Add postgresql.passwordFromSecret flag to avoid duplicate PGPASSWORD env var (CE + EE)

[bxker]

Problem

In both helm-charts/mend-renovate-ce/templates/deployment.yaml and helm-charts/mend-renovate-ee/templates/server-deployment.yaml, the PGPASSWORD env entry is gated on:

{{- if or .Values.postgresql.enabled .Values.renovate.existingSecret }}        # CE
{{- if or .Values.postgresql.enabled .Values.renovateServer.existingSecret }}  # EE

This is the only secret-derived env var in each file gated on postgresql.enabled in addition to existingSecret — every other field (MEND_RNV_LICENSE_KEY, MEND_RNV_GITHUB_APP_KEY, GITHUB_COM_TOKEN, etc.) is gated purely on (rawValue OR existingSecret).

Consequence: a user who sets postgresql.enabled: true (to get PGDATABASE/PGUSER/PGPORT/PGHOST rendered from values) but supplies PGPASSWORD themselves via extraEnvVars (e.g. sourced from an external-secrets-managed Kubernetes Secret, not this chart's own existingSecret/auto-created Secret) ends up with two PGPASSWORD env entries on the container — one from extraEnvVars, one chart-injected from the auto-created (and in this scenario, empty) chart Secret. This duplicate caused a pod crash loop in our environment.

Proposed change

Add postgresql.passwordFromSecret (bool, default true) to both charts' values.yaml, and change the guard in each deployment template to:

{{- if and .Values.postgresql.passwordFromSecret (or .Values.postgresql.enabled .Values.renovate.existingSecret) }}        # CE
{{- if and .Values.postgresql.passwordFromSecret (or .Values.postgresql.enabled .Values.renovateServer.existingSecret) }}  # EE

Default true reproduces the current condition exactly (and true X == X) — no behavior change for anyone who doesn't set the new flag. Setting postgresql.passwordFromSecret: false opts out of the chart's own PGPASSWORD injection while still rendering PGDATABASE/PGUSER/PGPORT/PGHOST from postgresql.* — for use when PGPASSWORD is supplied via extraEnvVars or another external mechanism.

No change to either chart's secret.yaml — the chart's auto-created Secret still exists and still gets a pgPassword key when .Values.postgresql.password is set; the container simply won't reference it for PGPASSWORD when the new flag is false.

Backward-compatibility verification (both charts)

Rendered each chart with default values before and after this change — no diff:

$ helm template test helm-charts/mend-renovate-ce > before.yaml   # (main branch)
$ helm template test helm-charts/mend-renovate-ce > after.yaml    # (this branch)
$ diff before.yaml after.yaml
# (no output)

$ helm template test helm-charts/mend-renovate-ee > before.yaml   # (main branch)
$ helm template test helm-charts/mend-renovate-ee > after.yaml    # (this branch)
$ diff before.yaml after.yaml
# (no output)

Rendered each chart with postgresql.enabled: true + passwordFromSecret: false + an external PGPASSWORD via extraEnvVars/renovateServer.extraEnvVars — confirmed exactly one PGPASSWORD entry in both, with PGDATABASE/PGUSER/PGPORT/PGHOST still present. Rendered the same values without the new flag set (reproducing the original bug) in both — confirmed two PGPASSWORD entries, demonstrating the flag is necessary and correctly scoped in both charts.

helm lint — 0 failures on both helm-charts/mend-renovate-ce and helm-charts/mend-renovate-ee.

Example usage

postgresql:
  enabled: true
  passwordFromSecret: false   # PGPASSWORD supplied via extraEnvVars below
  user: "svc_renovate"
  database: "renovate"
  port: 5432
  host: "your-postgres-host"
renovate:            # CE
  extraEnvVars:
    - name: PGPASSWORD
      valueFrom:
        secretKeyRef:
          name: your-external-secret
          key: pgPassword
renovateServer:       # EE
  extraEnvVars:
    - name: PGPASSWORD
      valueFrom:
        secretKeyRef:
          name: your-external-secret
          key: pgPassword

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds the postgresql.passwordFromSecret Helm value, defaulting to true, to control chart-managed PGPASSWORD injection in CE and EE Deployments. The Deployments source PGPASSWORD from the chart Secret only when this setting is enabled and PostgreSQL is enabled or an existing Secret is configured.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: gabriel-ladzaretti, nabeelsaabna

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly names the new postgresql.passwordFromSecret flag and the duplicate PGPASSWORD env var fix across CE and EE.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nabeelsaabna]

please do the same for renovate-ee chart

[bxker]

please do the same for renovate-ee chart

Just added the changes to the mend-renovate-ee chart as well.