Helm: access to postgres data is lost after upgrade if postgres.postgresPassowrd is not explicitly set

[hWorblehat]

Steps to reproduce:

1. Deploy wiki.js via helm chart. Don't specify postgres.postgresPassword value.
2. Updated the helm release
3. Ensure the wiki container is restarted after the upgrade (e.g. kubectl delete pod ...)

When the new pod/container is started, it no longer has access to the postgres database.

log excerpt:

2021-03-18T10:53:24.076Z [MASTER] error: Database Initialization Error: password authentication failed for user "postgres"

2021-03-18 10:52:25.273 GMT [337] FATAL: password authentication failed for user "postgres"
2021-03-18 10:52:25.273 GMT [337] DETAIL: Password does not match for user "postgres".

This is caused by the fact that when the Helm release is updated, a new random postgres password is generated and stored in a secret. Next time the pod reschedules, it picks up the new secret. However, the postgres data stored on the persistent volume is protected using the old password, so it is no longer accessible.

This is a bug in the postgresql chart, as it should fail the upgrade if a password is not specified. It does this if used directly, but in Helm 3 it does not when used as a subchart, because the macro to check for the password value is in the NOTES.txt template, which Helm doesn't render by default. I've raised the following bug against that chart: bitnami/charts#6121

However, I think this is also a bug in the wiki.js chart. At the very least, some documentation should be added to the chart README indicating that data will be lost if a postgres password isn't explicitly specified. Ideally, the chart would fail if the value is missing.

[dr4Ke]

I guess the solution is to manage this secret outside the chart and use the postgresql.existingSecret parameter.

See https://github.com/bitnami/charts/tree/master/bitnami/postgresql#postgresql-parameters

[rune1979]

This still seems to be an issue, I feel like i have lost data too many times for now.

• ARM arch
  image requarks/wiki

Postgress chart:

image:
  registry: docker.io
  repository: bitnami/postgresql
  tag: 14.7.0

existingSecret: wiki-postgresql

values:

postgresql:
  ## Use the PostgreSQL chart dependency.
  ## Set to false if bringing your own PostgreSQL, and set secret value postgresql-uri.
  ##
  enabled: true


  ## TILFØJET FORDI DB FORBINDELSEN PLUDSELIG RØG!
  existingSecret: wiki-postgresql

It would be fantastic if the official wikijs helm chart would be compatible with the arm architecture. I think it is only the default database deployment that do not have an arm image in the repository. But, I am stuck in figuring out what happens, it might only happening when a new wikijs image are deployed or so (im using latest tag).

[gangstead]

The next time you get locked out I wrote some instructions here for how to change the postgres password on the volume so you won't lose data. Other than that you must set the existingSecret to keep this problem from occurring/reoccurring.