[Helm] How to use externally managed k8s secret for postgres credentials?

[theelderbeever]

I am attempting to deploy the Dagster helm chart with ArgoCD. To this end we can't embed secrets directly in the chart. I would like to be able to point the chart at a secret that is managed outside of the helm chart for Dagster to read the postgres credentials from.

In the chart there is .Values.global.postgresqlSecretName here which would seem to imply that you can manage this separately. However, further down in the .Values.postgresql here it is implied that the values for postgres, namely postgresqlPassword will exclusively be read from the values file. When deploying the chart this seems to be the behavior as well.

So my question comes down to

1. What is the purpose/point of .Values.global.postgresqlSecretName?
2. Can I manage the postgres secrets external to the chart or do I just need to fork the chart and fix it myself?

Many thanks to anyone who has an answer!

Also yes I know there is a draft PR loosely revolving around this subject however, I think my main issue is question 1 from above.

[dmvianna]

I, like you, missed line 8 of the values file I got with helm show values dagster/dagster > values.yaml:

global:
  postgresqlSecretName: "dagster-postgresql-secret"

Some more reading dagster/charts/dagster-user-deployments/templates/deployment-user.yaml I found lines 64-68:

            - name: DAGSTER_PG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "dagsterUserDeployments.postgresql.secretName" $ }}
                  key: postgresql-password

Yeah, not exactly the same variables, but could that be?

So I deleted the existing dagster-postgresql-secret from my namespace and replaced it with

kubectl create secret generic dagster-postgresql-secret \
    --from-literal=postgresql-password=${PASSWORD}

And of course, I configured my values.yaml to look like

postgresql:
  enabled: false
  postgresqlHost: "pg-sqlproxy-gcloud-sqlproxy.${mynamespace}"

  postgresqlUsername: ${myuser}
  postgresqlPassword: ""
  postgresqlDatabase: ${mydb}

generatePostgresqlPasswordSecret: false

helm upgrade ... -f values.yaml et... le voilà. My database has a brand new Dagster schema.