From f3dbb57a806db620ae83cd76433b8efa69cb5a02 Mon Sep 17 00:00:00 2001
From: lhb6540 <lhb6540@gmail.com>
Date: Mon, 20 Jul 2026 11:35:44 +0800
Subject: [PATCH] =?UTF-8?q?fix(helm):=20=E4=BF=AE=E6=AD=A3=20CI=20?=
 =?UTF-8?q?=E6=B8=B2=E6=9F=93=E4=B8=8E=20PostgreSQL=20=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E5=91=98=E5=AF=86=E7=A0=81=E5=BC=95=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

同步 Helm CI matrix 与当前 values schema 和确定性凭据策略。

- 所有 CI 渲染加载测试凭据并迁移 Ingress TLS 数组配置
- PostgreSQL 使用 postgres 用户时引用管理员密码 key
- 增加内置 Secret 和 existingSecret 的管理员用户契约测试

Signed-off-by: lhb6540 <lhb6540@gmail.com>
---
 .github/workflows/pr-helm-chart.yml           |  7 ++++---
 charts/skillhub/templates/_helpers.tpl        |  6 +++++-
 .../skillhub/tests/configuration-contracts.sh | 21 +++++++++++++++++++
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-helm-chart.yml b/.github/workflows/pr-helm-chart.yml
index bc5d8e03..5ec348d3 100644
--- a/.github/workflows/pr-helm-chart.yml
+++ b/.github/workflows/pr-helm-chart.yml
@@ -98,7 +98,8 @@ jobs:
             description: Ingress + TLS + cert-manager
             args: >-
               --set ingress.enabled=true
-              --set ingress.tls.enabled=true
+              --set-json 'ingress.hosts=[{"host":"skills.example.com","paths":[{"path":"/","pathType":"Prefix"}]}]'
+              --set-json 'ingress.tls=[{"hosts":["skills.example.com"],"secretName":"skills-tls"}]'
               --set ingress.certManager.enabled=true
           - name: s3-storage
             description: S3 存储
@@ -143,7 +144,7 @@ jobs:
       - name: Render template - ${{ matrix.scenario.name }}
         run: |
           echo "## ${{ matrix.scenario.description }}"
-          helm template test-release . ${{ matrix.scenario.args }} > rendered.yaml
+          helm template test-release . -f tests/test-values.yaml ${{ matrix.scenario.args }} > rendered.yaml
           echo "✅ Template rendered successfully"
 
       - name: Validate resources
@@ -158,7 +159,7 @@ jobs:
       - name: Validate default dependency wiring
         if: ${{ matrix.scenario.name == 'bitnami-default' }}
         run: |
-          helm template test-release . --show-only templates/server-deployment.yaml > server.yaml
+          helm template test-release . -f tests/test-values.yaml --show-only templates/server-deployment.yaml > server.yaml
           grep -Fq 'value: "test-release-postgresql"' server.yaml
           grep -Fq 'value: "test-release-redis-master"' server.yaml
           grep -Fq 'name: test-release-postgresql' server.yaml
diff --git a/charts/skillhub/templates/_helpers.tpl b/charts/skillhub/templates/_helpers.tpl
index d287cfeb..2f4b9321 100644
--- a/charts/skillhub/templates/_helpers.tpl
+++ b/charts/skillhub/templates/_helpers.tpl
@@ -148,9 +148,13 @@ app.kubernetes.io/component: scanner
 {{- end -}}
 {{- end }}
 
-{{- /* PostgreSQL 应用用户密码 Secret key */}}
+{{- /* PostgreSQL 密码 Secret key；postgres 使用管理员密码，其他用户使用应用密码 */}}
 {{- define "skillhub.postgresql.passwordKey" -}}
+{{- if eq .Values.postgresql.auth.username "postgres" -}}
+{{- .Values.postgresql.auth.secretKeys.adminPasswordKey | default "postgres-password" -}}
+{{- else -}}
 {{- .Values.postgresql.auth.secretKeys.userPasswordKey | default "password" -}}
+{{- end -}}
 {{- end }}
 
 {{- /* PostgreSQL JDBC URL */}}
diff --git a/charts/skillhub/tests/configuration-contracts.sh b/charts/skillhub/tests/configuration-contracts.sh
index e3b33b7b..acf671a6 100755
--- a/charts/skillhub/tests/configuration-contracts.sh
+++ b/charts/skillhub/tests/configuration-contracts.sh
@@ -72,6 +72,27 @@ grep -Fq 'key: custom-pg-key' "$TMP_DIR/custom.yaml"
 grep -Fq 'name: custom-redis' "$TMP_DIR/custom.yaml"
 grep -Fq 'key: custom-redis-key' "$TMP_DIR/custom.yaml"
 
+render postgresql-admin "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --show-only templates/server-deployment.yaml >"$TMP_DIR/postgresql-admin.yaml"
+grep -Fq 'value: "postgres"' "$TMP_DIR/postgresql-admin.yaml"
+grep -Fq 'key: postgres-password' "$TMP_DIR/postgresql-admin.yaml"
+render postgresql-admin-secret "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --show-only charts/postgresql/templates/secrets.yaml >"$TMP_DIR/postgresql-admin-secret.yaml"
+grep -Eq '^  postgres-password:' "$TMP_DIR/postgresql-admin-secret.yaml"
+if grep -Eq '^  password:' "$TMP_DIR/postgresql-admin-secret.yaml"; then
+  fail "Bitnami PostgreSQL must not create a custom-user password key for username=postgres"
+fi
+
+render postgresql-admin-existing-secret "$CHART_DIR" \
+  --set postgresql.auth.username=postgres \
+  --set postgresql.auth.existingSecret=custom-pg-admin \
+  --set postgresql.auth.secretKeys.adminPasswordKey=custom-admin-key \
+  --show-only templates/server-deployment.yaml >"$TMP_DIR/postgresql-admin-existing-secret.yaml"
+grep -Fq 'name: custom-pg-admin' "$TMP_DIR/postgresql-admin-existing-secret.yaml"
+grep -Fq 'key: custom-admin-key' "$TMP_DIR/postgresql-admin-existing-secret.yaml"
+
 render sentinel "$CHART_DIR" \
   --set redis.architecture=replication \
   --set redis.sentinel.enabled=true \