security: implement Kubernetes Secrets for sensitive environment variables

- Remove OPENAI_API_KEY from values.yaml to prevent secrets in git
- Add Secret template for secure credential management
- Update deployment to use secretKeyRef for API key injection
- Add comprehensive README with security best practices
- Maintain backward compatibility with optional secret creation
- Eliminate security vulnerability of plaintext secrets in version control

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: root

helm/chat-service/README.md

@@ -0,0 +1,91 @@
+# Chat Service Helm Chart
+
+This Helm chart deploys the chat-service microservice with production-ready configurations.
+
+## Prerequisites
+
+Before installing this chart, you must create the required Kubernetes secret:
+
+```bash
+# Create the secret with your actual API key
+kubectl create secret generic chat-service-secrets \
+  --from-literal=OPENAI_API_KEY=your-actual-api-key-here \
+  --namespace omnipdf
+
+# Or create from a file (more secure)
+echo -n 'your-actual-api-key-here' > /tmp/api-key
+kubectl create secret generic chat-service-secrets \
+  --from-file=OPENAI_API_KEY=/tmp/api-key \
+  --namespace omnipdf
+rm /tmp/api-key
+```
+
+## Installation
+
+```bash
+# Install using Makefile
+make install CHART_NAME=chat-service
+
+# Or install directly with Helm
+helm upgrade --install chat-service . \
+  --namespace omnipdf \
+  --create-namespace
+```
+
+## Security
+
+- **Secrets**: API keys are stored in Kubernetes Secrets, not in values.yaml
+- **Non-root**: Container runs as user 65534 (nobody)
+- **Read-only filesystem**: Container filesystem is read-only
+- **Dropped capabilities**: All Linux capabilities are dropped
+- **Resource limits**: CPU and memory limits are enforced
+
+## Configuration
+
+Key configuration options in `values.yaml`:
+
+```yaml
+# Scaling
+replicaCount: 2
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+
+# Resources
+resources:
+  limits:
+    cpu: 200m
+    memory: 256Mi
+  requests:
+    cpu: 50m
+    memory: 64Mi
+
+# Image
+image:
+  repository: ghcr.io/notyusheng/chat-service
+  pullPolicy: Never  # For offline environments
+```
+
+## Monitoring
+
+The service exposes a `/health` endpoint on port 8000 for health checks.
+
+## Troubleshooting
+
+**Secret not found error:**
+```bash
+# Check if secret exists
+kubectl get secret chat-service-secrets -n omnipdf
+
+# Create the secret if missing (see Prerequisites above)
+```
+
+**Image pull errors with pullPolicy: Never:**
+```bash
+# Ensure image exists locally
+docker images | grep chat-service
+
+# Pull and tag image if needed
+docker pull ghcr.io/notyusheng/chat-service:dev-v0.0.0-6653136
+```

helm/chat-service/templates/deployment.yaml

@@ -50,10 +50,16 @@ spec:
             {{- toYaml .Values.readinessProbe | nindent 12 }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.env }}
           env:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
+            {{- range .Values.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+            - name: OPENAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.name }}
+                  key: OPENAI_API_KEY
           {{- with .Values.volumeMounts }}
           volumeMounts:
             {{- toYaml . | nindent 12 }}

helm/chat-service/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.secrets.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secrets.name }}
+  labels:
+    {{- include "chat-service.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secrets.data }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+  {{- end }}
+{{- end }}

helm/chat-service/values.yaml

@@ -135,10 +135,15 @@ affinity: {}
 env:
   - name: OPENAI_BASE_URL
     value: http://webworkdgx/vllm_qwen2.5/v1
-  - name: OPENAI_API_KEY
-    value: lm-studio
   - name: OPENAI_MODEL
     value: qwen2.5-0.5b-instruct
 
+# Secret configuration for sensitive values
+secrets:
+  # Set to true to create secret from values, false to use existing secret
+  create: false
+  # Name of the secret to reference (must exist if create=false)
+  name: chat-service-secrets
+
 #istio:
 #  enabled: true