From 9266aaa88e33fa725fff5573648a81ece92028ba Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 15 Jun 2026 13:25:06 -0700 Subject: [PATCH] security.toml: document WEED_ env override for jwt signing keys (#9981) security.toml: document WEED_ env override for the jwt signing keys These keys are HMAC secrets; spell out the env-var mapping so they can be injected from a secret store instead of living in the config file. --- weed/command/scaffold/security.toml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/weed/command/scaffold/security.toml b/weed/command/scaffold/security.toml index 860412dcd..1d9832bc5 100644 --- a/weed/command/scaffold/security.toml +++ b/weed/command/scaffold/security.toml @@ -4,7 +4,16 @@ # /etc/seaweedfs/security.toml # this file is read by master, volume server, filer, and worker -# comma separated origins allowed to make requests to the filer and s3 gateway. +# Any value below can also be supplied as an environment variable instead of +# living in this file: prefix the key with WEED_, upper-case it, and replace +# "." with "_". This is the recommended way to inject the secrets in here from +# a Kubernetes Secret (env valueFrom.secretKeyRef) rather than a ConfigMap. +# The JWT signing keys map to: +# WEED_JWT_SIGNING_KEY, WEED_JWT_SIGNING_READ_KEY (master <-> volume) +# WEED_JWT_FILER_SIGNING_KEY, WEED_JWT_FILER_SIGNING_READ_KEY (s3/clients <-> filer) +# A set env var wins over the file, so the file can stay empty (or absent). + +# comma separated origins allowed to make requests to the filer and s3 gateway. # enter in this format: https://domain.com, or http://localhost:port [cors.allowed_origins] values = "*"