From b042e712a32904006664e43c5bd865217326fc50 Mon Sep 17 00:00:00 2001
From: bryan hunt <bryan@livecircle.org>
Date: Fri, 12 Jun 2026 19:50:45 +0100
Subject: [PATCH 1/2] Add extraEnv and extraEnvFrom to livekit-server

Lets operators inject secrets (Redis password, API keys, etc.) via
secretKeyRef or envFrom without rendering them into the plaintext
ConfigMap. LiveKit substitutes ${VAR} in its YAML config at startup,
so values.yaml can reference these env vars instead of literals.
---
 livekit-server/templates/deployment.yaml |  7 +++++++
 livekit-server/values.yaml               | 16 ++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/livekit-server/templates/deployment.yaml b/livekit-server/templates/deployment.yaml
index 7b35cee..71015f2 100644
--- a/livekit-server/templates/deployment.yaml
+++ b/livekit-server/templates/deployment.yaml
@@ -60,6 +60,13 @@ spec:
             - name: LIVEKIT_TURN_KEY
               value: /etc/lkcert/tls.key
             {{- end }}
+            {{- with .Values.extraEnv }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.livekit.port }}
diff --git a/livekit-server/values.yaml b/livekit-server/values.yaml
index bcf6d51..1e29223 100644
--- a/livekit-server/values.yaml
+++ b/livekit-server/values.yaml
@@ -10,6 +10,22 @@ image:
 
 imagePullSecrets: []
 
+# Extra environment variables for the livekit-server container.
+# Use this to inject secrets via valueFrom.secretKeyRef without baking
+# them into the plaintext ConfigMap. LiveKit substitutes ${VAR} in its
+# YAML config at startup, so you can reference these from livekit.* below.
+extraEnv: []
+# - name: REDIS_PASSWORD
+#   valueFrom:
+#     secretKeyRef:
+#       name: my-redis-secret
+#       key: password
+
+# Extra envFrom sources (e.g. envFrom an existing Secret in bulk).
+extraEnvFrom: []
+# - secretRef:
+#     name: livecircle-external-env-secrets
+
 terminationGracePeriodSeconds: 18000
 
 # configuration for livekit

From b6fa690985896c2b531bf765606573cb6262c45b Mon Sep 17 00:00:00 2001
From: bryan hunt <bryan@livecircle.org>
Date: Sun, 14 Jun 2026 21:20:10 +0100
Subject: [PATCH 2/2] Add custom volume support for LiveKit pods

---
 livekit-server/templates/deployment.yaml | 10 ++++++++--
 livekit-server/values.yaml               | 16 ++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/livekit-server/templates/deployment.yaml b/livekit-server/templates/deployment.yaml
index 71015f2..1ae3880 100644
--- a/livekit-server/templates/deployment.yaml
+++ b/livekit-server/templates/deployment.yaml
@@ -113,7 +113,7 @@ spec:
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) }}
+          {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) .Values.extraVolumeMounts }}
           volumeMounts:
           {{- if .Values.storeKeysInSecret.enabled }}
             - name: keys-volume
@@ -125,8 +125,11 @@ spec:
               mountPath: /etc/lkcert
               readOnly: true
           {{- end }}
+          {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- end }}
-      {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) }}
+      {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) .Values.extraVolumes }}
       volumes:
         {{- if .Values.storeKeysInSecret.enabled }}
         - name: keys-volume
@@ -139,6 +142,9 @@ spec:
           secret:
             secretName: {{ required "tls secret required if turn enabled" .Values.livekit.turn.secretName }}
       {{- end }}
+      {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
diff --git a/livekit-server/values.yaml b/livekit-server/values.yaml
index 1e29223..944b994 100644
--- a/livekit-server/values.yaml
+++ b/livekit-server/values.yaml
@@ -26,6 +26,22 @@ extraEnvFrom: []
 # - secretRef:
 #     name: livecircle-external-env-secrets
 
+# Extra volumes to attach to the pod. Useful for mounting CA certificate
+# bundles, additional config files, etc.
+extraVolumes: []
+# - name: redis-ca
+#   secret:
+#     secretName: my-secret
+#     items:
+#       - key: REDIS_CA_CERT
+#         path: ca.crt
+
+# Extra volumeMounts for the livekit-server container. Pair with extraVolumes.
+extraVolumeMounts: []
+# - name: redis-ca
+#   mountPath: /etc/redis-ca
+#   readOnly: true
+
 terminationGracePeriodSeconds: 18000
 
 # configuration for livekit