Simplifying secret management

helm/taskchampion-sync-server/README.md

@@ -43,18 +43,17 @@ Reference it via `clientIdSecret: "my-client-ids"`.
 
 ### PostgreSQL Secret
 
-```yaml
+For PostgreSQL, the chart can automatically create a secret with the connection string, or use an existing secret. 
-apiVersion: v1
-kind: Secret
-metadata:
-  name: my-postgres-creds
-type: Opaque
-data:
-  connection: <base64-encoded LibPQ connection URI>
-  password: <base64-encoded password>
-```
 
-Reference it via `postgres.existingSecret: "my-postgres-creds"`.
+**Automatic Secret Creation**:
+- When `postgres.existingSecret` is empty (default), the chart automatically creates a secret
+- Secret is named using Helm naming convention: `release-name-taskchampion-sync-server`
+- Secret contains only a `connection` key with the built connection string
+
+**Existing Secret Usage**:
+- When `postgres.existingSecret` is provided, the chart uses that secret
+- The secret **must** contain a `connection` key with the PostgreSQL connection string
+- If the secret doesn't have a `connection` key, the deployment will fail with a clear error
 
 ## Configuration
 

helm/taskchampion-sync-server/examples/postgres-values.yaml

@@ -3,7 +3,6 @@ sqlite:
 
 postgres:
   enabled: true
-  existingSecret: "taskchampion-postgres-creds"
   database: taskchampion
   host: postgres-primary
   username: taskchampion-user

helm/taskchampion-sync-server/templates/_helpers.tpl

@@ -67,9 +67,5 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "taskchampion-sync-server.postgres-secret-name" -}}
-  {{- if .Values.postgres.existingSecret -}}
+{{- printf "%s-connection" .Release.Name -}}
-    {{- .Values.postgres.existingSecret -}}
-  {{- else -}}
-    {{- include "taskchampion-sync-server.fullname" . -}}
-  {{- end }}
 {{- end -}}

helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml

@@ -1,11 +1,11 @@
-{{- if and .Values.postgres.enabled (eq .Values.postgres.existingSecret "") -}}
+{{- if .Values.postgres.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
+  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
   labels:
     {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
 type: Opaque
 data:
   connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
-{{- end -}}
+{{- end }}