#Secrets

The controller needs three credentials from the GitHub App. They are read from a Kubernetes Secret with these keys:

The Helm chart mounts private-key at /github/private-key.pem and sets GITHUB_PRIVATE_KEY_PATH accordingly.

#Recommended: manage the Secret yourself

kubectl -n flux-system create secret generic github-deployment-bridge \
  --from-literal=app-id=123456 \
  --from-literal=installation-id=987654 \
  --from-file=private-key=./github-app.pem

Then install with github.existingSecret=github-deployment-bridge.

Rotating an existingSecret does not restart pods by itself (the chart cannot checksum an external Secret). After updating keys:

kubectl -n flux-system rollout restart deployment/github-deployment-bridge

Or use Reloader / a similar controller watching the Secret.

#Alternative: let Helm create the Secret

Pass values at install time and opt in with github.allowInsecureValues=true. Inline credentials are stored in the Helm release Secret (sh.helm.release.v1.*) as well as the chart-managed Secret - fine for local/dev; prefer an external Secret manager or sealed/SOPS secret in production:

helm upgrade --install github-deployment-bridge \
  oci://ghcr.io/roberteggl/charts/github-deployment-bridge \
  --version 1.3.3 \
  --namespace flux-system \
  --set github.allowInsecureValues=true \
  --set github.appId=123456 \
  --set github.installationId=987654 \
  --set-file github.privateKey=./github-app.pem \
  --set config.clusterName=production-eu \
  --set config.environment=production

Next: PVC · Install with Helm