From 3224e1b786d8afbe745ee9ed4f5c67a08b0a4cf9 Mon Sep 17 00:00:00 2001 From: Thomas Chopitea Date: Mon, 31 Aug 2026 20:18:29 +0000 Subject: [PATCH 1/4] feat(yeti): consolidate agents secret configuration under .Values.agents --- charts/osdfir-infrastructure/Chart.lock | 6 +++--- charts/osdfir-infrastructure/Chart.yaml | 4 ++-- .../osdfir-infrastructure/charts/yeti/Chart.yaml | 2 +- .../charts/yeti/templates/_helpers.tpl | 8 +++++--- .../charts/yeti/templates/agents-statefulset.yaml | 5 +++-- .../osdfir-infrastructure/charts/yeti/values.yaml | 15 ++++++++------- 6 files changed, 22 insertions(+), 18 deletions(-) diff --git a/charts/osdfir-infrastructure/Chart.lock b/charts/osdfir-infrastructure/Chart.lock index 8ba882f8..e4f640b4 100644 --- a/charts/osdfir-infrastructure/Chart.lock +++ b/charts/osdfir-infrastructure/Chart.lock @@ -4,7 +4,7 @@ dependencies: version: 2.5.6 - name: yeti repository: file://charts/yeti - version: 2.6.0 + version: 2.7.0 - name: openrelik repository: file://charts/openrelik version: 2.4.2 @@ -14,5 +14,5 @@ dependencies: - name: hashr repository: file://charts/hashr version: 2.0.1 -digest: sha256:8fecf0dc21ff91e7e31bb3aeb8dc674dfe1626910cec03718e4cafec56889e7b -generated: "2026-08-31T14:24:01.276081487Z" +digest: sha256:d2cef67f8b863c638a70ecca2c2944b2823aefa1dba8d8cb1d47ce4d3e5972b1 +generated: "2026-08-31T20:18:14.07591851Z" diff --git a/charts/osdfir-infrastructure/Chart.yaml b/charts/osdfir-infrastructure/Chart.yaml index c816eb8e..8b5e7962 100644 --- a/charts/osdfir-infrastructure/Chart.yaml +++ b/charts/osdfir-infrastructure/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: osdfir-infrastructure -version: 2.12.0 +version: 2.13.0 description: A Helm chart for Open Source Digital Forensics Kubernetes deployments. keywords: - timesketch @@ -18,7 +18,7 @@ dependencies: - condition: global.yeti.enabled name: yeti repository: file://charts/yeti - version: 2.6.0 + version: 2.7.0 - condition: global.openrelik.enabled name: openrelik repository: file://charts/openrelik diff --git a/charts/osdfir-infrastructure/charts/yeti/Chart.yaml b/charts/osdfir-infrastructure/charts/yeti/Chart.yaml index 63047b5d..2b02f1da 100644 --- a/charts/osdfir-infrastructure/charts/yeti/Chart.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: yeti -version: 2.6.0 +version: 2.7.0 description: A Helm chart for Yeti Kubernetes deployments. keywords: - yeti diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl index 48406abb..81c5d368 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl +++ b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl @@ -31,11 +31,13 @@ Emits a non-empty string when true, so callers test it with `if`. */}} {{- define "yeti.agentsEnabled" -}} {{- if and .Values.agents .Values.agents.enabled -}} -{{- if and (not .Values.agents.googleApiKeySecret) (ne .Values.agents.llmProvider "ollama") -}} +{{- $googleSecret := .Values.agents.googleApiKeySecret -}} +{{- if and (not $googleSecret) (ne .Values.agents.llmProvider "ollama") -}} {{- fail (printf "\n\nagents.enabled is true but agents.googleApiKeySecret is not set.\nThe Yeti Agents service reads GOOGLE_API_KEY at startup and cannot run without it.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-google-api-secret \\\n --namespace %s --from-literal=google-api-key=$GOOGLE_API_KEY\n helm upgrade ... --set agents.googleApiKeySecret=yeti-google-api-secret\n\nAlternatively set agents.llmProvider=ollama to use a local model, or\nagents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} -{{- if not .Values.global.yeti.apiKeySecret -}} -{{- fail (printf "\n\nagents.enabled is true but global.yeti.apiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set global.yeti.apiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} +{{- $yetiSecret := .Values.agents.yetiApiKeySecret | default .Values.global.yeti.apiKeySecret -}} +{{- if not $yetiSecret -}} +{{- fail (printf "\n\nagents.enabled is true but no Yeti API key secret is configured (agents.yetiApiKeySecret or global.yeti.apiKeySecret).\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} true {{- end -}} diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml index a21bd5c8..0c655644 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml @@ -41,11 +41,12 @@ spec: {{- include "yeti.envs" . | nindent 12 }} - name: YETI_API_ROOT value: "http://{{ .Release.Name }}-yeti-api:8000" - {{- if .Values.global.yeti.apiKeySecret }} + {{- $yetiSecret := .Values.agents.yetiApiKeySecret | default .Values.global.yeti.apiKeySecret }} + {{- if $yetiSecret }} - name: YETI_API_KEY valueFrom: secretKeyRef: - name: {{ .Values.global.yeti.apiKeySecret | quote }} + name: {{ $yetiSecret | quote }} key: "yeti-api" {{- end }} {{- if .Values.agents.googleApiKeySecret }} diff --git a/charts/osdfir-infrastructure/charts/yeti/values.yaml b/charts/osdfir-infrastructure/charts/yeti/values.yaml index 6093afbc..9b27d4f5 100644 --- a/charts/osdfir-infrastructure/charts/yeti/values.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/values.yaml @@ -185,9 +185,9 @@ bloomcheck: ## agents: ## @param agents.enabled Whether to enable Yeti Agents microservice - ## Enabling this requires agents.googleApiKeySecret (or llmProvider "ollama") - ## and global.yeti.apiKeySecret. The install fails with instructions if either - ## is missing, rather than deploying a service that cannot answer. + ## Enabling this requires a Google API key for Gemini (agents.googleApiKeySecret) + ## and Yeti API credentials (agents.yetiApiKeySecret or global.yeti.apiKeySecret). + ## The install fails with instructions if either is missing. ## enabled: false image: @@ -200,14 +200,15 @@ agents: ## @param agents.image.pullPolicy ## pullPolicy: IfNotPresent + ## @param agents.yetiApiKeySecret Existing secret containing the Yeti API key (key: "yeti-api"). + ## Defaults to global.yeti.apiKeySecret if set. + ## (e.g. kubectl create secret generic yeti-api-secret --from-literal=yeti-api=${YETI_API_KEY}) + ## + yetiApiKeySecret: "" ## @param agents.googleApiKeySecret Existing secret containing the Google API key for Gemini. ## Required when agents.llmProvider is "gemini". ## (e.g. kubectl create secret generic yeti-google-api-secret --from-literal=google-api-key=${GOOGLE_API_KEY}) ## - ## The agents workload is only deployed once it can actually run, which also - ## requires global.yeti.apiKeySecret: the agents reach Yeti over its API, and - ## without those credentials they start but every tool call fails. - ## googleApiKeySecret: "" ## @param agents.llmProvider LLM backend for the agents service ("gemini" or "ollama") ## From 9b120920ae4f2f5d8f864cf8afeddfac5fbf53c0 Mon Sep 17 00:00:00 2001 From: Thomas Chopitea Date: Mon, 31 Aug 2026 20:20:31 +0000 Subject: [PATCH 2/4] feat(yeti): set image pullPolicy Always for bloomcheck and agents --- .../charts/yeti/templates/bloomcheck-statefulset.yaml | 2 +- charts/osdfir-infrastructure/charts/yeti/values.yaml | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml index 32c0a720..df20a223 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml @@ -24,7 +24,7 @@ spec: containers: - name: bloomcheck image: "{{ .Values.bloomcheck.image.repository }}:{{ .Values.bloomcheck.image.tag }}" - imagePullPolicy: {{ .Values.config.imagePullPolicy }} + imagePullPolicy: {{ .Values.bloomcheck.image.pullPolicy | default .Values.config.imagePullPolicy }} command: ["/bin/sh", "-c"] args: - | diff --git a/charts/osdfir-infrastructure/charts/yeti/values.yaml b/charts/osdfir-infrastructure/charts/yeti/values.yaml index 9b27d4f5..d94a6abf 100644 --- a/charts/osdfir-infrastructure/charts/yeti/values.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/values.yaml @@ -163,6 +163,9 @@ bloomcheck: ## @param bloomcheck.image.tag Overrides the image tag whose default is the chart appVersion ## tag: dev + ## @param bloomcheck.image.pullPolicy + ## + pullPolicy: Always ## Yeti bloomcheck resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## @param bloomcheck.resources.limits Resource limits for the bloomcheck container @@ -199,7 +202,7 @@ agents: tag: dev ## @param agents.image.pullPolicy ## - pullPolicy: IfNotPresent + pullPolicy: Always ## @param agents.yetiApiKeySecret Existing secret containing the Yeti API key (key: "yeti-api"). ## Defaults to global.yeti.apiKeySecret if set. ## (e.g. kubectl create secret generic yeti-api-secret --from-literal=yeti-api=${YETI_API_KEY}) From 3bdae3b8849b329fbcae24670f73604ebef8ffe8 Mon Sep 17 00:00:00 2001 From: Thomas Chopitea Date: Mon, 31 Aug 2026 20:57:24 +0000 Subject: [PATCH 3/4] style(yeti): remove local template variable assignments to match chart conventions --- .../charts/yeti/templates/_helpers.tpl | 6 ++---- .../charts/yeti/templates/agents-statefulset.yaml | 11 ++++++++--- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl index 81c5d368..25cb42aa 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl +++ b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl @@ -31,12 +31,10 @@ Emits a non-empty string when true, so callers test it with `if`. */}} {{- define "yeti.agentsEnabled" -}} {{- if and .Values.agents .Values.agents.enabled -}} -{{- $googleSecret := .Values.agents.googleApiKeySecret -}} -{{- if and (not $googleSecret) (ne .Values.agents.llmProvider "ollama") -}} +{{- if and (not .Values.agents.googleApiKeySecret) (ne .Values.agents.llmProvider "ollama") -}} {{- fail (printf "\n\nagents.enabled is true but agents.googleApiKeySecret is not set.