fix(helm): 修正 CI 渲染与 PostgreSQL 管理员密码引用

同步 Helm CI matrix 与当前 values schema 和确定性凭据策略。

- 所有 CI 渲染加载测试凭据并迁移 Ingress TLS 数组配置
- PostgreSQL 使用 postgres 用户时引用管理员密码 key
- 增加内置 Secret 和 existingSecret 的管理员用户契约测试

Signed-off-by: lhb6540 <lhb6540@gmail.com>

.github/workflows/pr-helm-chart.yml

@@ -98,7 +98,8 @@ jobs:
             description: Ingress + TLS + cert-manager
             args: >-
               --set ingress.enabled=true
-              --set ingress.tls.enabled=true
+              --set-json 'ingress.hosts=[{"host":"skills.example.com","paths":[{"path":"/","pathType":"Prefix"}]}]'
+              --set-json 'ingress.tls=[{"hosts":["skills.example.com"],"secretName":"skills-tls"}]'
               --set ingress.certManager.enabled=true
           - name: s3-storage
             description: S3 存储
@@ -143,7 +144,7 @@ jobs:
       - name: Render template - ${{ matrix.scenario.name }}
         run: |
           echo "## ${{ matrix.scenario.description }}"
-          helm template test-release . ${{ matrix.scenario.args }} > rendered.yaml
+          helm template test-release . -f tests/test-values.yaml ${{ matrix.scenario.args }} > rendered.yaml
           echo "✅ Template rendered successfully"
 
       - name: Validate resources
@@ -158,7 +159,7 @@ jobs:
       - name: Validate default dependency wiring
         if: ${{ matrix.scenario.name == 'bitnami-default' }}
         run: |
-          helm template test-release . --show-only templates/server-deployment.yaml > server.yaml
+          helm template test-release . -f tests/test-values.yaml --show-only templates/server-deployment.yaml > server.yaml
           grep -Fq 'value: "test-release-postgresql"' server.yaml
           grep -Fq 'value: "test-release-redis-master"' server.yaml
           grep -Fq 'name: test-release-postgresql' server.yaml

charts/skillhub/templates/_helpers.tpl

@@ -148,9 +148,13 @@ app.kubernetes.io/component: scanner
 {{- end -}}
 {{- end }}
 
-{{- /* PostgreSQL 应用用户密码 Secret key */}}
+{{- /* PostgreSQL 密码 Secret key；postgres 使用管理员密码，其他用户使用应用密码 */}}
 {{- define "skillhub.postgresql.passwordKey" -}}
+{{- if eq .Values.postgresql.auth.username "postgres" -}}
+{{- .Values.postgresql.auth.secretKeys.adminPasswordKey | default "postgres-password" -}}
+{{- else -}}
 {{- .Values.postgresql.auth.secretKeys.userPasswordKey | default "password" -}}
+{{- end -}}
 {{- end }}
 
 {{- /* PostgreSQL JDBC URL */}}

charts/skillhub/tests/configuration-contracts.sh

@@ -72,6 +72,27 @@ grep -Fq 'key: custom-pg-key' "$TMP_DIR/custom.yaml"
 grep -Fq 'name: custom-redis' "$TMP_DIR/custom.yaml"
 grep -Fq 'key: custom-redis-key' "$TMP_DIR/custom.yaml"
 
+render postgresql-admin "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --show-only templates/server-deployment.yaml >"$TMP_DIR/postgresql-admin.yaml"
+grep -Fq 'value: "postgres"' "$TMP_DIR/postgresql-admin.yaml"
+grep -Fq 'key: postgres-password' "$TMP_DIR/postgresql-admin.yaml"
+render postgresql-admin-secret "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --show-only charts/postgresql/templates/secrets.yaml >"$TMP_DIR/postgresql-admin-secret.yaml"
+grep -Eq '^  postgres-password:' "$TMP_DIR/postgresql-admin-secret.yaml"
+if grep -Eq '^  password:' "$TMP_DIR/postgresql-admin-secret.yaml"; then
+  fail "Bitnami PostgreSQL must not create a custom-user password key for username=postgres"
+fi
+
+render postgresql-admin-existing-secret "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --set postgresql.auth.existingSecret=custom-pg-admin \
+  --set postgresql.auth.secretKeys.adminPasswordKey=custom-admin-key \
+  --show-only templates/server-deployment.yaml >"$TMP_DIR/postgresql-admin-existing-secret.yaml"
+grep -Fq 'name: custom-pg-admin' "$TMP_DIR/postgresql-admin-existing-secret.yaml"
+grep -Fq 'key: custom-admin-key' "$TMP_DIR/postgresql-admin-existing-secret.yaml"
+
 render sentinel "$CHART_DIR" \
   --set redis.architecture=replication \
   --set redis.sentinel.enabled=true \