fix(values): consistent usage of postgresql.adminPasswordKey by muja · Pull Request #44 · redhat-developer/rhdh-chart

muja · 2024-09-20T07:27:00Z

Description of the change

Consistently use adminPasswordKey. Overriding this value currently leads to buggy behavior because it is not consistently used everywhere. Specifically the hard-coded postgres-password in one of the extraEnvVars is causing issues and downstream values files cannot override that easily.

Additional Information

Since janus-idp.postgresql.secretName is not used anymore, could be considered to delete it, but it might break downstream charts which use that helper.

Checklist

Chart version bumped in Chart.yaml according to semver.
Variables are documented in the values.yaml and added to the README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes.
JSON Schema template updated and re-generated the raw schema via pre-commit hook.
List tests pass for Chart using the Chart Testing tool and the ct lint command.

rm3l

Hi @muja ! Thanks for this contribution.

Error:  templates/: template: backstage/charts/upstream/charts/postgresql/templates/primary/statefulset.yaml:385:16: executing "backstage/charts/upstream/charts/postgresql/templates/primary/statefulset.yaml" at <include "common.tplvalues.render" (dict "value" .Values.primary.extraEnvVars "context" $)>: error calling include: template: backstage/charts/common/templates/_tplvalues.tpl:19:8: executing "common.tplvalues.render" at <tpl $value .context>: error calling tpl: error during tpl function execution for "- name: POSTGRESQL_ADMIN_PASSWORD\n  valueFrom:\n    secretKeyRef:\n      key: '{{- include \"postgresql.adminPasswordKey\" }}'\n      name: '{{- include \"postgresql.v1.secretName\" . }}'": template: backstage/charts/upstream/charts/postgresql/templates/primary/statefulset.yaml:4:16: executing "backstage/charts/upstream/charts/postgresql/templates/primary/statefulset.yaml" at <include>: wrong number of args for include: want 2 got 1

Could you look into the lint issues reported?
https://github.com/redhat-developer/rhdh-chart/actions/runs/10955059451/job/30920518609?pr=44
Thanks.

sonarqubecloud · 2024-10-08T11:35:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

muja · 2024-10-08T11:35:52Z

Hi @rm3l

I believe I was missing a .. Should be fixed now.

muja · 2024-10-08T17:07:31Z

It seems that the context differs for the two invocations. The invocations on line 111/112 happen from the upstream chart, where the .Values.global look like this (weirdly):

{
    "auth": {
        "backend": {
            "enabled": true,
            "existingSecret": "",
            "value": ""
        }
    },
    "clusterRouterBase": "apps.example.com",
    "dynamic": {
        "includes": [
            "dynamic-plugins.default.yaml"
        ],
        "plugins": []
    },
    "host": "",
    "imagePullSecrets": [],
    "imageRegistry": ""
}

while the invocation in line 239/240 happens from the postgres chart, from who's POV they look like this:

{
    "auth": {
        "backend": {
            "enabled": true,
            "existingSecret": "",
            "value": ""
        }
    },
    "clusterRouterBase": "apps.example.com",
    "dynamic": {
        "includes": [
            "dynamic-plugins.default.yaml"
        ],
        "plugins": []
    },
    "host": "",
    "imagePullSecrets": [],
    "imageRegistry": "",
    "postgresql": {
        "auth": {
            "database": "",
            "existingSecret": "",
            "password": "",
            "postgresPassword": "",
            "secretKeys": {
                "adminPasswordKey": "",
                "replicationPasswordKey": "",
                "userPasswordKey": ""
            },
            "username": ""
        },
        "service": {
            "ports": {
                "postgresql": ""
            }
        }
    },
    "storageClass": ""
}

This causes the error. Any idea how to resolve this?

muja · 2024-10-08T17:53:50Z

That missing section is defined in the postgres chart's values.yaml file and when the invocation happens in the upstream chart, those values are not yet set/merged. I'm not a helm chart expert so I'm not sure what would be a good way to resolve this other than specifying empty objects in the values file:

global:
  postgresql:
    auth: {}
upstream:
  auth: {}

muja · 2024-10-08T18:11:52Z

charts/backstage/values.yaml

-            key: postgres-password
-            name: '{{- include "janus-idp.postgresql.secretName" . }}'
+            key: '{{- include "postgresql.adminPasswordKey" . }}'
+            name: '{{- include "postgresql.v1.secretName" . }}'


using this helper here changes the name property from rhdh-chart-postgresql to rhdh-chart-backstage. Is that a breaking change / problem?

sonarqubecloud · 2024-11-13T20:24:03Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

muja · 2025-02-05T06:45:36Z

Any update on this?

sonarqubecloud · 2025-02-06T16:28:01Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2025-05-12T19:48:50Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2025-08-19T16:57:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rm3l

Hi @muja ,
So sorry it took us this long to get back to this PR. Are you still interested in following up on this?

rm3l · 2026-01-07T13:30:05Z

/review

rhdh-qodo-merge · 2026-01-07T13:30:31Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🔒 No security concerns identified
⚡ Recommended focus areas for review YAML Syntax In the `secretKeyRef` block for `POSTGRESQL_ADMIN_PASSWORD` under `upstream.postgresql.extraEnvVars`, the `name` field appears to be mis-indented relative to `key`, which can break YAML parsing or result in an incorrect object structure being rendered by Helm. extraEnvVars: - name: POSTGRESQL_ADMIN_PASSWORD valueFrom: secretKeyRef: key: '{{- include "postgresql.adminPasswordKey" . }}' name: '{{- include "postgresql.v1.secretName" . }}' service:
📚 Focus areas based on broader codebase context Schema Templating The JSON schema `default` for `extraEnvVars` now contains Helm template expressions (`{{- include "postgresql.adminPasswordKey" . }}` / `{{- include "postgresql.v1.secretName" . }}`) rather than concrete default values. Validate that `values.schema.json` is intended to embed Helm templating (and that your schema generation/tooling and IDE validators can consume it); otherwise this can break schema consumers and autocompletion. (Ref 3, Ref 2) "name": "POSTGRESQL_ADMIN_PASSWORD", "valueFrom": { "secretKeyRef": { "key": "{{- include \"postgresql.adminPasswordKey\" . }}", "name": "{{- include \"postgresql.v1.secretName\" . }}" } Reference reasoning: The chart’s schema template examples define defaults as plain JSON values (strings/booleans/objects) without Helm `include` expressions, indicating that schema defaults are generally expected to be static data rather than templated Helm output.
📄 References redhat-developer/rhdh-chart/charts/orchestrator-infra/values.schema.json [1-133] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [137-267] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [1-106] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [335-447] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [107-135] redhat-developer/rhdh-chart/charts/orchestrator-infra/values.schema.tmpl.json [1-136] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [268-334] redhat-developer/rhdh-chart/charts/backstage/values.schema.tmpl.json [448-452]

sonarqubecloud · 2026-01-15T11:23:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

openshift-ci bot requested review from coreydaley and tumido September 20, 2024 07:27

rm3l reviewed Oct 1, 2024

View reviewed changes

fix(values): consistent usage of postgresql.adminPasswordKey

44770f5

muja force-pushed the main branch from 393d325 to 44770f5 Compare October 8, 2024 11:35

muja commented Oct 8, 2024

View reviewed changes

Merge branch 'main' into main

21361f1

Merge branch 'main' into main

93608eb

Merge branch 'main' into main

5506d07

rm3l temporarily deployed to internal May 12, 2025 19:48 — with GitHub Actions Inactive

Merge branch 'main' into main

dc69c0e

Fortune-Ndlovu temporarily deployed to internal August 19, 2025 16:57 — with GitHub Actions Inactive

rm3l reviewed Dec 8, 2025

View reviewed changes

Merge branch 'main' into main

3712ab3

rm3l temporarily deployed to external December 8, 2025 14:04 — with GitHub Actions Inactive

rm3l removed request for coreydaley and tumido December 8, 2025 14:06

Merge branch 'main' into main

d1c0770

rm3l temporarily deployed to external January 7, 2026 13:29 — with GitHub Actions Inactive

rhdh-qodo-merge bot added the Review effort 2/5 label Jan 7, 2026

Merge branch 'main' into main

6d15277

rm3l deployed to external January 15, 2026 11:23 — with GitHub Actions Active

Conversation

muja commented Sep 20, 2024

Description of the change

Additional Information

Checklist

Uh oh!

rm3l left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Oct 8, 2024

Quality Gate passed

Uh oh!

muja commented Oct 8, 2024

Uh oh!

muja commented Oct 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muja commented Oct 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muja Oct 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Nov 13, 2024

Quality Gate passed

Uh oh!

muja commented Feb 5, 2025

Uh oh!

sonarqubecloud bot commented Feb 6, 2025

Quality Gate passed

Uh oh!

sonarqubecloud bot commented May 12, 2025

Quality Gate passed

Uh oh!

sonarqubecloud bot commented Aug 19, 2025

Quality Gate passed

Uh oh!

rm3l left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rm3l commented Jan 7, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 7, 2026

PR Reviewer Guide 🔍

Uh oh!

sonarqubecloud bot commented Jan 15, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

muja commented Oct 8, 2024 •

edited

Loading

muja commented Oct 8, 2024 •

edited

Loading

muja Oct 8, 2024 •

edited

Loading

rm3l left a comment •

edited

Loading