Skip to content

fix: inject Elasticsearch credentials into the deploy-search job - #63

Open
YDKK wants to merge 1 commit into
mastodon:mainfrom
YDKK:main
Open

fix: inject Elasticsearch credentials into the deploy-search job#63
YDKK wants to merge 1 commit into
mastodon:mainfrom
YDKK:main

Conversation

@YDKK

@YDKK YDKK commented Jul 13, 2026

Copy link
Copy Markdown

What

The deploy-search hook Job (templates/job-deploy-search.yaml) is missing the mastodon.secrets.elasticsearch env include, so ES_USER / ES_PASS are never passed to the tootctl search deploy container.

Why

When Elasticsearch requires authentication (e.g. an ECK-managed cluster with a file realm, or any cluster with security enabled), the job fails:

[401] {"error":{"root_cause":[{"type":"security_exception", "reason":"missing authentication credentials for REST request [/chewy_specifications/_alias]"...}

The web and sidekiq deployments already include mastodon.secrets.elasticsearch; the deploy-search job was simply overlooked.
This affects current releases including 1.0.3.

Change

  • Add {{- include "mastodon.secrets.elasticsearch" . | nindent 12 }} to the job env (placed alongside the other secret includes).

Testing

helm template with mastodon.hooks.deploySearch.enabled=true, elasticsearch.enabled=true and an elasticsearch.existingSecret now renders ES_USER / ES_PASS (secretKeyRef) in the deploy-search Job, matching the web/sidekiq deployments.

Fixes 401 missing authentication credentials when running `tootctl search deploy` against an auth-enabled ES cluster.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant