[docs] talm: encrypted user values and dry-run secret redaction#590
[docs] talm: encrypted user values and dry-run secret redaction#590Aleksei Sviridkin (lexfrei) wants to merge 2 commits into
Conversation
Add a talm.md section covering the encrypted-user-values workflow (values-secret.yaml -> talm.key encryption -> templateOptions.valueFiles -> in-template use) and how secrets are redacted across talm template, talm template -i, and talm apply --dry-run. Documents --show-secrets / --show-secrets-in-drift, the apply value-source flags, and the value-based-matching sharp edge. Signed-off-by: Aleksei Sviridkin <f@lex.la>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
More reviews will be available in 43 minutes and 26 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new section to the Talm documentation explaining how to handle encrypted user values and secret redaction. The feedback suggests formatting the YAML configuration using block style instead of flow style, maintaining American English spelling consistency (e.g., changing 'Behaviour' to 'Behavior' and 'honours' to 'honors'), and correcting a minor grammatical issue.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| **Step 3 — reference the encrypted file** from `Chart.yaml` by adding it to `templateOptions.valueFiles`, so both `talm template` and `talm apply` read it: | ||
|
|
||
| ```yaml | ||
| templateOptions: { valueFiles: ["values-secret.encrypted.yaml"] } |
There was a problem hiding this comment.
Using block style for YAML is generally preferred over flow style (JSON-like) in Kubernetes and Helm documentation as it is more readable and consistent with the rest of the examples in this guide.
| templateOptions: { valueFiles: ["values-secret.encrypted.yaml"] } | |
| templateOptions: | |
| valueFiles: | |
| - values-secret.encrypted.yaml |
There was a problem hiding this comment.
Switched to block style in edff884 — agreed, it reads better and matches the other examples in this guide.
|
|
||
| How secrets are handled across commands: | ||
|
|
||
| | Command | Behaviour | |
There was a problem hiding this comment.
The rest of the documentation primarily uses American English spelling (e.g., optimized, customizable, customization). Consider changing Behaviour to Behavior to maintain spelling consistency across the document.
There was a problem hiding this comment.
Fixed in edff884 (Behaviour → Behavior).
| | `talm template -i` (node file) | secret values are omitted entirely from the committed node file — the real value is re-rendered in memory only at apply, so no plaintext (or ciphertext) ever lands in `nodes/*.yaml`. | | ||
| | `talm apply --dry-run` | both diffs redact secrets: talm's structured drift preview AND the server-returned `Config diff:` block. `--show-secrets-in-drift` reveals them. | | ||
|
|
||
| The `--show-secrets-in-drift` flag governs every secret-bearing surface of the apply dry-run, covering both these user values and the Talos bootstrap material (`cluster.ca.key`, `machine.token`, encryption secrets, Wireguard keys, etc.). By default a dry-run never prints a CA private key or a user secret in cleartext. |
There was a problem hiding this comment.
Add a comma after By default to improve readability and grammatical correctness.
There was a problem hiding this comment.
Added the comma in edff884.
|
|
||
| The `--show-secrets-in-drift` flag governs every secret-bearing surface of the apply dry-run, covering both these user values and the Talos bootstrap material (`cluster.ca.key`, `machine.token`, encryption secrets, Wireguard keys, etc.). By default a dry-run never prints a CA private key or a user secret in cleartext. | ||
|
|
||
| `talm apply` honours the full set of value sources, matching `talm template`: `--values`, `--set`, `--set-string`, `--set-file`, `--set-json`, `--set-literal`, merged on top of the `templateOptions.*` defaults from `Chart.yaml`. This keeps `template` and `apply` rendering identically. |
There was a problem hiding this comment.
Consider changing honours to honors to remain consistent with the American English spelling used throughout the rest of the documentation.
There was a problem hiding this comment.
Fixed in edff884 (honours → honors).
Aleksei Sviridkin (lexfrei)
requested review from
Andrei Kvapil (kvaps) and
Timofei Larkin (lllamnyp)
as code owners
- block-style YAML for the templateOptions.valueFiles example - American English spelling (Behavior, honors) - comma after "By default" for readability Signed-off-by: Aleksei Sviridkin <f@lex.la>
1 participant
What
Adds a
2.4 Encrypted user values and secret redactionsection to thenexttalm install guide.Why
The talm encrypted-user-values feature — encrypted
values-secret.yamldecrypted in memory, honored at bothtalm templateandtalm apply, with secrets kept out of committed node files and CI logs — had no user-facing documentation. The new section covers the full workflow (create → encrypt → reference intemplateOptions.valueFiles→ use in templates) and how secrets are redacted acrosstalm template,talm template -i, andtalm apply --dry-run, including--show-secrets/--show-secrets-in-driftand the value-based-matching sharp edge.Notes
nextonly — the feature ships in talm v0.32.0; not backported to v1.0–v1.4 (older talm).