Add volumes and volumeMounts values to the Helm chart for file-based credentials

.gitignore

@@ -1,5 +1,7 @@
 ### PostgreSQL Operator ###
 config/
+# Written by the fabric8 Kubernetes client when the tests run against the Dev Service
+.kube/
 
 ### STS ###
 .apt_generated

docs/cluster-connection.md

@@ -75,7 +75,63 @@ spec:
 
 > **Note:** The volume source can be any type that provides a file.
 
-> **Note:** The Helm chart does not support extra volumes yet.
+##### With the Helm chart
+
+The chart exposes the `app.volumes` and `app.volumeMounts` values. Both take the raw Kubernetes syntax, so any volume source works. Pass them in your own values file:
+
+```yaml
+app:
+  volumes:
+    - name: db-credentials
+      secret:
+        secretName: db-credentials-secret
+  volumeMounts:
+    - name: db-credentials
+      mountPath: /mnt/secrets
+      readOnly: true
+```
+
+```bash
+helm install postgresql-operator <chart-url> --values values.yaml
+```
+
+See the [installation section](../README.md#helm-chart) of the README for the chart URL.
+
+##### With the Secrets Store CSI driver
+
+Use this option to read the credentials from an external secret store, for example AWS Secrets Manager. The chart does not create the `SecretProviderClass`, so you have to apply it yourself:
+
+```yaml
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: db-credentials
+spec:
+  provider: aws
+  parameters:
+    objects: |
+      - objectName: "my/db/credentials"
+        objectAlias: "db-credentials.json"
+```
+
+Then reference it from the chart values:
+
+```yaml
+app:
+  volumes:
+    - name: db-credentials
+      csi:
+        driver: secrets-store.csi.k8s.io
+        readOnly: true
+        volumeAttributes:
+          secretProviderClass: db-credentials
+  volumeMounts:
+    - name: db-credentials
+      mountPath: /mnt/secrets
+      readOnly: true
+```
+
+> **Note:** The `SecretProviderClass` must live in the namespace of the operator.
 
 ### Examples
 

operator/src/main/helm/values.yaml

@@ -0,0 +1,22 @@
+---
+# This file overrides the default values that the quarkus-helm extension generates.
+#
+# Why it exists: a list field of the operator Deployment becomes a Helm value only if the key
+# already exists in `src/main/kubernetes/kubernetes.yml`. An empty list `[]` does not survive
+# there. The fabric8 model marks `PodSpec.imagePullSecrets`, `PodSpec.volumes` and
+# `Container.volumeMounts` with `@JsonInclude(NON_EMPTY)`. A list with one null element does
+# survive, but the generated default is then unusable, so this file replaces it with a real
+# empty list.
+#
+# The unusable default takes one of two shapes, and the path of the value decides which:
+#   - A plain path, such as `spec.template.spec.volumes`, produces `- {}`, a list that holds
+#     one empty object. A user who copies that default and appends an entry gets invalid YAML.
+#   - A container-filtered path, such as
+#     `spec.template.spec.containers.(name == postgresql-operator).volumeMounts`, produces
+#     `{}`, an object. That shape also contradicts the `type: array` of `values.schema.json`.
+#
+# See https://github.com/quarkiverse/quarkus-helm/issues/453
+app:
+  imagePullSecrets: []
+  volumes: []
+  volumeMounts: []

operator/src/main/kubernetes/kubernetes.yml

@@ -7,4 +7,10 @@ spec:
   template:
     spec:
       affinity: {}
+      # The `[~]` placeholders are required, see operator/src/main/helm/values.yaml for the reason.
       imagePullSecrets: [~]
+      volumes: [~]
+      containers:
+        # The name must match `quarkus.kubernetes.name`, otherwise Dekorate adds a second container.
+        - name: postgresql-operator
+          volumeMounts: [~]

operator/src/main/resources/application.yml

@@ -86,12 +86,9 @@ quarkus:
           - (kind == Deployment).spec.template.spec.containers.(name == ${quarkus.kubernetes.name}).imagePullPolicy
       image-pull-secrets:
         property: imagePullSecrets
-        value:
-          - null
         paths:
           - (kind == Deployment).spec.template.spec.imagePullSecrets
-        expression: "{{- if eq (toYaml .Values.app.imagePullSecrets | trim) \"- {}\" }} null{{- else }}{{- toYaml .Values.app.imagePullSecrets | nindent 8 }}{{- end }}"
-        description: Kubernetes image pull secrets to use if the OCI image is hosted on a private registry
+        expression: "{{- toYaml (.Values.app.imagePullSecrets | default list) | nindent 8 }}"
       resource-requests-cpu:
         property: resources.requests.cpu
         value: ${quarkus.kubernetes.resources.requests.cpu}
@@ -113,6 +110,16 @@ quarkus:
         paths:
           - (kind == Deployment).spec.template.spec.affinity
         description: Kubernetes affinity configuration for Pod scheduling
+      volumes:
+        property: volumes
+        paths:
+          - (kind == Deployment).spec.template.spec.volumes
+        expression: "{{- toYaml (.Values.app.volumes | default list) | nindent 8 }}"
+      volume-mounts:
+        property: volumeMounts
+        paths:
+          - (kind == Deployment).spec.template.spec.containers.(name == ${quarkus.kubernetes.name}).volumeMounts
+        expression: "{{- toYaml (.Values.app.volumeMounts | default list) | nindent 12 }}"
       console-color:
         property: envs.QUARKUS_CONSOLE_COLOR
         value-as-bool: ${quarkus.console.color}
@@ -127,9 +134,26 @@ quarkus:
         description: Specify the format of the produced JSON. Supported values are "DEFAULT", "ECS", and "GCP".
     values-schema:
       properties:
+        # The type must be set explicitly for every non-scalar value, because the generated
+        # schema otherwise falls back to `string`.
+        #
+        # A value that `src/main/helm/values.yaml` provides also loses the `description` of its
+        # `quarkus.helm.values` entry, so the description belongs here instead.
         "affinity":
           name: app.affinity
           type: object
+        "imagePullSecrets":
+          name: app.imagePullSecrets
+          type: array
+          description: Kubernetes image pull secrets to use if the OCI image is hosted on a private registry
+        "volumes":
+          name: app.volumes
+          type: array
+          description: Additional volumes for the operator Pod, for example a Secret volume or a Secrets Store CSI volume
+        "volumeMounts":
+          name: app.volumeMounts
+          type: array
+          description: Additional volume mounts for the operator container
     expressions:
       release-name-labels:
         expression: "{{ .Release.Name }}"