From c58bb4800dee169479ba601aec22cb5841745ba7 Mon Sep 17 00:00:00 2001
From: Jansen Fuller <jansendfuller@mailfence.com>
Date: Fri, 1 May 2026 11:07:42 -0600
Subject: [PATCH] Fix plain connection string in pod env

---
 .../templates/_helpers.tpl                    | 57 +++++--------------
 .../templates/deployment.yaml                 | 14 +++--
 .../templates/secrets/postgres-secret.yaml    | 11 ++++
 .../templates/serviceaccount.yaml             | 38 +++++++++++++
 helm/taskchampion-sync-server/values.yaml     | 11 +++-
 5 files changed, 79 insertions(+), 52 deletions(-)
 create mode 100644 helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
 create mode 100644 helm/taskchampion-sync-server/templates/serviceaccount.yaml

diff --git a/helm/taskchampion-sync-server/templates/_helpers.tpl b/helm/taskchampion-sync-server/templates/_helpers.tpl
index b436ee4..da1a417 100644
--- a/helm/taskchampion-sync-server/templates/_helpers.tpl
+++ b/helm/taskchampion-sync-server/templates/_helpers.tpl
@@ -41,50 +41,11 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{- define "taskchampion-sync-server.postgres-connection" -}}
-  {{- $secret := .Values.postgres.existingSecret -}}
-  {{- $secretData := "" -}}
-  {{- if $secret -}}
-    {{- $secretData = (lookup "v1" "Secret" .Release.Namespace $secret).data -}}
-  {{- end -}}
-  
-  {{- $host := "" -}}
-  {{- $port := "5432" -}}
-  {{- $username := "" -}}
-  {{- $password := "" -}}
-  {{- $database := "taskchampion" -}}
-  
-  {{- /* Get values from secret (higher priority) */ -}}
-  {{- if $secretData -}}
-    {{- if hasKey $secretData "host" -}}
-      {{- $host = (b64dec $secretData.host) -}}
-    {{- end -}}
-    {{- if hasKey $secretData "port" -}}
-      {{- $port = (b64dec $secretData.port) -}}
-    {{- end -}}
-    {{- if hasKey $secretData "username" -}}
-      {{- $username = (b64dec $secretData.username) -}}
-    {{- end -}}
-    {{- if hasKey $secretData "password" -}}
-      {{- $password = (b64dec $secretData.password) -}}
-    {{- end -}}
-    {{- if hasKey $secretData "database" -}}
-      {{- $database = (b64dec $secretData.database) -}}
-    {{- end -}}
-  {{- end -}}
-  
-  {{- /* Fallback to values.yaml */ -}}
-  {{- if eq $host "" -}}
-    {{- $host = .Values.postgres.host -}}
-  {{- end -}}
-  {{- if eq $username "" -}}
-    {{- $username = .Values.postgres.username -}}
-  {{- end -}}
-  {{- if eq $password "" -}}
-    {{- $password = .Values.postgres.password -}}
-  {{- end -}}
-  {{- if eq $database "" -}}
-    {{- $database = .Values.postgres.database -}}
-  {{- end -}}
+  {{- $host := .Values.postgres.host -}}
+  {{- $port := .Values.postgres.port | quote -}}
+  {{- $username := .Values.postgres.username -}}
+  {{- $password := .Values.postgres.password -}}
+  {{- $database := .Values.postgres.database -}}
   
   {{- /* Build URI */ -}}
   {{- $uri := printf "postgresql://" -}}
@@ -104,3 +65,11 @@ app.kubernetes.io/instance: {{ .Release.Name }}
   {{- end -}}
   {{- $uri -}}
 {{- end -}}
+
+{{- define "taskchampion-sync-server.postgres-secret-name" -}}
+  {{- if .Values.postgres.existingSecret -}}
+    {{- .Values.postgres.existingSecret -}}
+  {{- else -}}
+    {{- include "taskchampion-sync-server.fullname" . -}}
+  {{- end }}
+{{- end -}}
\ No newline at end of file
diff --git a/helm/taskchampion-sync-server/templates/deployment.yaml b/helm/taskchampion-sync-server/templates/deployment.yaml
index ccc44b1..f059489 100644
--- a/helm/taskchampion-sync-server/templates/deployment.yaml
+++ b/helm/taskchampion-sync-server/templates/deployment.yaml
@@ -18,11 +18,10 @@ spec:
       labels:
         {{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
     spec:
-      {{- with .Values.image.pullSecrets }}
-      imagePullSecrets:
-        {{- range . }}
-        - name: {{ . }}
-        {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "taskchampion-sync-server.fullname" . }}
+      {{- else if .Values.serviceAccount.name }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- end }}
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
@@ -52,7 +51,10 @@ spec:
             {{- end }}
             {{- if eq .Values.postgres.enabled true }}
             - name: CONNECTION
-              value: {{ include "taskchampion-sync-server.postgres-connection" . | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+                  key: connection
             {{- end }}
           ports:
             - name: http
diff --git a/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml b/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
new file mode 100644
index 0000000..30fd22c
--- /dev/null
+++ b/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.postgres.enabled (eq .Values.postgres.existingSecret "") -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+type: Opaque
+data:
+  connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
+{{- end -}}
\ No newline at end of file
diff --git a/helm/taskchampion-sync-server/templates/serviceaccount.yaml b/helm/taskchampion-sync-server/templates/serviceaccount.yaml
new file mode 100644
index 0000000..d4742a8
--- /dev/null
+++ b/helm/taskchampion-sync-server/templates/serviceaccount.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-binding
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
+subjects:
+- kind: ServiceAccount
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
\ No newline at end of file
diff --git a/helm/taskchampion-sync-server/values.yaml b/helm/taskchampion-sync-server/values.yaml
index b305ba7..9ffac05 100644
--- a/helm/taskchampion-sync-server/values.yaml
+++ b/helm/taskchampion-sync-server/values.yaml
@@ -79,10 +79,17 @@ sqlite:
     storageClass: ""
     existingClaim: ""
 
-# PostgreSQL backend configuration (mutually exclusive with sqlite)
+# Service account configuration
+serviceAccount:
+  create: true  # Default: automatically create service account
+  name: ""      # Optional: use existing service account
+  annotations: {}
+
+# PostgreSQL configuration
 postgres:
   enabled: false
-  existingSecret: ""
+  existingSecret: ""  # If empty, auto-create secret; if provided, use existing
+  # Individual connection components for building connection string
   database: taskchampion
   host: postgres
   port: 5432