refactor(postgres): support external secrets

docs/postgresql.md

@@ -39,6 +39,38 @@ it is safe to re-run: existing roles and databases are left untouched.
 The postgres values must be specified for `authentik` and `openwebui`. They may use the same
 server, but should have different roles and databases.
 
+## Passwords
+
+The openwebui postgres password is read from a Kubernetes `Secret`, under the key `password`.
+The chart does not create it. Simply specify the resource name:
+
+```yaml
+openwebui:
+  postgres:
+    passwordSecret:
+      name: vllm-openwebui-pg
+```
+
+For the Authentik subchart to also use an external secret, the password must be injected via `global.env`, which covers server and worker at
+once:
+
+```yaml
+authentik:
+  authentik:
+    postgresql:
+      password: # unset on purpose, supplied below
+  global:
+    env:
+      - name: AUTHENTIK_POSTGRESQL__PASSWORD
+        valueFrom:
+          secretKeyRef: { name: vllm-authentik-pg, key: password }
+```
+
+> [!IMPORTANT]
+>
+> Use alphanumeric passwords. OpenWebUI's is interpolated into a connection URI in the pod,
+> where nothing percent-encodes it, so `@ : / ? # %` would corrupt the DSN.
+
 ## Sharing a server between releases
 
 The names default to `vllm-openwebui` and `vllm-authentik`, if multiple

templates/NOTES.txt

@@ -2,3 +2,9 @@ VLLM Gateway and models have been successfully deployed on your cluster.
 
 You can access the gateway at https://gateway.{{ .Values.envoy.baseDomain }}/v1/chat/completions
 You can access Open-WebUI at https://openwebui.{{ .Values.envoy.baseDomain }}/
+{{- /* The subchart defaults it to "<release>-postgresql", a plausible name that resolves
+to nothing, so an omission would otherwise surface as an authentik CrashLoopBackOff.
+*/}}
+{{- if .Values.authentik.enabled }}
+  {{- $_ := .Values.authentik.authentik.postgresql.host | required ".Values.authentik.authentik.postgresql.host is required: the chart does not deploy PostgreSQL" }}
+{{- end }}

templates/openwebui/deployment.yaml

@@ -34,11 +34,19 @@ spec:
               value: "true"
             - name: OPENAI_API_BASE_URL
               value: https://gateway.{{ .Values.envoy.baseDomain }}/v1
-            - name: DATABASE_URL
+  {{- $pg := .Values.openwebui.postgres }}
+  {{- /* Must precede DATABASE_URL: $(VAR) only expands earlier entries. */}}
+            - name: PG_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "openwebui.fullname" . }}-postgres
-                  key: OPENWEBUI_DATABASE_URL
+                  name: {{ (default dict $pg.passwordSecret).name | required ".Values.openwebui.postgres.passwordSecret.name is required" }}
+                  key: password
+  {{- /* One value fills both db and role. Guarded: an explicit null or "" deletes the
+  chart default, and an unset part of a DSN fails at connect time, not render time. */}}
+  {{- $db := $pg.database | required ".Values.openwebui.postgres.database is required" }}
+  {{- $ssl := $pg.sslMode | required ".Values.openwebui.postgres.sslMode is required" }}
+            - name: DATABASE_URL
+              value: "postgresql://{{ $db }}:$(PG_PASSWORD)@{{ $pg.host | required ".Values.openwebui.postgres.host is required" }}:5432/{{ $db }}?sslmode={{ $ssl }}"
             - name: ENABLE_OAUTH_SIGNUP
               value: "true"
             - name: ENABLE_LOGIN_FORM

tools/helm/lint-values.yaml

@@ -14,7 +14,8 @@ openwebui:
     password: dummy
   postgres:
     host: pg.example.invalid
-    password: dummy
+    passwordSecret:
+      name: dummy-pg
 models:
   lint: &model
     fullName: org/lint-model

values.yaml

@@ -62,7 +62,9 @@ openwebui:
     database: vllm-openwebui
     # "disable" puts every query on the wire in cleartext.
     sslMode: require
-    password:
+    # Existing secret holding the role's password under the key "password".
+    passwordSecret:
+      name:
   admin:
     user: admin
     email: admin@sdsc.ethz.ch