ahp/pargar
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

fix(chart): fail loudly instead of generating random secrets on lookup miss
build-and-push / build (push) Successful in 28s
Details

Browse Source 
randAlphaNum fallbacks silently minted new db/redis/rustfs passwords on
every cluster-less render (always the case under Argo CD's helm
template), overwriting live credentials. Fresh installs now get a clear
error demanding explicit values; helm upgrades are unaffected (lookup
preserves existing secrets).
This commit is contained in:
ahp
2026-10-18 23:20:22 +03:30
parent 53c8c8e94c
commit 943897044a
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/helm/pargar/templates/secret-data.yaml
+6 -3
View File
@@ -8,7 +8,10 @@
{{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
{{- $pgPass = .Values.postgres.auth.password }}
{{- else }}
{{- $pgPass = randAlphaNum 32 }}
{{- /* Fail loudly instead of silently minting a random password: under
Argo CD (helm template) `lookup` is always empty, and a random
value would diverge from the live service on every render. */}}
{{- fail "postgres.auth.password must be set: no existing pargar-postgres secret was found and .Values.postgres.auth.password is empty or a change-me placeholder" }}
{{- end }}
apiVersion: v1
kind: Secret
@@ -30,7 +33,7 @@ stringData:
{{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
{{- $rdPass = .Values.redis.auth.password }}
{{- else }}
{{- $rdPass = randAlphaNum 32 }}
{{- fail "redis.auth.password must be set: no existing pargar-redis secret was found and .Values.redis.auth.password is empty or a change-me placeholder" }}
{{- end }}
apiVersion: v1
kind: Secret
@@ -56,7 +59,7 @@ stringData:
{{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
{{- $secret = .Values.rustfs.auth.secretKey }}
{{- else }}
{{- $secret = randAlphaNum 40 }}
{{- fail "rustfs.auth.secretKey must be set: no existing pargar-rustfs secret was found and .Values.rustfs.auth.secretKey is empty or a change-me placeholder" }}
{{- end }}
apiVersion: v1
kind: Secret