morpho-org · rguichard · Jul 21, 2026
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.35
+version: 0.1.36
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

@@ -34,10 +34,24 @@ curl --location 'http://localhost:4000/cache/evm/1?secret=YOUR-AUTH-SECRET' \
      --data '{"method":"eth_blockNumber","params":[],"id":1,"jsonrpc":"2.0"}'
 ```
 
-## Vault Config
+## Config Sources
 
-The eRPC chart reads non-secret config from `vault.configPath` and secret values
-from `vault.secretsPath`. Keep `vault.configPath` as a config template. Static
+The eRPC chart reads the non-secret config template from either:
+
+- a Kubernetes ConfigMap (key `erpc.yaml`) named by `vault.configMapName`
+  (preferred, PLA-2003: config lives in the repo and goes through PR review), or
+- Vault at `vault.configPath` when `vault.configMapName` is empty (legacy).
+
+Secret values always come from Vault at `vault.secretsPath`; only secrets
+(passwords, API keys) and feature flags belong there. When `vault.configMapName`
+is set, the ConfigMap must be created before the `vault-config-creator` job runs
+— in the prd environment chart, files under `config/*.yaml` are rendered into
+`<basename>-config` ConfigMaps as pre-install/pre-upgrade hooks with an earlier
+hook-weight/sync-wave than the job.
+
+## Vault Secrets
+
+Keep the config source (ConfigMap or `vault.configPath`) as a template. Static
 secret placeholders use `__SECRET_<KEY>__`; the API-key auth list can use the
 `__SECRET_API_KEY_STRATEGIES__` marker to generate one secret auth strategy for
 every `API_KEY_*=<value>` entry in `vault.secretsPath`. Generated auth IDs are
@@ -58,3 +72,14 @@ values.
 The Vault config job renders placeholders into a temporary `erpc.yaml`, validates
 that rendered config with `erpc validate`, then stores only the rendered file in
 the runtime Kubernetes Secret.
+
+### Migrating an instance from Vault config to ConfigMap
+
+1. Export the instance's config from Vault (`.Data.data.config` at its
+   `vault.configPath`) into `helm/environments/prd/erpc/config/<name>.yaml`.
+2. Replace any inline secret values (for example database or Redis passwords in
+   connection URIs) with `__SECRET_<KEY>__` placeholders, and add the matching
+   `KEY=VALUE` entries to `vault.secretsPath` in Vault **before** deploying —
+   the render job fails hard on unresolved placeholders.
+3. Set `vault.configMapName: "<name>-config"` on the instance's values and bump
+   the chart versions.
@@ -3,6 +3,8 @@
 {{- fail "vault.validationImage.repository and vault.validationImage.tag are required when vault.validationImage.enabled=true" }}
 {{- end }}
 {{- $useDedicatedValidator := $validationImage.enabled }}
+{{- $configMapName := .Values.vault.configMapName | default "" }}
+{{- $configTemplatePath := ternary "/erpc-config/erpc.yaml" "/vault/secrets/erpc-config" (ne $configMapName "") }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -22,15 +24,18 @@ spec:
         {{- include "erpc.selectorLabels" . | nindent 8 }}
         job: vault-config-creator
       annotations:
-        # Vault Agent annotations for config injection (on pod template)
+        # Vault Agent annotations for secrets (and, without configMapName,
+        # config) injection (on pod template)
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: {{ include "erpc.vaultCreatorServiceAccountName" . | quote }}
+        {{- if not $configMapName }}
         vault.hashicorp.com/agent-inject-secret-erpc-config: {{ .Values.vault.configPath | default "secret/data/erpc/config" | quote }}
-        vault.hashicorp.com/agent-inject-secret-erpc-secrets: {{ .Values.vault.secretsPath | default "secret/data/erpc/secrets" | quote }}
         vault.hashicorp.com/agent-inject-template-erpc-config: |
           {{`{{- with secret "`}}{{ .Values.vault.configPath | default "secret/data/erpc/config" }}{{`" -}}
           {{- .Data.data.config -}}
           {{- end }}`}}
+        {{- end }}
+        vault.hashicorp.com/agent-inject-secret-erpc-secrets: {{ .Values.vault.secretsPath | default "secret/data/erpc/secrets" | quote }}
         vault.hashicorp.com/agent-inject-template-erpc-secrets: |
           {{`{{- with secret "`}}{{ .Values.vault.secretsPath | default "secret/data/erpc/secrets" }}{{`" -}}
           {{- range $key, $value := .Data.data -}}
@@ -50,6 +55,11 @@ spec:
       volumes:
         - name: rendered-config
           emptyDir: {}
+        {{- if $configMapName }}
+        - name: erpc-config-template
+          configMap:
+            name: {{ $configMapName | quote }}
+        {{- end }}
         {{- if .Values.securityHardening.enabled }}
         - name: tmp
           emptyDir: {}
@@ -64,14 +74,21 @@ spec:
           imagePullPolicy: {{ .Values.vault.jobImage.pullPolicy }}
           resources:
             {{- toYaml .Values.vault.jobResources | nindent 12 }}
-          {{- if .Values.securityHardening.enabled }}
           env:
+            - name: CONFIG_TEMPLATE_PATH
+              value: {{ $configTemplatePath | quote }}
+            {{- if .Values.securityHardening.enabled }}
             - name: HOME
               value: /tmp
-          {{- end }}
+            {{- end }}
           volumeMounts:
             - name: rendered-config
               mountPath: /work
+            {{- if $configMapName }}
+            - name: erpc-config-template
+              mountPath: /erpc-config
+              readOnly: true
+            {{- end }}
             {{- if .Values.securityHardening.enabled }}
             - name: tmp
               mountPath: /tmp
@@ -85,18 +102,18 @@ spec:
                 set -o pipefail
               fi
 
-              echo "Rendering ERPC configuration from vault config and secrets..."
