[REOPEN] openfga ignores using of external secret #135

[vaceslav]

This is a reopen issue request.

The issue #135 still not fixed.

The env var OPENFGA_DATASTORE_URI was fixed only for container openfga-migrate
After defined the Postgres URL as secret, the migrate container works as expected, but the main container openfga still do not use Postgres URL from secret.
It should be also fixed for main openfga container

openobserve-helm-chart/charts/openobserve/templates/openfga-deployment.yaml

Line 50 in b2ef823

- name: OPENFGA_DATASTORE_URI

[kayahk]

The issue is that when externalSecret.enabled is true, the template logic will still set an empty or invalid OPENFGA_DATASTORE_URI value, which overrides the value from the external secret. As soon as the obsolete ENV parameter is deleted from the deployment object, OpenFGA can successfully connect with the database using the values from the secret.

So, instead of the current section here:

env:
  - name: OPENFGA_DATASTORE_ENGINE
    value: postgres
  {{- if .Values.postgres.enabled }}
  - name: OPENFGA_DATASTORE_URI
    value: "postgres://openobserve:{{ .Values.postgres.spec.password }}@{{ include "openobserve.fullname" . }}-postgres-rw.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:5432/app?sslmode=disable"
  {{- else if .Values.auth.ZO_META_POSTGRES_DSN }}
  - name: OPENFGA_DATASTORE_URI
    value: "{{ .Values.auth.ZO_META_POSTGRES_DSN }}"
  {{- else if .Values.config.ZO_META_POSTGRES_DSN }}
  - name: OPENFGA_DATASTORE_URI
    value: "{{ .Values.config.ZO_META_POSTGRES_DSN }}"
  {{- end }}

it should be something like this:

{{- if not .Values.externalSecret.enabled }}
{{- if .Values.postgres.enabled }}
- name: OPENFGA_DATASTORE_URI
  value: "postgres://..."
{{- else if .Values.auth.ZO_META_POSTGRES_DSN }}
- name: OPENFGA_DATASTORE_URI
  value: "{{ .Values.auth.ZO_META_POSTGRES_DSN }}"
{{- else if .Values.config.ZO_META_POSTGRES_DSN }}
- name: OPENFGA_DATASTORE_URI
  value: "{{ .Values.config.ZO_META_POSTGRES_DSN }}"
{{- end }}
{{- end }}

in case externalSecret.enabled is set to true the subsequent reference to the secret will be added to the manifest, as already implemented, but it will be not overridden by the previous ENV parameter OPENFGA_DATASTORE_URI

envFrom:
  - secretRef:  # postgres detail can be picked up from secret if not found anywhere else
      name: {{ if .Values.externalSecret.enabled }}{{ .Values.externalSecret.name }}{{ else }}{{ include "openobserve.fullname" . }}{{ end }}

[kayahk]

suggested a fix here: #143