Kalix secret show as undefined

Hi,

I’m migrating a specific microservice from Akka serverless to Kalix. When testing locally (development) everything works fine.

When I deploy I make use of secrets to set certain variables. When the deployment is done it seems in the dashboard that the secrets actual values (secret value) are undefined (Below and example how it looks like in the dasboard).

SERVICE_DB_PASSWORD=undefined
SERVICE_DB_URL=undefined
SERVICE_DB_USER=undefined

While in the Akka serverless console it does show that it is linked to a secret;

SERVICE_DB_URL=**Secret from service-secrets/SERVICE_DB_URL**

I’ve used the Kalix CLI and migrated all the commands to create the secrets and deploy the service to also use the Kalix CLI. I’ve pasted the commands used below (stripping senstive information)

kalix secret create generic service-secrets --literal SERVICE_DB_URL=jdbc:postgresql://111.111.111.111:5432/database,SERVICE_DB_USER=user,SERVICE_DB_PASSWORD=password

and then the deployment script;

kalix services deploy service eu.gcr.io/project/project-service:0.0.2-SNAPSHOT --secret-env SERVICE_DB_URL=service-secrets/SERVICE_DB_URL,SERVICE_DB_USER=service-secrets/SERVICE_DB_USER,SERVICE_DB_PASSWORD=service-secrets/SERVICE_DB_PASSWORD,SERVICE_USER_FUNCTION_PORT=service-secrets/SERVICE_USER_FUNCTION_PORT

The log files in the service also indicate that the database in this case isnt reachable, while for the deployment period i’ve enabled all connections to be allowed (so we can determine which IP’s we need to whitelist, linked to Google cloud SQL connection)

am I making a blatant mistake here or has something changed drasticly in how the secrets are fetched/parsed?

Thanks in advance

Hi Gilles,

I hope you’re doing well and thanks for your interest in Kalix.
I checked you service and it looks like it the secrets were deployed as METER_SERVICE_DB_* instead of SERVICE_DB_*. At least that’s what I see in your config:

kubectl -n <REDACTED PROJECT_ID> get kalixservice meter-service -o json | jq -r '.spec.containers[].env[].name'
METER_SERVICE_DB_PASSWORD
METER_SERVICE_USER_FUNCTION_PORT
METER_SERVICE_DB_URL
METER_SERVICE_DB_USER

I also tested deploying a service copying and pasting the commands you posted (just changed the service name to one I have for testing) and I got the right var names:

kubectl -n <REDACTED PROJECT_ID> get kalixservice shopping-cart -o json | jq -r '.spec.containers[].env[].name'
SERVICE_DB_URL
SERVICE_DB_USER
SERVICE_DB_PASSWORD
SERVICE_USER_FUNCTION_PORT

Best regards,
Fernando

Hi Gilles,

Just following up. One of our engineers took a deeper look and found two bugs in our new UI regarding how we display secrets. The fixes are in Progress and should be out in the next few days.

Best,
Fernando

1 Like

Hi Fernando,

Yes correct i’ve made it so that the naming was generic for the topic :slight_smile:

Well the issue wasn’t really that the secrets aren’t deployed, it seemed that the container did not have the actual secret values, the undefined in the UI confused me, the underlying issue was that i had misspelled a environment variable :see_no_evil: .

My apologies.

Kind regards,
Gilles