Support GCP service account for IAM auth with existing Cloud SQL Proxy

[Momotoculteur]

Describe the problem

Currently, the chart only supports static credentials. I’d like to be able to provide a GCP service account so that the pod can authenticate through the existing proxy.

I already run a Cloud SQL Auth Proxy locally via sidecar in the pod, and could connect via psql:
psql -h <db_adress> -p <db_port> -U <iam_account> <database>"

Solution brainstorm

Allow Weblate Helm chart to connect to a Cloud SQL PostgreSQL instance via IAM authentication using an existing Cloud SQL Auth Proxy, without requiring username/password in the chart.

Maybe add as redis, add postgresql.auth.enabled: false in order to use only username/adress/port ?

Describe alternatives you have considered

No response

Screenshots

No response

Additional context

No response

[Momotoculteur]

Workaround which allow to use IAM authentication and work for us, is to set with a random one like postgresql.auth.postgresPassword: "test" in values.yaml

[Mart-Kuc]

Hello @Momotoculteur,

It seems to me that this is not directly related to the Weblate Helm chart. Your suggestion appears to be more related to the Weblate application itself rather than the Helm chart.

As far as I know, you are correct that the application currently expects a static username and password to connect to PostgreSQL. The application itself would need to support a configuration where the database password is either empty or retrieved dynamically.

Or am I missing something?

[Momotoculteur]

Hello @Momotoculteur,
...
The application itself would need to support a configuration where the database password is either empty or retrieved dynamically.

Hey !
You're absolutely right. I just want to notice that make no sence to have a random password as i have in my chart, just to be able to fake the app to boot with password (by memory i get an error with empty password like : OS.env.get(POSTGRES_PASSWORD, required).
That why my initial proposition was to have the possibility to disabled auth like in redis, that avoid me to declare postgresql.auth.postgresPassword