Allow disabling db connection string injection

When using database secrets or connection details managed by the
mariadb-operator for example, the automatic injection of the
database.connection into the service .conf file is detrimental. This
allows users to disable that magic by explicitly setting the connection
to the value of 'null' and leaving the replacement behavior in place for
other cases. The existing charts used 'null' in some cases but its a
cleaner case to handle 'null' for this so switch them to defaulting to
the empty string.

Add values_overrides/<chart>/mariadb-operator.yaml for all 26
charts showing how to opt out of chart-managed database connection
strings when using mariadb-operator. Each override sets the
relevant connection key(s) to null and disables the db-init,
and db secret manifests that are no longer needed when the
operator manages the database lifecycle.

To opt out of chart-managed connection strings (e.g. when using
mariadb-operator to supply them via a mounted configuration snippet),
set the relevant key to null in a values override:

  conf:
    keystone:
      database:
        connection: null   # mariadb-operator provides [database]

Other keys in the database section (max_retries, etc.) are
unaffected and continue to be rendered normally.

Assisted-by: Claude Sonnet 4.6 <claude-sonnet-4-6@anthropic.com>
Change-Id: I7385dfb67f3d8899a8c3d1479b06f2ae21bc5791
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>

Author: cardoe

aodh/templates/configmap-etc.yaml

@@ -57,7 +57,7 @@ limitations under the License.
 {{- $_ := set .Values.conf.aodh.keystone_authtoken "memcache_secret_key" ( default ( randAlphaNum 64 ) .Values.endpoints.oslo_cache.auth.memcache_secret_key ) -}}
 {{- end -}}
 
-{{- if empty .Values.conf.aodh.database.connection -}}
+{{- if and (not (kindIs "invalid" .Values.conf.aodh.database.connection)) (empty .Values.conf.aodh.database.connection) -}}
 {{- $_ := tuple "oslo_db" "internal" "aodh" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | set .Values.conf.aodh.database "connection" -}}
 {{- end -}}
 

aodh/values.yaml

@@ -474,6 +474,11 @@ conf:
     database:
       alarm_history_time_to_live: 86400
       max_retries: -1
+      # -- Database connection URI. When empty the URI is auto-generated
+      ## from endpoints.oslo_db. Set to null to disable auto-generation,
+      ## e.g. when using an operator such as mariadb-operator that supplies
+      ## the connection string via a mounted configuration snippet.
+      connection: ""
     keystone_authtoken:
       auth_version: v3
       auth_type: password

barbican/templates/configmap-etc.yaml

@@ -49,7 +49,7 @@ limitations under the License.
 {{- $_ := set .Values.conf.barbican.keystone_authtoken "memcache_secret_key" ( default ( randAlphaNum 64 ) .Values.endpoints.oslo_cache.auth.memcache_secret_key ) -}}
 {{- end -}}
 
-{{- if empty .Values.conf.barbican.database.connection -}}
+{{- if and (not (kindIs "invalid" .Values.conf.barbican.database.connection)) (empty .Values.conf.barbican.database.connection) -}}
 {{- $connection := tuple "oslo_db" "internal" "barbican" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" -}}
 {{- if .Values.manifests.certificates -}}
 {{- $_ := (printf "%s?charset=utf8&ssl_ca=/etc/mysql/certs/ca.crt&ssl_key=/etc/mysql/certs/tls.key&ssl_cert=/etc/mysql/certs/tls.crt&ssl_verify_cert" $connection ) | set .Values.conf.barbican.database "connection" -}}

barbican/values.yaml

@@ -409,6 +409,11 @@ conf:
       service_type: key-manager
     database:
       max_retries: -1
+      # -- Database connection URI. When empty the URI is auto-generated
+      ## from endpoints.oslo_db. Set to null to disable auto-generation,
+      ## e.g. when using an operator such as mariadb-operator that supplies
+      ## the connection string via a mounted configuration snippet.
+      connection: ""
     barbican_api:
       # NOTE(portdirect): the bind port should not be defined, and is manipulated
       # via the endpoints section.

