refactor(postgres): hardcode secret key password

Author: cmdoret

docs/postgresql.md

@@ -36,8 +36,8 @@ server, but should have different roles and databases.
 
 ## Passwords
 
-The openwebui postgres password is read from Kubernetes `Secret` resources.
-Simply specify the resource name:
+The openwebui postgres password is read from a Kubernetes `Secret`, under the key `password`.
+The chart does not create it. Simply specify the resource name:
 
 ```yaml
 openwebui:

templates/authentik_validate.yaml

@@ -0,0 +1,5 @@
+{{- /* Renders nothing. Guards a subchart value the parent has no template of its own for. */}}
+{{- if .Values.authentik.enabled }}
+  {{- /* The subchart defaults this to "<release>-postgresql", which will not resolve. */}}
+  {{- $_ := .Values.authentik.authentik.postgresql.host | required ".Values.authentik.authentik.postgresql.host is required: the chart does not deploy PostgreSQL" }}
+{{- end }}

templates/openwebui/deployment.yaml

@@ -35,14 +35,13 @@ spec:
             - name: OPENAI_API_BASE_URL
               value: https://gateway.{{ .Values.envoy.baseDomain }}/v1
   {{- $pg := .Values.openwebui.postgres }}
-  {{- $ps := $pg.passwordSecret }}
   {{- /* Must precede DATABASE_URL: $(VAR) only expands earlier entries. */}}
             - name: PG_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ $ps.name | required ".Values.openwebui.postgres.passwordSecret.name is required" }}
-                  key: {{ $ps.key }}
-  {{- $db := $pg.database | required ".Values.openwebui.postgres.database is required" }}
+                  name: {{ $pg.passwordSecret.name | required ".Values.openwebui.postgres.passwordSecret.name is required" }}
+                  key: password
+  {{- $db := $pg.database }}
   {{- /* One value fills both db and role. */}}
             - name: DATABASE_URL
               value: "postgresql://{{ $db }}:$(PG_PASSWORD)@{{ $pg.host | required ".Values.openwebui.postgres.host is required" }}:5432/{{ $db }}?sslmode=require"

values.yaml

@@ -60,10 +60,9 @@ openwebui:
     host:
     # Database name, and the name of the role that owns it.
     database: vllm-openwebui
-    # Existing secret holding the role's password.
+    # Existing secret holding the role's password under the key "password".
     passwordSecret:
       name:
-      key: password
   admin:
     user: admin
     email: admin@sdsc.ethz.ch