From 3cc2248dc8af224c583d1e2a40c4304915ea0d08 Mon Sep 17 00:00:00 2001
From: darkobas <marko@datafund.io>
Date: Fri, 14 Aug 2026 01:15:24 +0200
Subject: [PATCH] feat(beekeeper): add extraEnv and envFrom support

The chart renders a fixed env list and offers no way to inject anything
else, so secrets have to be passed on the command line via
config.command. Anything passed that way is stored verbatim in the
Job/CronJob spec and is readable by anyone who can read those objects in
the namespace.

The node-funder deployments hit this directly: they pass a funding
wallet private key as --wallet-key.

Beekeeper already binds every flag to an environment variable (viper,
prefix "beekeeper", dashes replaced by underscores), so --wallet-key can
be supplied as BEEKEEPER_WALLET_KEY with no beekeeper change. This adds
the chart plumbing to do that:

  extraEnv:
    - name: BEEKEEPER_WALLET_KEY
      valueFrom:
        secretKeyRef:
          name: beekeeper-wallet-key
          key: walletKey

Both extraEnv and envFrom are applied to the CronJob container and to
both Job containers (init-ping and main), so the behaviour is the same
whichever mode is used.

Both default to empty and are wrapped in `with`, so a chart rendered
without them is byte-identical to before -- verified with helm template
on default values.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 charts/beekeeper/Chart.yaml             |  2 +-
 charts/beekeeper/templates/cronjob.yaml |  7 +++++++
 charts/beekeeper/templates/job.yaml     | 14 ++++++++++++++
 charts/beekeeper/values.yaml            | 24 ++++++++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/charts/beekeeper/Chart.yaml b/charts/beekeeper/Chart.yaml
index 8889dcc..932fd15 100644
--- a/charts/beekeeper/Chart.yaml
+++ b/charts/beekeeper/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 appVersion: latest
 name: beekeeper
-version: 0.4.13
+version: 0.4.14
 description: Ethereum Swarm Beekeeper Helm chart for Kubernetes
 home: https://www.ethswarm.org
 icon: https://docs.ethswarm.org/img/swarm-logo-2.svg
diff --git a/charts/beekeeper/templates/cronjob.yaml b/charts/beekeeper/templates/cronjob.yaml
index 180f0da..67fdbee 100644
--- a/charts/beekeeper/templates/cronjob.yaml
+++ b/charts/beekeeper/templates/cronjob.yaml
@@ -55,6 +55,13 @@ spec:
                   value: "{{ .Values.config.BZZ_TOKEN_ADDRESS }}"
                 - name: BEEKEEPER_ETH_ACCOUNT
                   value: "{{ .Values.config.ETH_ACCOUNT }}"
+                {{- with .Values.extraEnv }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
+              {{- with .Values.envFrom }}
+              envFrom:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
               command:
                 {{- range .Values.config.command }}
                 - {{ . }}
diff --git a/charts/beekeeper/templates/job.yaml b/charts/beekeeper/templates/job.yaml
index efd48f8..5354115 100644
--- a/charts/beekeeper/templates/job.yaml
+++ b/charts/beekeeper/templates/job.yaml
@@ -41,6 +41,13 @@ spec:
               value: "{{ .Values.config.BZZ_TOKEN_ADDRESS }}"
             - name: BEEKEEPER_ETH_ACCOUNT
               value: "{{ .Values.config.ETH_ACCOUNT }}"
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command:
             - sh
             - -c
@@ -72,6 +79,13 @@ spec:
               value: "{{ .Values.config.BZZ_TOKEN_ADDRESS }}"
             - name: BEEKEEPER_ETH_ACCOUNT
               value: "{{ .Values.config.ETH_ACCOUNT }}"
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command:
             {{- range .Values.config.command }}
             - {{ . }}
diff --git a/charts/beekeeper/values.yaml b/charts/beekeeper/values.yaml
index 15c9b42..c538da7 100644
--- a/charts/beekeeper/values.yaml
+++ b/charts/beekeeper/values.yaml
@@ -31,6 +31,30 @@ resources: {}
 
 nodeSelector: {}
 
+## Additional environment variables for the beekeeper container.
+## Use this to supply secrets rather than putting them in config.command,
+## where they end up readable in the Job/CronJob spec.
+##
+## Beekeeper reads any flag from the environment as BEEKEEPER_<FLAG>, with
+## dashes replaced by underscores, so --wallet-key can be provided as
+## BEEKEEPER_WALLET_KEY instead of being passed on the command line.
+##
+## Example:
+# extraEnv:
+#   - name: BEEKEEPER_WALLET_KEY
+#     valueFrom:
+#       secretKeyRef:
+#         name: beekeeper-wallet-key
+#         key: walletKey
+extraEnv: []
+
+## Populate environment variables from Secrets or ConfigMaps.
+## Example:
+# envFrom:
+#   - secretRef:
+#       name: beekeeper-wallet-key
+envFrom: []
+
 config:
   command: ["beekeeper", "check"]
   parallelism: 1