From e6a7def8d9b32e1a3ff54723c99ce7b20444aa1a Mon Sep 17 00:00:00 2001 From: Gagan Trivedi Date: Fri, 16 Oct 2026 10:04:31 +0530 Subject: [PATCH 1/2] docs(experimentation): Document WAREHOUSE_CREDENTIALS_SECRET and its chart secret --- .../core-configuration/environment-variables.md | 3 +++ .../hosting-guides/kubernetes-openshift.md | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md b/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md index f87dd5f94f89..c72e96d01264 100644 --- a/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md +++ b/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md @@ -49,6 +49,9 @@ relevant section below for more details. - `INFLUXDB_ORG`: The organisation string for your InfluxDB API call. - `EXPERIMENTATION_ENABLED`: Set to `true` once the experimentation infra is deployed. Experiments and warehouse connections stay unavailable until it is. Defaults to `false`. +- `WAREHOUSE_CREDENTIALS_SECRET`: Secret used to encrypt warehouse connection credentials. Warehouse delivery must use + the same value. Changing it makes saved credentials unreadable. Defaults to `DJANGO_SECRET_KEY`; set your own so the + Django secret key isn't shared with warehouse delivery. - `GA_TABLE_ID`: GA table ID (view) to query when looking for organisation usage. - `USER_CREATE_PERMISSIONS`: Set the permissions for creating new users, using a comma-separated list of djoser or rest_framework permissions. Use this to turn off public user creation for self-hosting. e.g. diff --git a/docs/docs/deployment-self-hosting/hosting-guides/kubernetes-openshift.md b/docs/docs/deployment-self-hosting/hosting-guides/kubernetes-openshift.md index 7cf26da06bc4..a382e1c4c3ca 100644 --- a/docs/docs/deployment-self-hosting/hosting-guides/kubernetes-openshift.md +++ b/docs/docs/deployment-self-hosting/hosting-guides/kubernetes-openshift.md @@ -427,6 +427,11 @@ ingress: The Kafka password also has a `passwordFromExistingSecret` form. Use it in production. +The API encrypts warehouse connection credentials with a dedicated secret, and warehouse delivery decrypts them with it. +The chart generates it on install. To provide your own, use +`experimentation.warehouseCredentialsSecretFromExistingSecret`. Changing it makes saved credentials unreadable, so they +must be entered again. + The topics are `flagsmith_warehouse_events` and `flagsmith_warehouse_events_retry`. Change them with `experimentation.kafka.topic` and `experimentation.kafka.retryTopic`. The Kafka login needs these permissions: From 7a7e72b48767d09b1712b290131a22f970bcfc49 Mon Sep 17 00:00:00 2001 From: Gagan Trivedi Date: Fri, 16 Oct 2026 10:14:44 +0530 Subject: [PATCH 2/2] docs(experimentation): Drop the WAREHOUSE_CREDENTIALS_SECRET default --- .../core-configuration/environment-variables.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md b/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md index c72e96d01264..25374a50dc60 100644 --- a/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md +++ b/docs/docs/deployment-self-hosting/core-configuration/environment-variables.md @@ -50,8 +50,7 @@ relevant section below for more details. - `EXPERIMENTATION_ENABLED`: Set to `true` once the experimentation infra is deployed. Experiments and warehouse connections stay unavailable until it is. Defaults to `false`. - `WAREHOUSE_CREDENTIALS_SECRET`: Secret used to encrypt warehouse connection credentials. Warehouse delivery must use - the same value. Changing it makes saved credentials unreadable. Defaults to `DJANGO_SECRET_KEY`; set your own so the - Django secret key isn't shared with warehouse delivery. + the same value. Changing it makes saved credentials unreadable. - `GA_TABLE_ID`: GA table ID (view) to query when looking for organisation usage. - `USER_CREATE_PERMISSIONS`: Set the permissions for creating new users, using a comma-separated list of djoser or rest_framework permissions. Use this to turn off public user creation for self-hosting. e.g.