+              echo "Rendering ERPC configuration from config template $CONFIG_TEMPLATE_PATH and vault secrets..."
 
               timeout=60
               count=0
-              while { [ ! -f /vault/secrets/erpc-config ] || [ ! -f /vault/secrets/erpc-secrets ]; } && [ $count -lt $timeout ]; do
-                echo "Waiting for vault config and secrets files... ($count/$timeout)"
+              while { [ ! -f "$CONFIG_TEMPLATE_PATH" ] || [ ! -f /vault/secrets/erpc-secrets ]; } && [ $count -lt $timeout ]; do
+                echo "Waiting for config template and vault secrets files... ($count/$timeout)"
                 sleep 2
                 count=$((count + 2))
               done
 
-              if [ ! -f /vault/secrets/erpc-config ]; then
-                echo "ERROR: Vault config file not found after $timeout seconds"
+              if [ ! -f "$CONFIG_TEMPLATE_PATH" ]; then
+                echo "ERROR: Config template file $CONFIG_TEMPLATE_PATH not found after $timeout seconds"
                 exit 1
               fi
 
@@ -346,7 +363,7 @@ spec:
                     exit 1
                   }
                 }
-              ' /vault/secrets/erpc-config > "$tmp_rendered_config"
+              ' "$CONFIG_TEMPLATE_PATH" > "$tmp_rendered_config"
               mv "$tmp_rendered_config" "$rendered_config"
 
               echo "ERPC configuration rendered to $rendered_config"

@@ -8,6 +8,13 @@ vault:
   # Non-secret eRPC config template. Secret placeholders use __SECRET_<KEY>__;
   # the API-key auth list can be generated from __SECRET_API_KEY_STRATEGIES__.
   configPath: "secret/data/erpc/config"
+  # When set, the non-secret config template is read from this ConfigMap
+  # (key "erpc.yaml") instead of Vault's configPath. Secrets are still
+  # injected from secretsPath and substituted into __SECRET_<KEY>__
+  # placeholders. The ConfigMap must be created before the
+  # vault-config-creator job runs (pre-install/pre-upgrade hook with a
+  # lower hook-weight / earlier sync-wave than the job).
+  configMapName: ""
   # Dedicated secret-only entry shared by all eRPC config variants.
   secretsPath: "secret/data/erpc/secrets"
   jobImage:

@@ -1,19 +1,19 @@
 dependencies:
 - name: erpc
   repository: file://../../../charts/erpc
-  version: 0.1.35
+  version: 0.1.36
 - name: erpc
   repository: file://../../../charts/erpc
-  version: 0.1.35
+  version: 0.1.36
 - name: erpc
   repository: file://../../../charts/erpc
-  version: 0.1.35
+  version: 0.1.36
 - name: erpc
   repository: file://../../../charts/erpc
-  version: 0.1.35
+  version: 0.1.36
 - name: erpc
   repository: file://../../../charts/erpc
-  version: 0.1.35
+  version: 0.1.36
 - name: redis-ha
   repository: https://dandydeveloper.github.io/charts
   version: 4.35.2
@@ -29,5 +29,5 @@ dependencies:
 - name: prometheus-redis-exporter
   repository: https://prometheus-community.github.io/helm-charts
   version: 6.8.0
-digest: sha256:6f63ffe63edeae52172c50f6d1dd3ed8f12e964a7c8af088c49daeeb4f2a5cda
-generated: "2026-06-16T17:08:14.874547+02:00"
+digest: sha256:c0eab2e9c69ceeab79ea64c4154d2ec810eae54d0e0090cd39fffc953e08a00f
+generated: "2026-07-21T17:28:33.268154+02:00"
@@ -2,33 +2,33 @@ apiVersion: v2
 name: erpc-prd
 description: eRPC fault-tolerant EVM RPC proxy - Production Environment
 type: application
-version: 0.1.40
+version: 0.1.41
 appVersion: "latest"
 
 dependencies:
   - name: erpc
     repository: file://../../../charts/erpc
-    version: 0.1.35
+    version: 0.1.36
   - name: erpc
     alias: erpc-dev
     condition: erpc-dev.enabled
     repository: file://../../../charts/erpc
-    version: 0.1.35
+    version: 0.1.36
   - name: erpc
     alias: erpc-processing
     condition: erpc-processing.enabled
     repository: file://../../../charts/erpc
-    version: 0.1.35
+    version: 0.1.36
   - name: erpc
     alias: erpc-router
     condition: erpc-router.enabled
     repository: file://../../../charts/erpc
-    version: 0.1.35
+    version: 0.1.36
   - name: erpc
     alias: erpc-fallback
     condition: erpc-fallback.enabled
     repository: file://../../../charts/erpc
-    version: 0.1.35
+    version: 0.1.36
   - name: redis-ha
     version: "4.35.2"
     repository: "https://dandydeveloper.github.io/charts"