# Helm chart values

What the collector's Helm chart owns, and the values it takes for your configuration and secrets.

## The chart models nothing about your database

You supply a complete `collector.toml` and the chart writes it to a ConfigMap verbatim, mounted at
`/etc/dbg-collector/collector.toml`.  The chart owns the image, the pod spec, the ServiceAccount and
secret injection, and nothing else.  Anything under `config:` other than `inline` is rejected at install
rather than quietly ignored.

| Value | What it holds |
|---|---|
| `config.inline` | Your complete `collector.toml`, written verbatim to a ConfigMap. |
| `secrets.serverSecret` | The real value of the DBGorilla client secret.  The chart puts it in a Secret. |
| `secrets.databasePasswords` | The values for the database passwords your `collector.toml` references with `{ env = "…" }`. |

:::danger[Never leave the secret inline in `config.inline`]

`config.inline` renders into a **ConfigMap**, which is readable by anything that can `get configmap`
in that namespace.

If your `collector.toml` has the secret written in as a literal, replace it with an environment
reference before using it with this chart:

```toml
secret = { env = "DBG_SERVER_SECRET" }
```

and pass the real value through `secrets.serverSecret`, which the chart puts in a Secret.  The same
applies to every database password: reference `{ env = "…" }` and supply the values under
`secrets.databasePasswords`.
:::