secret.yaml

{{- if and (not .Values.externalSecrets.enabled) (not .Values.externalSecrets.externalSecretsOperator.enabled) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "retool.fullname" . }}
{{- if or (not .Values.retoolJwtSecret) (not .Values.config.encryptionKey) }}
  labels:
    {{- include "retool.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": no-upgrade-existing
{{- end }}
type: Opaque
{{- $secretName := (include "retool.fullname" .) }}
{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName | default dict }}
{{- $secretData := (get $secret "data") | default dict }}
data:
  {{ if and (not .Values.env.RETOOL_LOAD_FILE_SECRETS) (not .Values.env.LICENSE_KEY_FILE) }}
  license-key: {{ .Values.config.licenseKey | default "" | b64enc | quote }}
  {{ end }}


  {{ if and (not .Values.env.RETOOL_LOAD_FILE_SECRETS) (not .Values.env.JWT_SECRET_FILE) }}
  {{ if not .Values.config.jwtSecretSecretName }}
  {{ if .Values.config.jwtSecret }}
  jwt-secret: {{ .Values.config.jwtSecret | b64enc | quote }}
  {{ else if (get $secretData "jwt-secret") }}
  jwt-secret: {{ (get $secretData "jwt-secret") }}
  {{ else }}
  jwt-secret: {{ randAlphaNum 20 | b64enc | quote }}
  {{ end }}
  {{ end }}
  {{ end }}

  {{ if and (not .Values.env.RETOOL_LOAD_FILE_SECRETS) (not .Values.env.ENCRYPTION_KEY_FILE) }}
  {{ if not .Values.config.encryptionKeySecretName }}
  {{ if .Values.config.encryptionKey }}
  encryption-key: {{ .Values.config.encryptionKey | b64enc | quote }}
  {{ else if (get $secretData "encryption-key") }}
  encryption-key: {{ get $secretData "encryption-key" }}
  {{ else }}
  encryption-key: {{ required "Please set a value for .Values.config.encryptionKey" .Values.config.encryptionKey }}
  {{ end }}
  {{ end }}
  {{ end }}

  {{ if and (not .Values.env.RETOOL_LOAD_FILE_SECRETS) (not .Values.env.GOOGLE_CLIENT_SECRET_FILE) }}
  {{ if .Values.config.auth.google.clientSecret }}
  google-client-secret: {{ .Values.config.auth.google.clientSecret | b64enc | quote }}
  {{ else  }}
  google-client-secret: ""
  {{ end }}
  {{ end }}

  {{ if not .Values.postgresql.enabled }}
  {{ if and (not .Values.env.RETOOL_LOAD_FILE_SECRETS) (not .Values.env.POSTGRES_PASSWORD_FILE) }}
  postgresql-password: {{ .Values.config.postgresql.password | default "" | b64enc | quote }}
  {{ end }}
  {{ end }}
{{- end }}