Skip to content

Commit 13b9bdf

Browse files
alix-graylogalix-graylog
committed
fix: prevent silent MongoDB provisioning failure with existingSecretName (issue #116)
1 parent fdff2a7 commit 13b9bdf

3 files changed

Lines changed: 112 additions & 1 deletion

File tree

‎charts/graylog/templates/config/secret/secrets.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,23 @@
44
{{- $err = cat $err "Please set it using graylog.config.mongodb.customUri, or provide a global secret override with global.existingSecretName" }}
55
{{- fail $err }}
66
{{- end }}
7+
{{/* Validate existingSecretName + communityResource.enabled conflict (C-06) */}}
8+
{{- if .Values.global.existingSecretName }}
9+
{{- if .Values.mongodb.communityResource.enabled }}
10+
{{- $msg := "Cannot use global.existingSecretName with mongodb.communityResource.enabled=true." }}
11+
{{- $msg = cat $msg "This combination leaves MongoDB credentials undefined (the chart will skip backup secret creation but MongoDB CR will still reference it)." }}
12+
{{- $msg = cat $msg "\n\nChoose one of the following instead:" }}
13+
{{- $msg = cat $msg "\n\nOption A: External secret + external MongoDB" }}
14+
{{- $msg = cat $msg "\n --set global.existingSecretName=my-secret" }}
15+
{{- $msg = cat $msg "\n --set mongodb.communityResource.enabled=false" }}
16+
{{- $msg = cat $msg "\n --set graylog.config.mongodb.customUri='mongodb://user:pass@host:27017/graylog'" }}
17+
{{- $msg = cat $msg "\n\nOption B: Chart-managed secrets + chart-managed MongoDB (default)" }}
18+
{{- $msg = cat $msg "\n Omit global.existingSecretName" }}
19+
{{- $msg = cat $msg "\n --set mongodb.communityResource.enabled=true" }}
20+
{{- $msg = cat $msg "\n\nSee examples/values-existing-secret-external-mongodb.yaml for a complete example." }}
21+
{{- fail $msg }}
22+
{{- end }}
23+
{{- end }}
724
{{- if not .Values.global.existingSecretName -}}
825
{{/* Lookup secrets to restore */}}
926
{{- $secretName := include "graylog.secretsName" . }}

‎charts/graylog/templates/tests/test-mongodb-connectivity.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.graylog.enabled }}
1+
{{- if and .Values.graylog.enabled .Values.mongodb.communityResource.enabled }}
22
apiVersion: v1
33
kind: Pod
44
metadata:

‎examples/values-existing-secret-external-mongodb.yaml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# GitOps Pattern: External Secret + External MongoDB
2+
#
3+
# This example demonstrates the correct configuration for users who want to:
4+
# - Use GitOps (Argo CD / Flux) with externally-managed secrets
5+
# - Connect to an external/self-managed MongoDB instance
6+
# - Avoid Helm-managed secret generation and rotation
7+
#
8+
# Why this pattern?
9+
# - Global secrets are managed outside Helm (e.g., via sealed-secrets, external-secrets operator)
10+
# - MongoDB is managed separately (cloud provider, self-managed cluster, etc.)
11+
# - Helm only orchestrates the Graylog and Data Node workloads
12+
#
13+
# Prerequisites:
14+
# 1. A secret named "graylog-managed-secret" (or your chosen name) must exist
15+
# with the following required keys:
16+
# - GRAYLOG_PASSWORD_SECRET: Base64-encoded pepper string (≥64 chars)
17+
# - GRAYLOG_ROOT_PASSWORD_SHA2: SHA256 hash of root password
18+
# - GRAYLOG_MONGODB_URI: Base64-encoded MongoDB connection string
19+
# - GRAYLOG_ROOT_USERNAME: (optional) defaults to "admin" if not provided
20+
#
21+
# 2. MongoDB must be running and accessible at the configured connection URI
22+
#
23+
# Example secret creation:
24+
# kubectl create secret generic graylog-managed-secret \
25+
# --from-literal=GRAYLOG_PASSWORD_SECRET="$(openssl rand -base64 64)" \
26+
# --from-literal=GRAYLOG_ROOT_PASSWORD_SHA2="$(echo -n mypassword | sha256sum | cut -d' ' -f1)" \
27+
# --from-literal=GRAYLOG_MONGODB_URI="$(echo -n 'mongodb://graylo[EMAIL_ADDRESS_REDACTED]om:27017/graylog' | base64)" \
28+
# --from-literal=GRAYLOG_ROOT_USERNAME="admin"
29+
#
30+
31+
global:
32+
# Point to the externally-managed secret containing all credentials
33+
# This secret must exist in the same namespace before installation
34+
existingSecretName: graylog-managed-secret
35+
36+
# Disable chart-managed MongoDB
37+
# When using external MongoDB, set this to false
38+
mongodb:
39+
communityResource:
40+
enabled: false
41+
42+
# Configure Graylog to use external MongoDB
43+
graylog:
44+
# The MongoDB connection URI is read from the external secret's GRAYLOG_MONGODB_URI key
45+
# You can also override it here if needed (optional):
46+
# config:
47+
# mongodb:
48+
# customUri: "mongodb://graylo[EMAIL_ADDRESS_REDACTED]om:27017/graylog"
49+
50+
# Example: Configure replicas for Graylog
51+
replicas: 3
52+
53+
# Example: Configure resources
54+
resources:
55+
requests:
56+
memory: "2Gi"
57+
cpu: "500m"
58+
limits:
59+
memory: "3Gi"
60+
cpu: "1000m"
61+
62+
# Data Node configuration (also uses the external secret)
63+
datanode:
64+
# Example: Configure replicas for Data Node
65+
replicas: 3
66+
67+
# Example: Configure resources for Data Node
68+
resources:
69+
requests:
70+
memory: "2Gi"
71+
cpu: "500m"
72+
limits:
73+
memory: "4Gi"
74+
cpu: "1000m"
75+
76+
# Disable MongoDB-specific tests (not applicable when MongoDB is external)
77+
graylog:
78+
enabled: true
79+
80+
# Example: Configure ingress for external access
81+
ingress:
82+
enabled: true
83+
ingressClassName: "nginx"
84+
web:
85+
enabled: true
86+
hosts:
87+
- host: "graylog.example.com"
88+
paths:
89+
- path: /
90+
pathType: Prefix
91+
tls:
92+
- secretName: graylog-tls
93+
hosts:
94+
- "graylog.example.com"

0 commit comments

Comments
 (0)