Step 3: Create the secrets

Create the Kubernetes Secrets that hold your connection details, with one script, before you install the chart. The chart contains no passwords: each service reads its connection details from Secrets that you create in the namespace.

The commands on this page load their variables from openlm-install.env, the file you created from the installation worksheet.

Why the secrets aren't part of Helm

You create the secrets with kubectl, not Helm, on purpose. That way, helm uninstall or a failed upgrade can never delete your credentials, and you can rotate a password without touching the Helm release.

3.1 Save the script

Save the following block as create-openlm-secrets.sh next to your worksheet. You don't need to edit it: it reads everything from the worksheet.

#!/usr/bin/env bash
# create-openlm-secrets.sh: creates or updates every Secret the OpenLM Platform reads.
# Safe to run again: existing secrets are updated in place.
set -euo pipefail
: "${NS:?load openlm-install.env first}" "${SQL_HOST:?}" "${SQL_USER:?}" "${SQL_PASSWORD:?}" "${DB_PREFIX:?}"
: "${MONGO_URI:?}" "${KAFKA_BOOTSTRAP:?}" "${REDIS_HOST:?}" "${REDIS_PASSWORD:?}" "${HANGFIRE_PASSWORD:?}"

apply() { local name="$1"; shift
  kubectl -n "$NS" create secret generic "$name" "$@" --dry-run=client -o yaml | kubectl -n "$NS" apply -f - >/dev/null
  echo "  ok  $name"; }

# SQL Server. Connection strings carry the password BASE64-ENCODED (the services decode it).
# Split-field secrets carry it as plain text.
SQL_PASSWORD_B64="$(printf '%s' "$SQL_PASSWORD" | base64 | tr -d '\n')"
DS="$SQL_HOST"; [ "$SQL_PORT" != "1433" ] && DS="$SQL_HOST,$SQL_PORT"
TAIL="Min Pool Size=0;Max Pool Size=100;Encrypt=${SQL_ENCRYPT};TrustServerCertificate=True"
conn() { echo "Data Source=$DS;Initial Catalog=$1;User ID=$SQL_USER;Password=$SQL_PASSWORD_B64;$TAIL"; }

# Redis. With TLS the services need ssl=True in the connection string.
REDIS_CONN="$REDIS_HOST:$REDIS_PORT,password=$REDIS_PASSWORD,abortConnect=false"
[ "${REDIS_TLS:-false}" = "true" ] && REDIS_CONN="$REDIS_CONN,ssl=True"

echo "Creating secrets in namespace $NS ..."
apply openlm-generic-identity-db-credentials \
  --from-literal="IDENTITY_DATABASE_CONNECTIONSTRING=$(conn "${DB_PREFIX}_identity")" \
  --from-literal="ConnectionString=$(conn "${DB_PREFIX}_identity")"
apply openlm-generic-server-db-credentials \
  --from-literal="INFRASTRUCTURE__ServerConnectionStringTemplate=$(conn '{0}')"
apply openlm-generic-reporting-db-credentials \
  --from-literal="REPORTING_DATABASE_CONNECTIONSTRING=$(conn "${DB_PREFIX}_reporting")"
apply openlm-generic-reporting-mssql-credentials \
  --from-literal="HOST_NAME=$SQL_HOST" --from-literal="PORT=$SQL_PORT" \
  --from-literal="USERNAME=$SQL_USER" --from-literal="PASSWORD=$SQL_PASSWORD"
apply openlm-dss-db-credentials \
  --from-literal="DbType=2" --from-literal="DbServer=$SQL_HOST" --from-literal="DbPort=$SQL_PORT" \
  --from-literal="DbName=${DB_PREFIX}_dss" --from-literal="DbUser=$SQL_USER" --from-literal="DbPassword=$SQL_PASSWORD_B64"

apply openlm-generic-mongo-db-credentials \
  --from-literal="MONGODB__CONNECTIONSTRING=$MONGO_URI" \
  --from-literal="MONGODB_CONNECTION=$MONGO_URI" --from-literal="MONGOURI=$MONGO_URI" --from-literal="MONGO_URI=$MONGO_URI"
apply openlm-generic-kafka-bootstrap-credentials \
  --from-literal="INFRASTRUCTURE__KAFKABOOTSTRAPSERVERS=$KAFKA_BOOTSTRAP"
apply openlm-generic-redis-connection-credentials \
  --from-literal="REDIS__CONNECTIONSTRING=$REDIS_CONN" \
  --from-literal="INFRASTRUCTURE__REDIS__CONNECTIONSTRING=$REDIS_CONN" \
  --from-literal="INFRASTRUCTURE__REDISCONNECTION=$REDIS_CONN" --from-literal="REDIS_CONNECTION=$REDIS_CONN"