blazar/templates/configmap-etc.yaml

@@ -36,7 +36,7 @@ limitations under the License.
 {{- $_ := set .Values.conf.blazar.keystone_authtoken "memcache_secret_key" ( default ( randAlphaNum 64 ) .Values.endpoints.oslo_cache.auth.memcache_secret_key ) -}}
 {{- end -}}
 
-{{- if empty .Values.conf.blazar.database.connection -}}
+{{- if and (not (kindIs "invalid" .Values.conf.blazar.database.connection)) (empty .Values.conf.blazar.database.connection) -}}
 {{- $_ := tuple "oslo_db" "internal" "blazar" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup"| set .Values.conf.blazar.database "connection" -}}
 {{- end -}}
 {{- if empty .Values.conf.blazar.DEFAULT.transport_url -}}

blazar/values.yaml

@@ -612,6 +612,11 @@ conf:
       os_admin_project_domain_name:
     database:
       max_retries: -1
+      # -- Database connection URI. When empty the URI is auto-generated
+      ## from endpoints.oslo_db. Set to null to disable auto-generation,
+      ## e.g. when using an operator such as mariadb-operator that supplies
+      ## the connection string via a mounted configuration snippet.
+      connection: ""
     keystone_authtoken:
       service_token_roles: service
       service_token_roles_required: true

cinder/templates/configmap-etc.yaml

@@ -34,7 +34,7 @@ limitations under the License.
 {{- $_ := tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup"| set $envAll.Values.conf.cinder.nova "auth_url" -}}
 {{- end }}
 
-{{- if empty .Values.conf.cinder.database.connection -}}
+{{- if and (not (kindIs "invalid" .Values.conf.cinder.database.connection)) (empty .Values.conf.cinder.database.connection) -}}
 {{- $connection := tuple "oslo_db" "internal" "cinder" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" -}}
 {{- if .Values.manifests.certificates -}}
 {{- $_ := (printf "%s?charset=utf8&ssl_ca=/etc/mysql/certs/ca.crt&ssl_key=/etc/mysql/certs/tls.key&ssl_cert=/etc/mysql/certs/tls.crt&ssl_verify_cert" $connection ) | set .Values.conf.cinder.database "connection" -}}

cinder/values.yaml

@@ -862,6 +862,11 @@ conf:
       internal_user_name: internal_cinder
     database:
       max_retries: -1
+      # -- Database connection URI. When empty the URI is auto-generated
+      ## from endpoints.oslo_db. Set to null to disable auto-generation,
+      ## e.g. when using an operator such as mariadb-operator that supplies
+      ## the connection string via a mounted configuration snippet.
+      connection: ""
     keystone_authtoken:
       service_token_roles: service
       service_token_roles_required: true

cloudkitty/templates/configmap-etc.yaml

@@ -32,7 +32,7 @@ limitations under the License.
 {{- $_ := set .Values.conf.cloudkitty.keystone_authtoken "memcache_secret_key" ( default ( randAlphaNum 64 ) .Values.endpoints.oslo_cache.auth.memcache_secret_key ) -}}
 {{- end -}}
 
-{{- if empty .Values.conf.cloudkitty.database.connection -}}
+{{- if and (not (kindIs "invalid" .Values.conf.cloudkitty.database.connection)) (empty .Values.conf.cloudkitty.database.connection) -}}
 {{- $connection := tuple "oslo_db" "internal" "cloudkitty" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" -}}
 {{- if .Values.manifests.certificates -}}
 {{- $_ := (printf "%s?charset=utf8&ssl_ca=/etc/mysql/certs/ca.crt&ssl_key=/etc/mysql/certs/tls.key&ssl_cert=/etc/mysql/certs/tls.crt&ssl_verify_cert" $connection ) | set .Values.conf.cloudkitty.database "connection" -}}

cloudkitty/values.yaml

@@ -578,6 +578,11 @@ conf:
       service_type: rating
     database:
       max_retries: -1
+      # -- Database connection URI. When empty the URI is auto-generated
+      ## from endpoints.oslo_db. Set to null to disable auto-generation,
+      ## e.g. when using an operator such as mariadb-operator that supplies
+      ## the connection string via a mounted configuration snippet.
+      connection: ""
     oslo_concurrency:
       lock_path: /var/lock
     collect: