document using existing secrets for the subcharts

[johanneskastl]

What this PR does / why we need it

Using the secrets: section the user can use existing secrets with the zammad chart. But the credentials for the subcharts are still in plaintext in the values.yaml file.

This PR adds commented examples on how to configure the subcharts to use the existing secrets.

Which issue this PR fixes

None. It could have been part of #76 that fixes #73

Special notes for your reviewer

1. Authentication for the memcached subchart is currently not being used at all, it seems. So I did not document anything there.

2. I am a little fishy on the details regarding the elasticsearch subchart. Enabling the secrets.elasticsearch.useExisting value leads to the secret being mounted in the zammad pod. However I have not found the secret being used in the elasticsearch part at all. But: The elasticsearch section did not contain any credentials, so it might well be that the elasticsearch credential just isn't used at all?

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• Chart Version bumped
• Upgrading instructions are documented in the README.md Not necessary, no code changes.

[mgruner]

@johanneskastl thanks for your proposal, this looks really nice. Can you please point me to the Helm/Kubernetes documentation that talks about existingSecret? So far I was not able to find it.

[johanneskastl]

@johanneskastl thanks for your proposal, this looks really nice. Can you please point me to the Helm/Kubernetes documentation that talks about existingSecret? So far I was not able to find it.

This is not a helm or Kubernetes specific key. It is something that must be supported by the chart, in this case the subcharts:
https://github.com/bitnami/charts/blob/main/bitnami/postgresql/values.yaml#L25
https://github.com/bitnami/charts/blob/main/bitnami/redis/values.yaml#L137
https://github.com/bitnami/charts/blob/main/bitnami/elasticsearch/values.yaml#L224

[mgruner]

So that's why I didn't find it. Thanks!

[johanneskastl]

Please check out bitnami/charts#20545 for questions on what exactly needs to go into the elasticsearch secret. This is in addition to the question above, whether elasticsearch in Zammad actually uses the password...

[mgruner]

Would you be so kind to rebase please, f41b98d should hopefully fix the failing chart linting checks.

[johanneskastl]

Would you be so kind to rebase please, f41b98d should hopefully fix the failing chart linting checks.

Done

[mgruner]

The elasticsearch credentials are saved into the Zammad database by the elasticsearch-init container here:

zammad-helm/zammad/templates/configmap-init.yaml

Line 12 in f41b98d

bundle exec rails r 'Setting.set("es_url", "{{ .Values.zammadConfig.elasticsearch.schema }}://{{ if .Values.zammadConfig.elasticsearch.enabled }}{{ .Release.Name }}-elasticsearch{{ else }}{{ .Values.zammadConfig.elasticsearch.host }}{{ end }}:{{ .Values.zammadConfig.elasticsearch.port }}")'

In the regular zammad containers, the configuration is used straight from the database. It's not consistent with other parts of the system, but that's how it works at present.

[johanneskastl]

 >>> helm lint zammad --timeout 900s
Error: failed linting charts: failed processing charts
Error: unknown flag: --timeout

This does not look like an error I introduced?

[mgruner]

Certainly not. Not sure what's going on yet.

[mgruner]

Can you try again please? aa05fbb should fix the linter.

[mgruner]

Thanks again @johanneskastl