# Sign-in to the background-job dashboard of the identity discovery service.
apply openlm-identitydiscovery-hangfire-credentials \
  --from-literal="Hangfire__Dashboard__Authorization__Username=admin" \
  --from-literal="Hangfire__Dashboard__Authorization__Password=$HANGFIRE_PASSWORD"

# Optional integrations. They must exist; leave them empty unless you use the integration.
apply openlm-auditservice-aws-credentials --from-literal=ACCESSKEY= --from-literal=SECRETKEY=
apply openlm-licensefilecomparator-aws-credentials \
  --from-literal=AWS_SQS_ACCESS_KEY= --from-literal=AWS_SQS_SECRET_ACCESS_KEY=
apply openlm-licensefilecomparator-servicenow-credentials \
  --from-literal=SERVICENOW_CLIENTID= --from-literal=SERVICENOW_CLIENTSECRET= \
  --from-literal=SERVICENOW_USERNAME= --from-literal=SERVICENOW_PASSWORD= --from-literal=SERVICENOW_INSTANCE_URL= \
  --from-literal=AWS_SQS_QUEUE_URL= --from-literal=AWS_SQS_REGION= \
  --from-literal=BROKERHUBAPI_DELAY_IN_MILLISECONDS=10000 --from-literal=BROKERHUBAPI_MAX_RETRY_COUNT=5 \
  --from-literal=AWS_SQS_MAX_MESSAGES=5 --from-literal=AWS_SQS_QUEUE_WORKER_COUNT=3 --from-literal=AWS_SQS_WAIT_TIME_SECONDS=10
for p in alertservice:ALERT_SERVICE identityservice:IDENTITY identityalignment:IDENTITYALIGNMENT; do
  args=(); for f in TYPE PROJECT_ID PRIVATE_KEY_ID PRIVATE_KEY CLIENT_MAIL CLIENT_ID AUTH_URI TOKEN_URI AUTH_PROVIDER_X509 CLIENT_x509; do
    args+=("--from-literal=${p#*:}__$f="); done
  apply "openlm-pushnotification-${p%%:*}-credentials" "${args[@]}"
done
apply openlm-sam-apikeys --from-literal=EXCHANGERATES__CURRENCYFREAKS__APIKEY= \
  --from-literal=EXCHANGERATES__FREECURRENCYAPI__APIKEY= --from-literal=EXCHANGERATES__OPENEXCHANGERATES__APIKEY=
echo "Done."

3.2 Run the script

source ./openlm-install.env
bash ./create-openlm-secrets.sh

Every line must say ok. If the script stops with load openlm-install.env first or a variable name, that variable is empty in your worksheet.

3.3 Add the TLS certificate

Store your certificate in a secret called openlm-lb-cert. The ingress serves it from there:

kubectl -n "$NS" create secret tls openlm-lb-cert --cert="$TLS_CERT_FILE" --key="$TLS_KEY_FILE"

Two points apply to the certificate:

• Certificate order: The certificate file must hold the server certificate first, then the intermediates. If your certificate comes from a private CA, add the root certificate at the end as well. TLS certificates explains why this matters for sign-in.
• OpenShift: The Routes use the router's certificate by default. Read OpenShift: certificates before this step.

Things that commonly go wrong

If a later step fails, find the symptom in this table:

Symptom later	Cause
Services log FormatException or Login failed for user	The SQL password in a connection string wasn't base64-encoded, or SQL_PASSWORD has a typo. The script handles the encoding. Don't edit connection strings by hand.
Pods stuck in CreateContainerConfigError	A secret a pod expects doesn't exist. Run the script again and check every line said ok.
Certain data jobs never write any data, with no error	MONGO_URI ends with /. Remove it and run the script again.

Check

kubectl -n "$NS" get secrets | grep -c "^openlm-"

It must print 17 (16 from the script plus openlm-lb-cert).

Changing a password later

Change the value in your worksheet, run the script again, then restart the OpenLM Platform pods so they read the new value: kubectl -n openlm rollout restart deployment. A pod reads Secrets only when it starts.