feat: support pgdog.toml from an existing Secret (configSecret)

README.md

@@ -229,6 +229,43 @@ kubectl create secret generic my-pgdog-users \
 The value is mounted at `/etc/secrets/pgdog/users.toml` regardless of the
 key name. A custom `key` is remapped automatically.
 
+#### pgdog.toml from an existing Secret
+
+Set `configSecret.name` to reference a Secret you created that holds the
+`pgdog.toml` file. The chart then skips rendering its own pgdog.toml
+ConfigMap and mounts your Secret as the config volume instead. Use this when
+your pgdog.toml contains values that must not live in a ConfigMap, such as
+database hosts or the admin password sourced from a secrets manager:
+
+```yaml
+configSecret:
+  name: my-pgdog-config # existing Secret in the same namespace
+  key: pgdog.toml       # key holding the pgdog.toml content (default: pgdog.toml)
+```
+
+Create the Secret, for example:
+
+```bash
+kubectl create secret generic my-pgdog-config \
+  --from-file=pgdog.toml=./pgdog.toml
+```
+
+The value is mounted at `/etc/pgdog/pgdog.toml` regardless of the key name.
+A custom `key` is remapped automatically. All pgdog.toml-related chart values
+(`databases`, `defaultPoolSize`, sharding settings, etc.) are ignored, since
+your Secret provides the whole file.
+
+Note: swapping the volume source is required — overlaying a Secret-provided
+`pgdog.toml` on top of the chart's ConfigMap with a `subPath` volume mount
+fails at container start (the mount target is a symlink inside the ConfigMap
+volume; see
+[kubernetes/kubernetes#61545](https://github.com/kubernetes/kubernetes/issues/61545)).
+
+Note: `plugins[].config` entries render into the chart's ConfigMap and are
+not mounted when `configSecret.name` is set. A Secret-provided pgdog.toml
+controls its own plugin config paths, so mount plugin files elsewhere via
+`extraVolumes`/`extraVolumeMounts`.
+
 #### Datadog API key from an existing Secret
 
 PgDog reads the Datadog API key from the `DD_API_KEY` environment variable.

templates/config.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.configSecret.name }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -618,3 +619,4 @@ data:
 {{ .config | indent 8 }}
     {{- end }}
     {{- end }}
+{{- end }}

templates/deployment.yaml

@@ -209,8 +209,16 @@ spec:
         {{- end }}
       volumes:
         - name: config
+          {{- if .Values.configSecret.name }}
+          secret:
+            secretName: {{ .Values.configSecret.name }}
+            items:
+              - key: {{ .Values.configSecret.key | default "pgdog.toml" }}
+                path: pgdog.toml
+          {{- else }}
           configMap:
             name: {{ include "pgdog.fullname" . }}
+          {{- end }}
         - name: users
           secret:
             {{- if .Values.usersSecret.name }}

test/values-existing-config-secret.yaml

@@ -0,0 +1,12 @@
+# Test referencing an existing, user-created Secret for pgdog.toml instead of
+# the chart-rendered ConfigMap. Covers:
+#   - configSecret: mount pgdog.toml from an existing Secret, with a custom key
+#     remapped to pgdog.toml; the chart's pgdog.toml ConfigMap is not rendered
+
+configSecret:
+  name: my-pgdog-config
+  key: my-config-key.toml
+
+usersSecret:
+  name: my-pgdog-users
+  key: users.toml

values.yaml

@@ -474,6 +474,27 @@ usersSecret:
   # it is mounted at /etc/secrets/pgdog/users.toml regardless of the key name
   key: users.toml
 
+# configSecret references an existing Secret (that you created yourself in
+# this namespace) holding the pgdog.toml file. When name is set, the chart
+# does not render its own pgdog.toml ConfigMap and mounts this Secret as the
+# /etc/pgdog directory instead. Use this when your pgdog.toml contains values
+# that must not live in a ConfigMap (e.g. database hosts or the admin
+# password sourced from a secrets manager).
+# Note: overlaying a Secret-provided pgdog.toml on top of the chart's
+# ConfigMap with a subPath volume mount does not work — the mount target is
+# a symlink inside the ConfigMap volume and the container runtime rejects it
+# (kubernetes/kubernetes#61545) — which is why this swaps the volume source.
+# Note: plugins[].config entries render into the chart's ConfigMap and are
+# not mounted when configSecret.name is set; a Secret-provided pgdog.toml
+# controls its own plugin config paths, so mount plugin files elsewhere via
+# extraVolumes/extraVolumeMounts.
+configSecret:
+  # name of the existing Secret containing pgdog.toml
+  name: ""
+  # key within that Secret whose value is the pgdog.toml content;
+  # it is mounted at /etc/pgdog/pgdog.toml regardless of the key name
+  key: pgdog.toml
+
 # otel configures OpenTelemetry metrics export. Left unset by default so the
 # [otel] section is omitted from pgdog.toml. Uncomment and fill in to enable.
 # otel: