Add support for mounting Alloy config from Kubernetes Secrets

[naptalie]

Summary

This enhancement addresses issue #443 by allowing users to mount Grafana Alloy configuration from Kubernetes Secrets instead of only from ConfigMaps. This provides better security for configurations containing sensitive credentials.

Changes

New Features

• Added alloy.secret configuration option in values.yaml with the following fields:
  • alloy.secret.create: Create a new Secret for the config file
  • alloy.secret.content: Content to assign to the Secret (supports templating via tpl)
  • alloy.secret.name: Name of existing Secret to use
  • alloy.secret.key: Key in Secret to get config from

Implementation Details

• Secret takes precedence over ConfigMap when both are configured
• ConfigMap is not created when using Secret (prevents resource duplication)
• Support for both creating new Secrets and referencing existing ones
• Added helper templates in _config.tpl for Secret name and key resolution
• Updated pod template to conditionally mount Secret or ConfigMap
• Added checksum annotation support for Secret content to trigger pod restarts on config changes

Testing

• Added CI test configuration for creating new Secret: custom-secret-config-values.yaml
• Added CI test configuration for using existing Secret: existing-secret-values.yaml
• All existing tests continue to pass with ConfigMap (backward compatible)

Documentation

• Updated README.md with new alloy.secret section
• Updated README.md.gotmpl template
• Added values table entries for all new secret configuration options
• Updated CHANGELOG.md

Backward Compatibility

The implementation maintains full backward compatibility with existing ConfigMap-based configurations. Users can continue using ConfigMaps without any changes.

Test Plan

1. Default behavior (ConfigMap) continues to work:

   helm template test . --values ci/default-values-values.yaml

2. New Secret creation works:

   helm template test . --values ci/custom-secret-config-values.yaml

3. Referencing existing Secret works:

   helm template test . --values ci/existing-secret-values.yaml

Usage Example

To use a Secret for your Alloy configuration:

alloy:
  secret:
    create: true
    content: |
      prometheus.remote_write "default" {
        endpoint {
          url = "https://prometheus.example.com/api/v1/write"
          basic_auth {
            username = "my-username"
            password = "my-secret-password"
          }
        }
      }

Or to reference an existing Secret:

alloy:
  secret:
    create: false
    name: my-existing-secret
    key: config.alloy

Fixes #443

🤖 Generated with Claude Code

Co-Authored-By: Claude [email protected]