Introduced in #86 (Authelia forward-auth).
Problem
When auth.authelia.secrets.existingSecret is set, the chart skips rendering its own Secret entirely:
# templates/authelia/secret.yaml
{{- if and .Values.auth.enabled (not .Values.auth.authelia.secrets.existingSecret) }}
That rendered Secret is the only source of users_database.yml. But templates/authelia/deployment.yaml mounts all four keys from $secretName (which resolves to existingSecret when set):
volumes:
- name: users
secret:
secretName: {{ $secretName }}
items:
- key: users_database.yml # <-- required in existingSecret too
- name: secrets
secret:
secretName: {{ $secretName }}
items: [session, storage-encryption, jwt]
However values.yaml documents only three keys:
# -- If set, the chart will NOT render its own Secret; provide a Secret
# with keys: session, storage-encryption, jwt.
existingSecret: ""
So anyone following the values comment provides a 3-key Secret, and Authelia fails to mount /config/users_database.yml (or comes up with no users). The users file must be supplied by the existingSecret as well.
Suggested fix
Update the values.yaml comment (and README) to state that existingSecret must contain four keys: session, storage-encryption, jwt, and users_database.yml (the full Authelia file-backend user DB, with argon2id password hashes).
Context
Hit while wiring existingSecret to an External Secrets Operator-managed Secret (secrets sourced from a vault, not committed). Straightforward once the deployment template made the fourth key obvious, but the values comment sends you the wrong way.
Introduced in #86 (Authelia forward-auth).
Problem
When
auth.authelia.secrets.existingSecretis set, the chart skips rendering its own Secret entirely:That rendered Secret is the only source of
users_database.yml. Buttemplates/authelia/deployment.yamlmounts all four keys from$secretName(which resolves toexistingSecretwhen set):However
values.yamldocuments only three keys:So anyone following the values comment provides a 3-key Secret, and Authelia fails to mount
/config/users_database.yml(or comes up with no users). The users file must be supplied by the existingSecret as well.Suggested fix
Update the
values.yamlcomment (and README) to state thatexistingSecretmust contain four keys:session,storage-encryption,jwt, andusers_database.yml(the full Authelia file-backend user DB, with argon2idpasswordhashes).Context
Hit while wiring
existingSecretto an External Secrets Operator-managed Secret (secrets sourced from a vault, not committed). Straightforward once the deployment template made the fourth key obvious, but the values comment sends you the wrong way.