feat: enhance log storage configuration with existing secret support

charts/portkey-app/docs/secret-manager-integration.md

@@ -157,6 +157,23 @@ spec:
             objectAlias: smtpPassword
           - path: smtpFrom
             objectAlias: smtpFrom
+      # Example for S3-compatible log storage. Adjust keys for your backend
+      # (mongo / s3_assume / azure). See the table at the bottom of this section.
+      - objectName: "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:myapp/portkey-log-storage"
+        objectType: "secretsmanager"
+        jmesPath:
+          - path: logStore
+            objectAlias: logStore
+          - path: logStoreAccessKey
+            objectAlias: logStoreAccessKey
+          - path: logStoreSecretKey
+            objectAlias: logStoreSecretKey
+          - path: logStoreRegion
+            objectAlias: logStoreRegion
+          - path: logStoreGenerationsBucket
+            objectAlias: logStoreGenerationsBucket
+          - path: logStoreBasePath
+            objectAlias: logStoreBasePath
   secretObjects:
     - secretName: portkey-mysql
       type: Opaque
@@ -230,6 +247,21 @@ spec:
           key: smtpPassword
         - objectName: smtpFrom
           key: smtpFrom
+    - secretName: portkey-log-storage
+      type: Opaque
+      data:
+        - objectName: logStore
+          key: logStore
+        - objectName: logStoreAccessKey
+          key: logStoreAccessKey
+        - objectName: logStoreSecretKey
+          key: logStoreSecretKey
+        - objectName: logStoreRegion
+          key: logStoreRegion
+        - objectName: logStoreGenerationsBucket
+          key: logStoreGenerationsBucket
+        - objectName: logStoreBasePath
+          key: logStoreBasePath
 ```
 
 Apply:
@@ -305,8 +337,29 @@ config:
     enabled: true
   smtp:
     enabled: true
+
+logStorage:
+  # Re-use an existing Kubernetes Secret instead of inlining credentials in values.
+  existingSecretName: "portkey-log-storage"
+  s3Compat:
+    enabled: true
 ```
 
