feat(dgraph): support existingSecret for ACL, encryption, and backup admin credentials

charts/dgraph/templates/alpha/secret-acl.yaml

@@ -1,4 +1,4 @@
-{{ if and .Values.alpha.acl.enabled .Values.alpha.acl.file }}
+{{ if and .Values.alpha.acl.enabled (not .Values.alpha.acl.existingSecret) .Values.alpha.acl.file }}
 apiVersion: v1
 kind: Secret
 metadata:

charts/dgraph/templates/alpha/secret-enc.yaml

@@ -1,4 +1,4 @@
-{{ if and .Values.alpha.encryption.enabled .Values.alpha.encryption.file }}
+{{ if and .Values.alpha.encryption.enabled (not .Values.alpha.encryption.existingSecret) .Values.alpha.encryption.file }}
 apiVersion: v1
 kind: Secret
 metadata:

charts/dgraph/templates/alpha/statefulset.yaml

@@ -316,12 +316,18 @@ spec:
       {{- if .Values.alpha.encryption.enabled }}
       - name: enc-volume
         secret:
-          secretName: {{ template "dgraph.alpha.fullname" . }}-encryption-secret
+          # existingSecret lets a pre-created Secret supply the encryption key, so it
+          # never has to be rendered through Helm values; otherwise mount the Secret
+          # the chart renders from `encryption.file`.
+          secretName: {{ .Values.alpha.encryption.existingSecret | default (printf "%s-encryption-secret" (include "dgraph.alpha.fullname" .)) }}
       {{- end }}
-      {{- if or .Values.alpha.acl.enabled }}
+      {{- if .Values.alpha.acl.enabled }}
       - name: acl-volume
         secret:
-          secretName: {{ template "dgraph.alpha.fullname" . }}-acl-secret
+          # existingSecret lets a pre-created Secret (e.g. one managed by Terraform or an
+          # external secrets operator) supply the HMAC key, so it never has to be rendered
+          # through Helm values; otherwise mount the Secret the chart renders from `acl.file`.
+          secretName: {{ .Values.alpha.acl.existingSecret | default (printf "%s-acl-secret" (include "dgraph.alpha.fullname" .)) }}
       {{- end }}
 {{- if .Values.alpha.persistence.enabled }}
   volumeClaimTemplates:

charts/dgraph/templates/backups/cronjob-full.yaml

@@ -126,9 +126,26 @@ spec:
           {{- end }}
           {{- if or .Values.alpha.acl.enabled .Values.backups.admin.auth_token }}
           - name: backup-secret-volume
+          {{- if and .Values.alpha.acl.enabled .Values.backups.admin.existingSecret }}
+            projected:
+              sources:
+              - secret:
+                  name: {{ .Values.backups.admin.existingSecret }}
+                  items:
+                  - key: {{ .Values.backups.admin.passwordSecretKey }}
+                    path: backup_admin_password
+              {{- if .Values.backups.admin.auth_token }}
+              - secret:
+                  name: {{ template "dgraph.backups.fullname" . }}-secret
+                  items:
+                  - key: backup_auth_token
+                    path: backup_auth_token
+              {{- end }}
+          {{- else }}
             secret:
               secretName: {{ template "dgraph.backups.fullname" . }}-secret
           {{- end }}
+          {{- end }}
           {{- if .Values.backups.nfs.enabled }}
           - name: backups-nfs-volume
             persistentVolumeClaim:

charts/dgraph/templates/backups/cronjob-inc.yaml

@@ -126,9 +126,26 @@ spec:
           {{- end }}
           {{- if or .Values.alpha.acl.enabled .Values.backups.admin.auth_token }}
           - name: backup-secret-volume
+          {{- if and .Values.alpha.acl.enabled .Values.backups.admin.existingSecret }}
+            projected:
+              sources:
+              - secret:
+                  name: {{ .Values.backups.admin.existingSecret }}
+                  items:
+                  - key: {{ .Values.backups.admin.passwordSecretKey }}
+                    path: backup_admin_password
+              {{- if .Values.backups.admin.auth_token }}
+              - secret:
+                  name: {{ template "dgraph.backups.fullname" . }}-secret
+                  items:
+                  - key: backup_auth_token
+                    path: backup_auth_token
+              {{- end }}
+          {{- else }}
             secret:
               secretName: {{ template "dgraph.backups.fullname" . }}-secret
           {{- end }}
+          {{- end }}
           {{- if .Values.backups.nfs.enabled }}
           - name: backups-nfs-volume
             persistentVolumeClaim:

charts/dgraph/templates/backups/secrets.yaml

@@ -1,7 +1,8 @@
 {{- $hasS3Keys := include "dgraph.backups.keys.s3.enabled" . -}}
 {{- $hasMinioKeys := include "dgraph.backups.keys.minio.enabled" . -}}
 {{- $backupsEnabled := or .Values.backups.full.enabled .Values.backups.incremental.enabled }}
-{{- if and $backupsEnabled (or .Values.alpha.acl.enabled .Values.backups.admin.auth_token $hasS3Keys $hasMinioKeys) -}}
+{{- $aclInlinePassword := and .Values.alpha.acl.enabled (not .Values.backups.admin.existingSecret) }}
+{{- if and $backupsEnabled (or $aclInlinePassword .Values.backups.admin.auth_token $hasS3Keys $hasMinioKeys) -}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -15,8 +16,8 @@ metadata:
   {{- end }}
 type: Opaque
 data:
-  {{- if .Values.alpha.acl.enabled }}
-  backup_admin_password: {{ required "backups.admin.password must be set when alpha.acl.enabled is true and backups are enabled" .Values.backups.admin.password | toString | b64enc | quote }}
+  {{- if $aclInlinePassword }}
+  backup_admin_password: {{ required "backups.admin.password must be set when alpha.acl.enabled is true, backups are enabled, and backups.admin.existingSecret is not set" .Values.backups.admin.password | toString | b64enc | quote }}
   {{- end }}
   {{- if .Values.backups.admin.auth_token }}
   backup_auth_token: {{ .Values.backups.admin.auth_token | toString | b64enc | quote }}

charts/dgraph/values.yaml

@@ -390,8 +390,16 @@ alpha:
   ## ref: https://docs.dgraph.io/installation/configuration/enable-acl
   acl:
     enabled: false
+    ## Filename (and Secret key) of the HMAC secret mounted at /dgraph/acl/<secretFile>.
+    secretFile: hmac_secret_file
+    ## Name of a pre-created Secret holding the HMAC key. When set, the chart does NOT
+    ## render its own ACL Secret from `file` below; the alpha pod mounts this Secret
+    ## instead, so the HMAC never passes through Helm values or release state. The
+    ## Secret must contain the `secretFile` key.
+    existingSecret: ""
     ## The values in `file: {}` will be the filename as key and the file data as the value.
-    ## Make sure that the filename key matches the dgraph configuration of `acl_secret_file`
+    ## Make sure that the filename key matches the dgraph configuration of `acl_secret_file`.
+    ## Ignored when `existingSecret` is set.
     # file:
     #   ## value for 1234567890123456789012345678901
     #   ## Note that Kubernetes secrets must be base64-encoded
@@ -401,8 +409,15 @@ alpha:
   ## ref: https://docs.dgraph.io/installation/configuration/encryption-at-rest
   encryption:
     enabled: false
+    ## Filename (and Secret key) of the encryption key mounted at /dgraph/enc/<keyFile>.
+    keyFile: enc_key_file
+    ## Name of a pre-created Secret holding the encryption key. When set, the chart does
+    ## NOT render its own encryption Secret from `file` below; the alpha pod mounts this
+    ## Secret instead. The Secret must contain the `keyFile` key.
+    existingSecret: ""
     ## The values in `file: {}` will be the filename as key and the file data as the value.
-    ## Make sure that the filename key matches the dgraph configuration of `encryption_key_file`
+    ## Make sure that the filename key matches the dgraph configuration of `encryption_key_file`.
+    ## Ignored when `existingSecret` is set.
     # file:
     #   ## value for 123456789012345
     #   ## Note that Kubernetes secrets must be base64-encoded
@@ -645,6 +660,14 @@ backups:
     ## ref: https://docs.dgraph.io/installation/configuration/enable-acl
     user: groot
     # password: password
+    ## Name of a pre-created Secret holding the backup admin password. When set, the
+    ## chart does NOT mint `backup_admin_password` into its own backups Secret; the
+    ## CronJob mounts this Secret's key instead, so the password never passes through
+    ## Helm values or release state. Ignored unless alpha.acl.enabled is true.
+    existingSecret: ""
+    ## Key within existingSecret (or the chart's own backups Secret) that holds the
+    ## backup admin password.
+    passwordSecretKey: backup_admin_password
     ## Mutual TLS client certificate and key can be used to secure transaction that was created with
     ## dgraph cert --client <name-of-client> should be specified here.
     ## ref. https://docs.dgraph.io/admin/security/tls-configuration#tls-options