[PostGIS] How to pass POSTGRES_PASSWORD from my own secrets

[fullonic]

Hey,
I'm having issues when overriding the PostgreSQL password from my own secrets. I'm using the postgis v0.2.4 helm charts.

I'm trying to read the password from my secrets in this way:

...
  postgresqlPassword:
    valueFrom:
      secretKeyRef:
        name: secrets
        key: POSTGRES_PASSWORD
  existingSecret: secrets
...
[my secrets]
secrets:
  - name: secrets
    data:
      POSTGRES_PASSWORD: #######

After applying the values.yaml I'm getting the following error:

Error: UPGRADE FAILED: template: go/charts/postgis/templates/tests/postgres-connection.yaml:1:4: executing "go/charts/postgis/templates/tests/postgres-connection.yaml" at <include "common.pod" (list . "postgis.test.connection")>: 
error calling include: template: go/charts/postgis/charts/common/templates/_common.pod.yaml:8:3: executing "common.pod" at <include "common.util.merge" (append . "common.pod.tpl")>: 
error calling include: template: go/charts/postgis/charts/common/templates/_helpers.tpl:117:28: executing "common.util.merge" at <include (index . 1) $top>: 
error calling include: template: go/charts/postgis/templates/tests/postgres-connection.yaml:20:13: executing "postgis.test.connection" at <include "common.secretFrom" $param>: 
error calling include: template: go/charts/postgis/charts/common/templates/_helpers.tpl:68:13: executing "common.secretFrom" at <include "common.secretName" .>: 
error calling include: template: go/charts/postgis/charts/common/templates/_helpers.tpl:82:35: executing "common.secretName" at <.valueFrom.secretKeyRef.name>: nil pointer evaluating interface {}.secretKeyRef

Basically postgresqlPassword is not being populated from my own secrets. Maybe I doing something wrong or missing something, but I can't spot what.

Thanks for your help.

[lucernae]

Hi @fullonic, sorry for the late reply.

Yes, it is possible to supply your own secret. But the secret needs to be in the same structure that the chart expects. Some values that contains valuesFrom key means you can specify the keyref, otherwise it is not overrideable at the moment.
I understand that it is also kind of undocumented.

Although it seems you error is coming from a different problem.

Here is an example.
Let's suppose you already have a secret manifest:

apiVersion: v1
kind: Secret
metadata:
  name: postgis-secret-test
stringData:
  database-url: "postgres://docker_test:5ZDWeDI0d6@postgis-postgis:5432/gis_test"
  POSTGRES_PASSWORD: "5ZDWeDI0d6"
  postgresql-user: "docker_test"

Note that the database-url key is needed for the helm hook test. The domain name postgis-postgis refer to the deployment name itself for convenience.
Helm will create it using this chart using default format <release name>-postgis.
Basically it is a URI format accepted by psql. In the example above it contains information about username, password, hostname, port, and db name.

Your values.yaml file then looks like this

postgresqlUsername: docker_test
postgresqlPassword:
  valueFrom:
    secretKeyRef:
      key: POSTGRES_PASSWORD
postgresqlDatabase: gis_test

existingSecret: postgis-secret-test

I tried to make it similar with your case where your password key is set to POSTGRES_PASSWORD instead of postgresql-password.

You can try the sample above by applying the secret first, then do helm install on the values with release name postgis.
Once it finished installing, try helm test postgis to check if the test itself succeeds.