Reference API key from a Kubernetes secret

[gjpin]

Hello!

While trying to reference a API key from a k8s secret, as mentioned in the README, helm fails to render the template and apply it.

secrets.yaml template is set to always create a k8s secret from the apiKey value.

Should the secret be created only if the apiKey value is set, like so?

{{- if not .Values.hyperdx.apiKey.valueFrom }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "hdx-oss.fullname" . }}-app-secrets
  labels:
    {{- include "hdx-oss.labels" . | nindent 4 }}
type: Opaque
data:
  api-key: {{ .Values.hyperdx.apiKey | b64enc }}
{{- end }}

Thank you

[srcreigh]

+1. The clickstack docs advertise the valueFrom method to set the API key now too. But it doesn't work.

https://clickhouse.com/docs/use-cases/observability/clickstack/deployment/helm#referencing-a-secret

{"level":"error","ts":"2026-01-04T18:50:55.911Z","msg":"Reconciler error","controller":"helmrelease","controllerGroup":"helm.toolkit.fluxcd.io","controllerKind":"HelmRelease","HelmRelease":{"name":"hyperdx","namespace":"hyperdx"},"namespace":"hyperdx","name":"hyperdx","reconcileID":"6e92fb57-0c91-4a21-be67-2fae8206a7ea","error":"template: clickstack/templates/secrets.yaml:9:39: executing "clickstack/templates/secrets.yaml" at : wrong type for value; expected string; got map[string]interface {}"}