ahp
dc1b9e9cc0
Include values profiles, secrets handling, TLS hooks, HPA/PDB, and in-cluster data services.
72 lines
2.7 KiB
YAML
72 lines
2.7 KiB
YAML
{{- if and .Values.postgres.enabled (not .Values.postgres.existingSecret) }}
|
|
{{- $pgName := include "pargar.postgresSecretName" . }}
|
|
{{- $pgExisting := lookup "v1" "Secret" .Release.Namespace $pgName }}
|
|
{{- $pgPass := "" }}
|
|
{{- if and $pgExisting $pgExisting.data (index $pgExisting.data "postgres-password") }}
|
|
{{- /* Never rotate an existing DB password — Postgres data dir is bound to it. */}}
|
|
{{- $pgPass = index $pgExisting.data "postgres-password" | b64dec }}
|
|
{{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
|
|
{{- $pgPass = .Values.postgres.auth.password }}
|
|
{{- else }}
|
|
{{- $pgPass = randAlphaNum 32 }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $pgName }}
|
|
labels:
|
|
{{- include "pargar.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
postgres-password: {{ $pgPass | quote }}
|
|
---
|
|
{{- end }}
|
|
{{- if and .Values.redis.enabled (not .Values.redis.existingSecret) }}
|
|
{{- $rdName := include "pargar.redisSecretName" . }}
|
|
{{- $rdExisting := lookup "v1" "Secret" .Release.Namespace $rdName }}
|
|
{{- $rdPass := "" }}
|
|
{{- if and $rdExisting $rdExisting.data (index $rdExisting.data "redis-password") }}
|
|
{{- $rdPass = index $rdExisting.data "redis-password" | b64dec }}
|
|
{{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
|
|
{{- $rdPass = .Values.redis.auth.password }}
|
|
{{- else }}
|
|
{{- $rdPass = randAlphaNum 32 }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $rdName }}
|
|
labels:
|
|
{{- include "pargar.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
redis-password: {{ $rdPass | quote }}
|
|
---
|
|
{{- end }}
|
|
{{- if and .Values.rustfs.enabled (not .Values.rustfs.existingSecret) }}
|
|
{{- $rsName := include "pargar.rustfsSecretName" . }}
|
|
{{- $rsExisting := lookup "v1" "Secret" .Release.Namespace $rsName }}
|
|
{{- $access := .Values.rustfs.auth.accessKey | default "pargar" }}
|
|
{{- $secret := "" }}
|
|
{{- if and $rsExisting $rsExisting.data (index $rsExisting.data "secret-key") }}
|
|
{{- $secret = index $rsExisting.data "secret-key" | b64dec }}
|
|
{{- if index $rsExisting.data "access-key" }}
|
|
{{- $access = index $rsExisting.data "access-key" | b64dec }}
|
|
{{- end }}
|
|
{{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
|
|
{{- $secret = .Values.rustfs.auth.secretKey }}
|
|
{{- else }}
|
|
{{- $secret = randAlphaNum 40 }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $rsName }}
|
|
labels:
|
|
{{- include "pargar.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
stringData:
|
|
access-key: {{ $access | quote }}
|
|
secret-key: {{ $secret | quote }}
|
|
{{- end }}
|