More options for elasticsearch secret creation

Sometimes you don't want to include secret data in Git manifest
for security reasons, e.g. when storing manifests in Git and
deploying with ArgoCD.

However, you may still want to generate a secret itself and then
edit it's data section later, e.g. manually with kubectl.

Provide more options of generating the secret while keeping
backwards compatibility.

related: apache#45140

Signed-off-by: Andrii Korotkov <[email protected]>

Author: andrii-korotkov-verkada

chart/templates/secrets/elasticsearch-secret.yaml

@@ -20,11 +20,11 @@
 ################################
 ## Elasticsearch Secret
 #################################
-{{- if (and .Values.elasticsearch.enabled (not .Values.elasticsearch.secretName)) }}
+{{- if (and .Values.elasticsearch.enabled (or (not .Values.elasticsearch.secretName) .Values.elasticsearch.alwaysGenerateSecret)) }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "airflow.fullname" . }}-elasticsearch
+  name: {{ template "elasticsearch_secret" . }}
   labels:
     release: {{ .Release.Name }}
     chart: {{ .Chart.Name }}
@@ -33,12 +33,14 @@ metadata:
       {{- toYaml . | nindent 4 }}
     {{- end }}
 type: Opaque
+{{- with .Values.elasticsearch.connection }}
+{{- if . }}
 data:
-  {{- with .Values.elasticsearch.connection }}
-    {{- if and .user .pass }}
-      connection: {{ urlJoin (dict "scheme" (default "http" .scheme) "userinfo" (printf "%s:%s" (.user | urlquery) (.pass | urlquery)) "host" (printf "%s:%s" .host ((default 9200 .port) | toString) ) ) | b64enc | quote }}
-    {{- else }}
-    connection: {{ urlJoin (dict "scheme" (default "http" .scheme) "host" (printf "%s:%s" .host ((default 9200 .port) | toString))) | b64enc | quote }}
-    {{- end }}
+  {{- if and .user .pass }}
+  connection: {{ urlJoin (dict "scheme" (default "http" .scheme) "userinfo" (printf "%s:%s" (.user | urlquery) (.pass | urlquery)) "host" (printf "%s:%s" .host ((default 9200 .port) | toString) ) ) | b64enc | quote }}
+  {{- else }}
+  connection: {{ urlJoin (dict "scheme" (default "http" .scheme) "host" (printf "%s:%s" .host ((default 9200 .port) | toString))) | b64enc | quote }}
   {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}

chart/values.schema.json

@@ -8000,6 +8000,11 @@
                     ],
                     "default": null
                 },
+                "alwaysGenerateSecret": {
+                    "description": "Whether to generate a secret even if secret name is specified.",
+                    "type": "boolean",
+                    "default": false
+                },
                 "connection": {
                     "description": "Elasticsearch connection configuration.",
                     "type": "object",

chart/values.yaml

@@ -2463,6 +2463,8 @@ elasticsearch:
   enabled: false
   # A secret containing the connection
   secretName: ~
+  # Whether to generate a secret even if secret name is specified
+  alwaysGenerateSecret: false
   # Or an object representing the connection
   # Example:
   # connection: