credentials for the ZAPP Redfish listener.
Categories:
Tags:

Redfish endpoints and credentials should come from Kubernetes Secrets. The listener reads secret files and expands ${secrets.<name>} references before it parses the pipeline YAML.

Secret keys

The default Redfish listener values use these keys:

redfish_endpoint
redfish_username
redfish_password

The pipeline references them like this:

redfishDevices:
  - endpoint: ${secrets.redfish_endpoint}
    username: ${secrets.redfish_username}
    password: ${secrets.redfish_password}

Use an existing Secret

Use existingSecret when another system manages the Secret.

zapp:
  listeners:
    - name: redfish
      secrets:
        - name: redfish-credentials
          existingSecret: redfish-credentials
          mountPath: /secrets/redfish

The Secret must contain a key named redfish-credentials. The value should be dotenv-style content:

redfish_endpoint=https://bmc.example.com
redfish_username=<username>
redfish_password=<password>

Let the chart create the Secret

For local testing, the chart can create the Secret from values.

zapp:
  listeners:
    - name: redfish
      secrets:
        - name: redfish-credentials
          existingSecret: ""
          mountPath: /secrets/redfish
          data:
            redfish_endpoint: "https://bmc.example.com"
            redfish_username: "admin"
            redfish_password: "admin"

Do not store production credentials in values files that are committed to source control.

Multiple BMCs

To collect from more than one baseboard management controller (BMC), add more entries to redfishDevices and provide matching secret keys.

envPlugins:
  sensorPipeline:
    redfishDevices:
      - endpoint: ${secrets.redfish_endpoint}
        username: ${secrets.redfish_username}
        password: ${secrets.redfish_password}
      - endpoint: ${secrets.redfish_endpoint_2}
        username: ${secrets.redfish_username_2}
        password: ${secrets.redfish_password_2}

Keep the secret file and the pipeline keys in sync. A missing key prevents configuration expansion.