Skip to content

Chart: existingSecret must also contain users_database.yml (values comment lists only 3 keys) #87

Description

@dev-dull

Introduced in #86 (Authelia forward-auth).

Problem

When auth.authelia.secrets.existingSecret is set, the chart skips rendering its own Secret entirely:

# templates/authelia/secret.yaml
{{- if and .Values.auth.enabled (not .Values.auth.authelia.secrets.existingSecret) }}

That rendered Secret is the only source of users_database.yml. But templates/authelia/deployment.yaml mounts all four keys from $secretName (which resolves to existingSecret when set):

volumes:
  - name: users
    secret:
      secretName: {{ $secretName }}
      items:
        - key: users_database.yml   # <-- required in existingSecret too
  - name: secrets
    secret:
      secretName: {{ $secretName }}
      items: [session, storage-encryption, jwt]

However values.yaml documents only three keys:

# -- If set, the chart will NOT render its own Secret; provide a Secret
# with keys: session, storage-encryption, jwt.
existingSecret: ""

So anyone following the values comment provides a 3-key Secret, and Authelia fails to mount /config/users_database.yml (or comes up with no users). The users file must be supplied by the existingSecret as well.

Suggested fix

Update the values.yaml comment (and README) to state that existingSecret must contain four keys: session, storage-encryption, jwt, and users_database.yml (the full Authelia file-backend user DB, with argon2id password hashes).

Context

Hit while wiring existingSecret to an External Secrets Operator-managed Secret (secrets sourced from a vault, not committed). Straightforward once the deployment template made the fourth key obvious, but the values comment sends you the wrong way.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions