[bitnami/keycloak] The default value of existingSecretHostKey, existingSecretUserKey, etc is not working about charts HOT 5 OPEN

Hi @xqe2011

In my opinion, this secret should contain the username, password, port, host, etc. However, after I review the template, only the password is included.

Are you referring to the secret-external-db.yaml template? Please note this template will be ignored if externalDatabase.existingSecret is set.

In values.yaml, it defines keycloak.databaseSecretHostKey defaults to db-host. But in configmap-env-vars.yaml, it uses .Values.externalDatabase.existingSecretHostKey

Maybe you're using an old values.yaml? There's no keycloak.databaseSecretHostKey parameter in the current values.yaml. Or you might be referring to the function helper defined here.

from charts.

Are you referring to the secret-external-db.yaml template? Please note this template will be ignored if externalDatabase.existingSecret is set.

No, I am referring to the statefulset.yaml lines from 160 to 187.

In _helpers.tpl lines from 194 to 221, it defines keycloak.databaseSecretHostKey from default value db-host or .Values.externalDatabase.existingSecretHostKey, but in statefulset.yaml, it uses .Values.externalDatabase.existingSecretHostKey instead which causes the default value doesn't work.

from charts.

Hi @xqe2011

So you're suggesting that we use set KEYCLOAK_DATABASE_HOST, KEYCLOAK_DATABASE_PORT, ... environment variables if a condition such as the one below is met and fallback into the default values defined in keycloak.databaseSecretXXXKey helpers, am I right?

{{- if and (not .Values.postgresql.enabled)  .Values.externalDatabase.existingSecret }}

from charts.

Hi @juan131

Yes. This change can reduce the time spent investigating why externalDatabase.existingSecret, named to suggest it includes full database credentials such as port, host, and password, only uses the password.

from charts.

@xqe2011 I've been reviewing the logic and it works like this:

• postgresql.enabled=true: ignore every externalDatabase.*** parameters and rely on the information retrieved from PostgreSQL subchart.
• postgresql.enabled=false
  • externalDatabase.existingSecret is set:
    • For password: retrieve from existing secret using key set at externalDatabase.existingSecretPasswordKey.
    • For host, port, user & database: retrieve from existing secret ONLY IF corresponding keycloak.databaseSecretXXXKey are set. Otherwise relay on externalDatabase.host, externalDatabase.port, externalDatabase.user and externalDatabase.database (added to the configmap-env-vars.yaml ConfigMap).
  • externalDatabase.existingSecret is NOT set:
    • Rely on externalDatabase.host, externalDatabase.port, externalDatabase.user, externalDatabase.database (values added to the configmap-env-vars.yaml ConfigMap) and externalDatabase.password (value added to the secret-external-db.yaml Secret).

I agree it's over-complicated. Let me review this with the team.

from charts.