photoprism/setup/charts/plus/templates/secret.yaml

37 lines
1.5 KiB
YAML

{{- /*
Recover existing passwords via lookup so upgrades keep the same values.
On first install, a random admin password is generated. Note that lookup
returns nil under `helm template` and `helm install --dry-run`, so those
invocations always print a fresh random — cosmetic only; real installs
preserve the stored value.
*/ -}}
{{- $secretName := printf "%s-secrets" (include "photoprism-plus.fullname" .) -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $existingAdmin := "" -}}
{{- $existingDb := "" -}}
{{- if $existing -}}
{{- $existingAdmin = default "" (index $existing.data "PHOTOPRISM_ADMIN_PASSWORD") | b64dec | trim -}}
{{- $existingDb = default "" (index $existing.data "PHOTOPRISM_DATABASE_PASSWORD") | b64dec | trim -}}
{{- end -}}
{{- $adminPassword := default "" (.Values.adminPassword | toString | trim) -}}
{{- if eq $adminPassword "" -}}
{{- if ne $existingAdmin "" -}}
{{- $adminPassword = $existingAdmin -}}
{{- else -}}
{{- $adminPassword = randAlphaNum 16 -}}
{{- end -}}
{{- end -}}
{{- $dbPassword := default "" (.Values.database.password | toString | trim) -}}
{{- if and (eq $dbPassword "") (ne $existingDb "") -}}
{{- $dbPassword = $existingDb -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
type: Opaque
stringData:
PHOTOPRISM_ADMIN_PASSWORD: {{ $adminPassword | quote }}
{{- if ne $dbPassword "" }}
PHOTOPRISM_DATABASE_PASSWORD: {{ $dbPassword | quote }}
{{- end }}