odoo-tower/instance-template-v3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(chart): rip out pg dual-mode shim — ESO-only (0.1.8)

Browse Source 
A-Chunk 3 finalisation. All live instances are migrated to ESO,
and Tower 0.77.2 makes the migrate + template-deploy paths also
emit ESO-shape overlays (wizard always has). The
`{{- if not .Values.postgres.passwordVaultPath }}` shim in
postgres-secret.yaml has zero remaining production callers.

Changes:
  - DELETE templates/postgres-secret.yaml (dual-mode legacy path)
  - DELETE _helpers.tpl `instance.pgPassword` (only consumed by
    postgres-secret.yaml; no other callers)
  - UNWRAP templates/postgres-password-externalsecret.yaml — the
    outer `{{- if .Values.postgres.passwordVaultPath }}` conditional
    is removed; the template now renders unconditionally and the
    chart's `required` directive on tenant.id is the new boundary
    (chart render fails loud if Tower forgot to populate it)
  - SIMPLIFY values.yaml — drop the legacy `postgres.password` field
    and the dual-mode documentation. `passwordVaultPath` stays as an
    operator-visible advisory string but the chart hardcodes the
    path shape from tenant.id + instance.code

Chart 0.1.7 → 0.1.8. helm template + helm lint verified locally;
helm template with tenant.id missing fails loud with a clear
error pointing the operator at the chart line + the source of the
missing value.

The live instances (erp/erp18v3/v19) carry tenant.id + passwordVaultPath
in their overlays already; this chart version produces the same
manifests for them on next ArgoCD reconcile — no observable change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
OdooSky v3
2026-05-12 13:56:40 +03:00
parent 96071aec8e
commit 4a8dc61a92
5 changed files with 24 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
templates/postgres-password-externalsecret.yaml
View File

@@ -1,17 +1,18 @@
{{- if .Values.postgres.passwordVaultPath }}
# postgres-password-externalsecret.yaml — per-instance Postgres password
# sourced from OpenBao via ESO. Produces the same `<release>-pg` Secret
# shape (POSTGRES_USER + POSTGRES_PASSWORD + POSTGRES_DB) that the legacy
# postgres-secret.yaml produces, so postgres-statefulset.yaml is unchanged.
# sourced from OpenBao via ESO. Produces the `<release>-pg` Secret
# (POSTGRES_USER + POSTGRES_PASSWORD + POSTGRES_DB) consumed by
# postgres-statefulset.yaml's envFrom.
#
# Rendered only when `.Values.postgres.passwordVaultPath` is set. The
# legacy postgres-secret.yaml renders when that field is empty —
# exactly one of the two ships per instance. Tower-managed migration
# in Chunk 3 flips overlays from the legacy path to this one.
# Single source of truth for pg password lifecycle. The chart had a
# dual-mode shim (legacy postgres-secret.yaml gated by an empty
# passwordVaultPath) through Chunks 1-3 of the A-OpenBao migration;
# rip-out lands in 0.1.8 after all live instances + every Tower
# create path (wizard / migrate / template-deploy) generate overlays
# that carry tenant.id + postgres.passwordVaultPath.
#
# OpenBao path convention: `tenants/<tenantID>/instances/<code>/pg`
# with a `password` field. Covered by the per-cluster ESO policy
# `eso-tenant-<cluster>` (buildEsoPolicy in Go) which already grants
# `eso-tenant-<cluster>` (buildEsoPolicy in Go) which grants
# read on `v3/data/tenants/<tenantID>/*`. No policy change required.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
@@ -48,4 +49,3 @@ spec:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
{{- end }}