Preparing database credentials

The helm chart v2.0.0 requires a pre-existing database credentials Secret and no longer creates the Secret from Helm values during installation.

For upgrades from Helm chart v1.1.0, the Helm-managed database-secrets resource is retained and can continue to use its default name. Helm chart v1.0.0 does not retain this Secret.

The following procedure creates a new unmanaged Secret by copying the existing database credentials. The procedure is applicable to upgrades from either version. It copies the encoded Secret data without exposing the database password in command output.

kubectl -n pty-protegrity-agent get secret database-secrets -o json \
  | jq '{apiVersion: "v1", kind: "Secret", metadata: {name: "protegrity-agent-db-credentials", namespace: .metadata.namespace}, type: .type, data: {postgres_user: .data.postgres_user, postgres_password: .data.postgres_password}}' \
  | kubectl apply -f -

Add --set databaseService.credentials.existingSecretName=protegrity-agent-db-credentials flag to both Helm commands in while upgrading to prevent credential loss.