mirror of
https://github.com/Tencent/WeKnora.git
synced 2026-09-19 10:28:49 +08:00
wizardchen
b3898eb101
The Secret template defaulted both keys to randAlphaNum 32, which Helm re-rolls on every template render. As a result, any `helm upgrade` without explicit secrets.systemAesKey / secrets.tenantAesKey rotated the keys, breaking decryption of every previously encrypted field (tenants.api_key, model API keys, vector store credentials, web search provider keys, WeKnoraCloud.AppSecret) and surfacing "enc:v1:..." ciphertext in the UI. Use Helm's `lookup` to reuse the values stored in the existing Secret when one is already present, falling back to randAlphaNum only on first install. Also document the recovery caveat in values.yaml so operators understand the risk of relying on the auto-generated value.