Conversation
The shared Raft peer token had two sources: an inline raft.token, or a token the chart generates and reuses via a lookup against the <release>-raft Secret. Neither let users keep the token in an external secret store and hand it to the cluster through the external-secrets operator, which is how the rest of their secrets already arrive. Add raft.externalSecrets, mirroring the block proposed for cookie_secret in pgdogdev#19, plus a templates/raft-externalsecret.yaml that renders an ExternalSecret when enabled. Its target Secret name is shared with the chart's existing lookup-based token resolution, so a synced token key flows into control.toml exactly like the generated one does, and the chart stops rendering its own <release>-raft Secret to avoid fighting the ExternalSecret for ownership. Move the printable-ASCII check to the resolved token, so a value read from a Secret is rejected for the trailing newline secret stores commonly carry rather than silently breaking peer authentication. Fix pgdogdev#29
|
Hmm, I would rather store it as a |
|
An external-secret just ends-up creating a k8s secret anyway. So, in terms of the final result, it should be pretty much the same, but this allows to configure the secret value somewhere else rather than just use helm - which can be helpful in many scenarios/setups In my case, I want to commit the resulting helm manifests to git (with |
|
Yeah makes sense. We need to add support for configuring |
2 participants
raft.tokencan only be set inline or generated by the chart, so the token can't come from an external secret store.Adds
raft.externalSecrets, mirroring thecontrol.externalSecretsblock in #19: the chart renders an ExternalSecret, reads the token key off its target Secret, and stops creating its own -raft Secret so the two don't fight over ownership. The printable-ASCII check moves to the resolved token, catching the trailing newline secret stores usually add.The token is resolved by lookup, so a plain helm template (or an install before the operator has synced) still falls back to a generated token; the next helm upgrade picks up the real one. Documented in the README.
Verified: ./test/test.sh and control2 configcheck pass on the new test/values-raft-external-secrets.yaml.
Fix #29