\nThe Yeti Agents service reads GOOGLE_API_KEY at startup and cannot run without it.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-google-api-secret \\\n --namespace %s --from-literal=google-api-key=$GOOGLE_API_KEY\n helm upgrade ... --set agents.googleApiKeySecret=yeti-google-api-secret\n\nAlternatively set agents.llmProvider=ollama to use a local model, or\nagents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} -{{- $yetiSecret := .Values.agents.yetiApiKeySecret | default .Values.global.yeti.apiKeySecret -}} -{{- if not $yetiSecret -}} +{{- if and (not .Values.agents.yetiApiKeySecret) (not .Values.global.yeti.apiKeySecret) -}} {{- fail (printf "\n\nagents.enabled is true but no Yeti API key secret is configured (agents.yetiApiKeySecret or global.yeti.apiKeySecret).\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} true diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml index 0c655644..68393f34 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml @@ -41,12 +41,17 @@ spec: {{- include "yeti.envs" . | nindent 12 }} - name: YETI_API_ROOT value: "http://{{ .Release.Name }}-yeti-api:8000" - {{- $yetiSecret := .Values.agents.yetiApiKeySecret | default .Values.global.yeti.apiKeySecret }} - {{- if $yetiSecret }} + {{- if .Values.agents.yetiApiKeySecret }} - name: YETI_API_KEY valueFrom: secretKeyRef: - name: {{ $yetiSecret | quote }} + name: {{ .Values.agents.yetiApiKeySecret | quote }} + key: "yeti-api" + {{- else if .Values.global.yeti.apiKeySecret }} + - name: YETI_API_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.global.yeti.apiKeySecret | quote }} key: "yeti-api" {{- end }} {{- if .Values.agents.googleApiKeySecret }} From 779ddea004247ef76541b533ceed1a43cb7606a2 Mon Sep 17 00:00:00 2001 From: Thomas Chopitea Date: Mon, 31 Aug 2026 21:23:24 +0000 Subject: [PATCH 4/4] refactor(yeti): exclusively define YETI_API_KEY via agents.yetiApiKeySecret --- .../charts/yeti/templates/_helpers.tpl | 4 ++-- .../charts/yeti/templates/agents-statefulset.yaml | 6 ------ 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl index 25cb42aa..0d3a5f91 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl +++ b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl @@ -34,8 +34,8 @@ Emits a non-empty string when true, so callers test it with `if`. {{- if and (not .Values.agents.googleApiKeySecret) (ne .Values.agents.llmProvider "ollama") -}} {{- fail (printf "\n\nagents.enabled is true but agents.googleApiKeySecret is not set.\nThe Yeti Agents service reads GOOGLE_API_KEY at startup and cannot run without it.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-google-api-secret \\\n --namespace %s --from-literal=google-api-key=$GOOGLE_API_KEY\n helm upgrade ... --set agents.googleApiKeySecret=yeti-google-api-secret\n\nAlternatively set agents.llmProvider=ollama to use a local model, or\nagents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} -{{- if and (not .Values.agents.yetiApiKeySecret) (not .Values.global.yeti.apiKeySecret) -}} -{{- fail (printf "\n\nagents.enabled is true but no Yeti API key secret is configured (agents.yetiApiKeySecret or global.yeti.apiKeySecret).\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} +{{- if not .Values.agents.yetiApiKeySecret -}} +{{- fail (printf "\n\nagents.enabled is true but agents.yetiApiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} true {{- end -}} diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml index 68393f34..95fc33b9 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml @@ -47,12 +47,6 @@ spec: secretKeyRef: name: {{ .Values.agents.yetiApiKeySecret | quote }} key: "yeti-api" - {{- else if .Values.global.yeti.apiKeySecret }} - - name: YETI_API_KEY - valueFrom: - secretKeyRef: - name: {{ .Values.global.yeti.apiKeySecret | quote }} - key: "yeti-api" {{- end }} {{- if .Values.agents.googleApiKeySecret }} - name: GOOGLE_API_KEY