tryretool / retool-helm

MIT License
45 stars 57 forks source link

use the correct password for the postgresql subchart based on username #114

Closed anna-yn closed 1 year ago

anna-yn commented 1 year ago

Right now, by default, we have these values:

postgresql:
  # We highly recommend you do NOT use this subchart as is to run Postgres in a container
  # for your production instance of Retool; it is a default. Please use a managed Postgres,
  # or self-host more permanantly. Use enabled: false and set in config above to do so.
  enabled: true
  ssl_enabled: false
  auth:
    database: hammerhead_production
    username: postgres
    password: retool

postgres happens to be the username of the default admin user in the postgresql subchart, which means it needs the admin password postgresPassword. These defaults would work out of the box because retool will be initiated with the user postgres and the auto-generated admin password postgresPassword which we did not specify here.

however, if the user changes username to anything else other than postgres, the install would break unless the user sets a postgresPassword field that has the same value as the password field. This is because we only pass the value of postgresPassword to retool regardless of whether password is set, but by specifying a custom user that is not postgres, the pg subchart actually expects password to be used for the custom user, not postgresPassword.

This fixes this case by checking whether username == "postgres", if true, we’d use postgresPassword , otherwise we use password. Also added some comments to warn people about this situation

We can't just add a new default for postgresPassword because that would break anyone who has installed the chart with the username postgres but not have postgresPassword set by changing the password for them.

I tested:

  1. pg username postgres , postgresPassword is used (pic1): a. new installation works b. upgrading to this new chart version doesn’t change anything
  2. pg username retool , password is used (pic2) a. new installation works b. upgrading to this new chart version changes the secret key from postgres-password to password which doesn’t break anything - if anyone has username set to anything other than postgres right now, the only way they could’ve made it work is to set `postgresPassword to be the same value as password, so changing the secret reference doesnt change anything

pic1: image pic2: image