++

apps/bi/base/backend.yaml

@@ -65,6 +65,7 @@ spec:
               - |
                 set -a
                 [ -f /vault/secrets/bi-db ] && . /vault/secrets/bi-db
+                [ -f /vault/secrets/bi-jwt ] && . /vault/secrets/bi-jwt
                 set +a
                 exec /opt/entrypoint.sh
 
@@ -162,12 +163,6 @@ spec:
             value:
               _default: "0"
 
-        secretEnvs:
-          - name: SUPERSET_JWT_SECRET
-            secretName:
-              _default: "superset-jwt-secret"
-            secretKey: "jwt_secret"
-
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
@@ -185,6 +180,11 @@ spec:
               DB_USERNAME={{ index .Data.data "username" }}
               DB_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-bi-jwt: secrets/data/vault/apps/bi
+            vault.hashicorp.com/agent-inject-template-bi-jwt: |-
+              {{- with secret "secrets/data/vault/apps/bi" -}}
+              SUPERSET_JWT_SECRET={{ index .Data.data "SUPERSET_JWT_SECRET" }}
+              {{- end -}}
 
         commitSha: ""
         gitlabUri: ""