Skip to main content
Thoras needs a handful of credentials to run: an internal API token, the dashboard login, and the bundled database password. You don’t have to provide any of them. On first install, Thoras generates whatever you didn’t supply and stores it in the thoras-config-controller Secret in the release namespace. If a credential later changes, Thoras restarts the components that use it so you don’t have to.
On a fresh install, workload pods briefly report CreateContainerConfigError while Thoras performs its first reconcile. This clears on its own.

​
Supplying your own credentials

Each credential resolves in this order of precedence:
  1. A Secret you manage, referenced via *.existingSecret or *SecretRef* values.
  2. A value pinned in values.yaml.
  3. Generated by Thoras into the thoras-config-controller Secret (default).
For example, to point the internal API token at your own Secret:
The Helm chart README lists every credential and the values keys that back it. See Secrets for the full table.

​
Rotating a credential

Generated values are not intended to be rotated in place. To control rotation, take ownership of the value by pinning it in values.yaml or by pointing the chart at a Secret you manage.
  • Existing Secret: update the value in your Secret. Thoras picks up the change within about a minute.
  • Pinned value: change it in values.yaml and run helm upgrade.
Two caveats:
  • Rotating the dashboard cookie secret signs every active dashboard session out.
  • The bundled TimescaleDB password has no rotation path. Use external TimescaleDB if you need to rotate the database password.
For the exact rotation semantics under GitOps, see Rotating secrets in the chart README.

​
Legacy secret seeding

featureFlags.enableLegacySecretSeeding (default true) keeps rendering the chart 4.x api-client-secret and thoras-timescale-password Secrets so their values can be migrated on upgrade. Nothing consumes them afterwards.
  • Fresh installs: set it to false.
  • Upgrading from 4.x: leave it on for the upgrade, then set it to false once the pods are healthy.
  • GitOps and helm template: set it to false. The legacy Secrets use Helm lookup, which those workflows cannot evaluate.
The flag and the legacy Secrets are removed in chart 6.0. See Deprecations.

​
Further reading