berglas VS helm-charts

Secret Manager: secure storage for sensitive data e.g passwords.

Google Secret Manager

API keys are easy to "leak" or compromise, so best to not only use the restrictions presented to you when you create them but physically protect them as well. Don't code them in plain-text, don't check them into GitHub, etc. Store them in a secure database or use a service like GCP Secret Manager.

I've been looking at Google Secret Manager which sounds promising but I've not been able to find any examples or tutorials that help with the actual practical details of best practice or getting this working. I'm currently reading about Cloud Functions which also sound promising but again, I'm just going deeper and deeper into GCP without feeling like I'm gaining any useful insights.

In this post, I described how to build secure GitHub Actions workflows by pull_request_target event instead of pull_request event. Using pull_request_target, you can prevent malicious codes from being executed in CI. And by managing secrets in secrets management services such as AWS Secrets Manager and Google Secret Manager and access them via OIDC, you can restrict the access to secrets securely. To migrate pull_request to pull_request_target, several modifications are needed. And pull_request_target has a drawback that it's difficult to test changes of workflows, so it's good to introduce pull_request_target to repositories that require strong permissions in CI. For example, a Terraform Monorepo tends to require strong permissions for CI, so it's good to introduce pull_request_target to it.

If you want to make these secrets more secure and get versioning and access logs for them, you may want to switch to Secret Manager later on. They can still be exposed as environment variables to your code. It's a little more setup work, so start with the simple approach at the top.

https://cloud.google.com/secret-manager https://aws.amazon.com/secrets-manager/

Which helm Chart do you use? You should probably use this one https://github.com/grafana/helm-charts/tree/main/charts/loki-distributed

We were able to keep this config in Grafana UI but if the pod (K8S) is fail the details is deleted, we are using latest prom helm .

Grafana Labs in its Helm repository provides chart that can install Loki stack also with other complementary tools like Logstash or Prometheus.

Once you have this ready for your cluster install Grafana from Grafana helm chart from here

grafana/helm-charts/blob/main/charts/loki-stack/Chart.yaml

Using the helm chart values from values.yaml here https://github.com/grafana/helm-charts/blob/main/charts/grafana/values.yaml

Hey everyone! This is probably an easy question for those of you with experience. I’m using helm to install loki-stack and cannot figure out how to enable the query frontend with the Helm chart.

from: https://github.com/grafana/helm-charts/blob/ef1cd8a48ab000137df980227745d1eeefcfbefb/charts/promtail/values.yaml

helm3 upgrade --install grafana grafana --dry-run --repo https://grafana.github.io/helm-charts --wait Release "grafana" does not exist. Installing it now. Error: failed to download "https://github.com/grafana/helm-charts/releases/download/grafana-6.16.14/grafana-6.16.14.tgz"