[xray] rabbitmq.auth.password must be set

[juame]

It is required to set a non-default password for rabbitmq.auth.password after the latest change:

charts/stable/xray/templates/keys-warnings.yaml

Lines 1 to 3 in c277c35

	{{- if and (not .Release.IsUpgrade) (eq .Values.rabbitmq.auth.password "password") .Values.rabbitmq.enabled }}
	{{- fail "\n\n**************************************\nSTOP! INSTALLATION not allowed with the default RabbitMQ password!\nPlease change the RabbitMQ password from the default value before proceeding with the installation.\n**************************************\n" }}
	{{- end }}

Unfortunately, it seems that the password in RabbitMQ is set from rabbitmq.auth.password. However, Xray is using the password defined in rabbitmq.auth.existingPasswordSecret (key rabbitmq-password).
Xray is unable to start if the password does not match the password in the secret key rabbitmq-password.

Helm values:

rabbitmq:
  auth:
    username: xrayuser
    password: password-set-in-rabbitmq
    existingPasswordSecret: xray-rabbitmq-creds # key: `rabbitmq-password`

I would expect that we could simply set the password in existingPasswordSecret and have it used by both Xray and RabbitMQ.

[rahulsadanandan]

Hi @juame, rabbitmq.existingPasswordSecret is not currently supported. Since we have custom loadDefinitions, the password needs to be specified there, and we reference it from rabbitmq.auth.password We will create an internal ticket and see how we can fix this.

Regarding the question

It is required to set a non-default password for rabbitmq.auth.password after the latest change

yes this is required now

[engnatha]

What's the proper way to not hardcode secrets in values files? When using tools like fluxcd/argocd where you can specify helm values in a repository, this pattern requires committing credentials to a visible repo.

[af-enj]

@engnatha as far as I know, there is no proper way for doing that. In my opinion the password check should be updated, to include "if password as secret is configured, then the check should be okay and rabbitmq.auth.password is ignored"

[zbialik]

I have also hit this issue and noticed that setting the rabbitmq.auth.password to some other invalid string does not fix the issue. It just avoid the helm check issue.

I think this is a result of this commit which relies on the rabbitmq.auth.password to define the load_definition secret, where that file should somehow be able to reference an external secret that we define under rabbitmq.auth.existingPasswordSecret.

[zbialik]

I think the best way to workaround this is to rely on one of these new helm values

rabbitmq:
    extraSecrets:
    load-definition:
      load_definition.json: 
  loadDefinition:
    enabled: true
    existingSecret: '{{ .Release.Name }}-load-definition'