+### Expected keys per log storage backend
+The Secret referenced by `logStorage.existingSecretName` must contain the keys
+for the backend you have enabled:
+
+| Backend     | Required keys                                                                                                                                                |
+| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `s3Compat`  | `logStore`, `logStoreAccessKey`, `logStoreSecretKey`, `logStoreRegion`, `logStoreGenerationsBucket`, `logStoreBasePath`                                       |
+| `s3Assume`  | `logStore`, `logStoreAccessKey`, `logStoreSecretKey`, `logStoreRegion`, `logStoreGenerationsBucket`, `logStoreAwsRoleArn`, `logStoreExternalId`                |
+| `mongo`     | `logStore`, `mongoConnectionUrl`, `mongoDatabase`, `mongoGenerationsCollection`, `mongoHooksCollection`                                                       |
+| `azure`     | `logStore`, `azureAuthMode`, `azureManagedClientId`, `azureStorageAccount`, `azureStorageKey`, `azureStorageContainer`                                        |
+
+The `logStore` key encodes the backend type (e.g. `s3_compat`, `s3_assume`,
+`mongo`, `azure`). `bedrockAssumed.*` credentials are unaffected by this
+setting and continue to live in the chart-managed gateway Secret.
+
 ## Option B: Mount-only (read from files; no Kubernetes Secrets sync)
 Create a `SecretProviderClass` without `secretObjects` (files only):
 ```yaml

charts/portkey-app/templates/_helpers.tpl

@@ -156,6 +156,18 @@ the user or some other secret provisioning mechanism
 {{- include "portkey.fullname" . }}-{{ .Values.gateway.name }}
 {{- end }}
 
+{{/*
+Name of the secret containing the log storage credentials. Falls back to the
+gateway secret when no existing secret is provided.
+*/}}
+{{- define "portkey.logStoreSecretsName" -}}
+{{- if .Values.logStorage.existingSecretName }}
+{{- .Values.logStorage.existingSecretName }}
+{{- else }}
+{{- include "portkey.gatewaySecretsName" . }}
+{{- end }}
+{{- end }}
+
 {{- define "portkey.gatewayClientAuth" -}}
 {{- .Values.config.defaultGatewayClientAuth | default "client_auth-PRIVATE_SEVICE" | quote }}
 {{- end }}
@@ -352,96 +364,96 @@ Template containing common environment variables that are used by several servic
 - name: LOG_STORE
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStore
 {{- if .Values.logStorage.mongo.enabled}}
 - name: MONGO_DB_CONNECTION_URL
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: mongoConnectionUrl
 - name: MONGO_DATABASE
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: mongoDatabase
 - name: MONGO_COLLECTION_NAME
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: mongoGenerationsCollection
 - name: MONGO_GENERATION_HOOKS_COLLECTION_NAME
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: mongoHooksCollection
 {{- end }}
 {{- if or .Values.logStorage.s3Compat.enabled }}
 - name: LOG_STORE_BASEPATH
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreBasePath
 {{- end }}      
 {{- if or .Values.logStorage.s3Compat.enabled .Values.logStorage.s3Assume.enabled }}
 - name: LOG_STORE_ACCESS_KEY
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreAccessKey
 - name: LOG_STORE_SECRET_KEY
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreSecretKey
 - name: LOG_STORE_REGION
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreRegion
 - name: LOG_STORE_GENERATIONS_BUCKET
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreGenerationsBucket
 {{- end }}
 {{- if .Values.logStorage.s3Assume.enabled }}
 - name: LOG_STORE_AWS_ROLE_ARN
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreAwsRoleArn
 - name: LOG_STORE_AWS_EXTERNAL_ID
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: logStoreExternalId
 {{- end }}
 {{- if .Values.logStorage.azure.enabled}}
 - name: AZURE_AUTH_MODE
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: azureAuthMode
 - name: AZURE_MANAGED_CLIENT_ID
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: azureManagedClientId
 - name: AZURE_STORAGE_ACCOUNT
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: azureStorageAccount
 - name: AZURE_STORAGE_KEY
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: azureStorageKey
 - name: AZURE_STORAGE_CONTAINER
   valueFrom:
     secretKeyRef:
-      name: {{ include "portkey.gatewaySecretsName" . }}
+      name: {{ include "portkey.logStoreSecretsName" . }}
       key: azureStorageContainer
 {{- end }}
 {{- end }}

charts/portkey-app/templates/gateway/secrets.yaml

@@ -8,6 +8,7 @@ metadata:
     {{- include "portkey.annotations" . | nindent 4 }}
 type: Opaque
 data:
+  {{- if not .Values.logStorage.existingSecretName }}
   {{- if .Values.logStorage.s3Compat.enabled}}
   logStore: {{ .Values.logStorage.logStore | b64enc | quote }}
   logStoreAccessKey: {{ .Values.logStorage.s3Compat.LOG_STORE_ACCESS_KEY | b64enc | quote }}
@@ -40,8 +41,9 @@ data:
   azureStorageKey: {{ .Values.logStorage.azure.AZURE_STORAGE_KEY | b64enc | quote }}
   azureStorageContainer: {{ .Values.logStorage.azure.AZURE_STORAGE_CONTAINER | b64enc | quote }}
   {{- end }}
+  {{- end }}
   {{- if .Values.bedrockAssumed.enabled}}
   bedrockAssumedAccessKey: {{ .Values.bedrockAssumed.AWS_ASSUME_ROLE_ACCESS_KEY_ID | b64enc | quote }}
   bedrockAssumedSecretKey: {{ .Values.bedrockAssumed.AWS_ASSUME_ROLE_SECRET_ACCESS_KEY | b64enc | quote }}
   bedrockAssumedRegion: {{ .Values.bedrockAssumed.AWS_ASSUME_ROLE_REGION | b64enc | quote }}
-  {{- end }}
+  {{- end }}

charts/portkey-app/values.yaml

@@ -118,6 +118,9 @@ config:
 # logStorage:
   # -- S3 specific configuration
 logStorage:
+  # -- Existing Kubernetes Secret to read log storage credentials from.
+  # See docs/secret-manager-integration.md for the required keys per backend.
+  existingSecretName: ""
   logStore: ""
   s3Compat:
     enabled: false