A-Chunk 3 finalisation. All live instances are migrated to ESO,
and Tower 0.77.2 makes the migrate + template-deploy paths also
emit ESO-shape overlays (wizard always has). The
`{{- if not .Values.postgres.passwordVaultPath }}` shim in
postgres-secret.yaml has zero remaining production callers.
Changes:
- DELETE templates/postgres-secret.yaml (dual-mode legacy path)
- DELETE _helpers.tpl `instance.pgPassword` (only consumed by
postgres-secret.yaml; no other callers)
- UNWRAP templates/postgres-password-externalsecret.yaml — the
outer `{{- if .Values.postgres.passwordVaultPath }}` conditional
is removed; the template now renders unconditionally and the
chart's `required` directive on tenant.id is the new boundary
(chart render fails loud if Tower forgot to populate it)
- SIMPLIFY values.yaml — drop the legacy `postgres.password` field
and the dual-mode documentation. `passwordVaultPath` stays as an
operator-visible advisory string but the chart hardcodes the
path shape from tenant.id + instance.code
Chart 0.1.7 → 0.1.8. helm template + helm lint verified locally;
helm template with tenant.id missing fails loud with a clear
error pointing the operator at the chart line + the source of the
missing value.
The live instances (erp/erp18v3/v19) carry tenant.id + passwordVaultPath
in their overlays already; this chart version produces the same
manifests for them on next ArgoCD reconcile — no observable change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
