Conversation
The tablet readiness probe authenticates as a Fluss client, so on a SASL-enforced cluster it needs a credential. The only documented way to supply one is tablet.readinessProbe.healthCheckAuth, which the chart inlines into the StatefulSet's exec command, leaving the credential in plain text in the rendered manifest. The chart already has a Secret-backed route: a secrets.env entry named READINESS_HEALTH_CHECK_AUTH renders a secretKeyRef on both the tablet and coordinator containers, and the exec probe inherits the container environment, so readiness-check.sh reads it unchanged. Nothing pointed at it, and setting both forms let the inline export silently override the Secret. Document the Secret-backed route in values.yaml and the Helm deployment guide, including the DESCRIBE-on-cluster requirement for the probe principal when the authorizer is enabled, and reject the combination at render time instead of silently preferring the inline value.
This was referenced Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The tablet readiness probe authenticates as a Fluss client, so on a SASL-enforced
cluster it needs a credential. The only documented way to supply one is
tablet.readinessProbe.healthCheckAuth, which the chart inlines into theStatefulSet's exec command, leaving the credential in plain text in the rendered
manifest.
The chart already has a Secret-backed route that nothing pointed at: a
secrets.enventry named
READINESS_HEALTH_CHECK_AUTHrenders asecretKeyRefon both the tabletand coordinator containers, and the exec probe inherits the container environment, so
readiness-check.shreads it unchanged.helm/values.yamland the Helm deployment guide.DESCRIBEon the cluster resource when theauthorizer is enabled.
exportsilentlyoverrode the Secret-sourced value.
No template logic or Java changes; the probe and the check tool are untouched.
Related to #3926, which asks for the credential to be derived from
server.yamlandwould remove the need to supply one at all. This is the smaller, immediately available
step.
Test Plan
helm lint helmandhelm unittest helm: 150/150 pass.helm/tests/secrets_test.yamlasserts thesecretKeyRefenv entry ispresent on the tablet container and that the probe command does not export the
variable. Verified it fails if the probe always exports.
helm/tests/secrets_validate_test.yamlasserts the conflict is rejected.Verified it fails without the validation rule.
🤖 AI-assisted changes - reviewed by human developer
🤖 Generated with Claude Code