feat: allow to pass external secret for DD API key and users.toml

Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 name: pgdog
-version: v0.64
-appVersion: "0.1.43"
+version: v0.65
+appVersion: "0.1.44"

README.md

@@ -178,6 +178,60 @@ externalSecrets:
   secretName: "my-secret" # Name of Secret you created
 ```
 
+### Referencing Existing Secrets
+
+If you manage Kubernetes Secrets yourself (via `kubectl`, sealed-secrets,
+SOPS, etc.), point the chart at them directly instead of putting secret
+values in `values.yaml`. This works without the ExternalSecrets operator.
+
+#### users.toml from an existing Secret
+
+Set `usersSecret.name` to reference a Secret you created that holds the
+`users.toml` file. The chart then skips rendering its own users Secret and
+mounts yours instead:
+
+```yaml
+usersSecret:
+  name: my-pgdog-users # existing Secret in the same namespace
+  key: users.toml      # key holding the users.toml content (default: users.toml)
+```
+
+Create the Secret, for example:
+
+```bash
+kubectl create secret generic my-pgdog-users \
+  --from-file=users.toml=./users.toml
+```
+
+The value is mounted at `/etc/secrets/pgdog/users.toml` regardless of the
+key name. A custom `key` is remapped automatically.
+
+#### Datadog API key from an existing Secret
+
+PgDog reads the Datadog API key from the `DD_API_KEY` environment variable.
+Reference an existing Secret and the chart injects it as `DD_API_KEY`, so the
+key is never written into `pgdog.toml` (or the ConfigMap):
+
+```yaml
+otel:
+  endpoint: https://otlp.example.com/v1/metrics # your OTLP endpoint
+  datadogApiKeySecret:
+    name: my-datadog # existing Secret in the same namespace
+    key: dd-api-key  # key holding the API key (default: dd-api-key)
+```
+
+Create the Secret, for example:
+
+```bash
+kubectl create secret generic my-datadog \
+  --from-literal=dd-api-key=<your-datadog-api-key>
+```
+
+This is mutually exclusive with the inline `otel.datadogApiKey`, which writes
+the key into the ConfigMap as plaintext and should be avoided.
+
+If both are set, the inline value takes precedence.
+
 ### ServiceAccount & RBAC
 
 RBAC with minimal permissions is enabled by default:

templates/deployment.yaml

@@ -85,6 +85,17 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
+            {{- with .Values.otel }}
+            {{- with .datadogApiKeySecret }}
+            {{- if .name }}
+            - name: DD_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .name }}
+                  key: {{ .key | default "dd-api-key" }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
             {{- range .Values.env }}
             {{- if ne .name "NODE_ID" }}
             - {{- toYaml . | nindent 14 }}
@@ -181,7 +192,12 @@ spec:
             name: {{ include "pgdog.fullname" . }}
         - name: users
           secret:
-            {{- if and .Values.externalSecrets.enabled
+            {{- if .Values.usersSecret.name }}
+            secretName: {{ .Values.usersSecret.name }}
+            items:
+              - key: {{ .Values.usersSecret.key | default "users.toml" }}
+                path: users.toml
+            {{- else if and .Values.externalSecrets.enabled
                        .Values.externalSecrets.secretName }}
             secretName: {{ .Values.externalSecrets.secretName }}
             {{- else }}

templates/secrets.yaml

@@ -44,7 +44,7 @@ server_auth = {{ .serverAuth | quote }}
 {{- end }}
 {{- end -}}
 
-{{- if not .Values.externalSecrets.enabled }}
+{{- if and (not .Values.externalSecrets.enabled) (not .Values.usersSecret.name) }}
 apiVersion: v1
 kind: Secret
 metadata:

test/values-existing-secrets.yaml

@@ -0,0 +1,22 @@
+# Test referencing existing, user-created Secrets instead of chart-rendered
+# ones. Covers:
+#   - usersSecret: mount users.toml from an existing Secret, with a custom key
+#     remapped to users.toml
+#   - otel.datadogApiKeySecret: inject the Datadog API key as the DD_API_KEY
+#     env var, keeping it out of pgdog.toml
+
+usersSecret:
+  name: my-pgdog-users
+  key: my-users-key.toml
+
+otel:
+  endpoint: https://otlp.example.com/v1/metrics
+  namespace: pgdog
+  datadogApiKeySecret:
+    name: my-datadog
+    key: api-key
+
+databases:
+  - name: primary
+    host: db.example.com
+    port: 5432

values.yaml

@@ -400,6 +400,32 @@ externalSecrets:
     #     key: pgdog/users
     #     property: users.toml
 
+# usersSecret references an existing Secret (that you created yourself in
+# this namespace) holding the users.toml file. When name is set, the chart
+# does not render its own users Secret and mounts this one instead.
+usersSecret:
+  # name of the existing Secret containing users.toml
+  name: ""
+  # key within that Secret whose value is the users.toml content;
+  # it is mounted at /etc/secrets/pgdog/users.toml regardless of the key name
+  key: users.toml
+
+# otel configures OpenTelemetry metrics export. Left unset by default so the
+# [otel] section is omitted from pgdog.toml. Uncomment and fill in to enable.
+# otel:
+#   endpoint: https://otlp.example.com/v1/metrics
+#   namespace: pgdog
+#   # Datadog API key options (mutually exclusive):
+#   #   datadogApiKey: inline value, written into pgdog.toml (plaintext in the
+#   #     ConfigMap) — avoid for real secrets.
+#   datadogApiKey: ""
+#   #   datadogApiKeySecret: inject the key from an existing Secret you created
+#   #     as the DD_API_KEY env var, which pgdog reads. Nothing is written into
+#   #     pgdog.toml. Preferred for real secrets.
+#   datadogApiKeySecret:
+#     name: ""          # existing Secret name
+#     key: dd-api-key   # key within that Secret holding the API key
+
 # ServiceMonitor for Prometheus metrics
 serviceMonitor:
   enabled: false