kerberos-io/helm-charts
1
0
Fork 0
mirror of https://github.com/kerberos-io/helm-charts.git synced 2026-08-23 15:18:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move MQTT and TURN credentials to hub-api for enhanced security

Browse Source
This commit is contained in:
Cédric Verstraeten
2026-05-26 06:50:39 +00:00
parent ea5705c03c
commit ca30ebfd3c
3 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
charts/hub/templates/kerberos-hub/hub-api.yaml
View File

@@ -194,6 +194,20 @@ spec:
value: "{{ .Values.kerberoshub.api.fallbackLanguage }}"
- name: API_KEY
value: "{{ .Values.kerberoshub.api.apiKey }}"
# MQTT credentials (served via /runtime/config to authenticated
# frontend clients; no longer exposed in the public env.js).
- name: MQTT_USERNAME
value: "{{ .Values.mqtt.username }}"
- name: MQTT_PASSWORD
value: "{{ .Values.mqtt.password }}"
# TURN credentials (served via /runtime/config to authenticated
# frontend clients; no longer exposed in the public env.js).
- name: TURN_USERNAME
value: "{{ .Values.turn.username }}"
- name: TURN_PASSWORD
value: "{{ .Values.turn.password }}"
{{- if .Values.kerberoshub.api.serverTLS.enabled }}
- name: TLS_CERT_FILE
value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"

14
charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml
View File

@@ -148,10 +148,9 @@ spec:
value: "{{ .Values.mqtt.host }}"
- name: MQTT_PORT
value: "{{ .Values.mqtt.port }}"
- name: MQTT_USERNAME
value: "{{ .Values.mqtt.username }}"
- name: MQTT_PASSWORD
value: "{{ .Values.mqtt.password }}"
# MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
# frontend. They are fetched from the authenticated hub-api endpoint
# /runtime/config after login. See hub-api deployment.
- name: MQTT_LEGACY_SERVER
value: "{{ .Values.mqtt.legacy.host }}"
- name: MQTT_LEGACY_PORT
@@ -164,10 +163,9 @@ spec:
# Turn (Pion)
- name: TURN_SERVER
value: "{{ .Values.turn.host }}"
- name: TURN_USERNAME
value: "{{ .Values.turn.username }}"
- name: TURN_PASSWORD
value: "{{ .Values.turn.password }}"
# TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
# frontend. They are fetched from the authenticated hub-api endpoint
# /runtime/config after login. See hub-api deployment.
# Mixpanel for monitoring
- name: MIXPANEL_KEY

14
charts/hub/templates/kerberos-hub/hub-frontend.yaml
View File

@@ -229,10 +229,9 @@ spec:
value: "{{ .Values.mqtt.host }}"
- name: MQTT_PORT
value: "{{ .Values.mqtt.port }}"
- name: MQTT_USERNAME
value: "{{ .Values.mqtt.username }}"
- name: MQTT_PASSWORD
value: "{{ .Values.mqtt.password }}"
# MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
# frontend. They are fetched from the authenticated hub-api endpoint
# /runtime/config after login. See hub-api deployment.
- name: MQTT_LEGACY_SERVER
value: "{{ .Values.mqtt.legacy.host }}"
- name: MQTT_LEGACY_PORT
@@ -245,10 +244,9 @@ spec:
# Turn (Pion)
- name: TURN_SERVER
value: "{{ .Values.turn.host }}"
- name: TURN_USERNAME
value: "{{ .Values.turn.username }}"
- name: TURN_PASSWORD
value: "{{ .Values.turn.password }}"
# TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
# frontend. They are fetched from the authenticated hub-api endpoint
# /runtime/config after login. See hub-api deployment.
# Mixpanel for monitoring
- name: MIXPANEL_KEY