From e55beeb27b10f1c68eb0b58b510d261c26c798e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 13:30:28 +0200
Subject: [PATCH 01/11] move socket-dir from hardcoded to values

This way it can be updated by custom values
---
 charts/dragonfly/templates/client/client-daemonset.yaml | 6 ------
 charts/dragonfly/values.yaml                            | 6 ++++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/charts/dragonfly/templates/client/client-daemonset.yaml b/charts/dragonfly/templates/client/client-daemonset.yaml
index 7ae924d6..8010fd0c 100644
--- a/charts/dragonfly/templates/client/client-daemonset.yaml
+++ b/charts/dragonfly/templates/client/client-daemonset.yaml
@@ -195,8 +195,6 @@ spec:
         volumeMounts:
         - name: config
           mountPath: "/etc/dragonfly"
-        - name: socket-dir
-          mountPath: /var/run/dragonfly
         {{- if .Values.client.extraVolumeMounts }}
         {{- toYaml .Values.client.extraVolumeMounts | nindent 8 }}
         {{- end }}
@@ -204,10 +202,6 @@ spec:
       - name: config
         configMap:
           name: {{ template "dragonfly.client.fullname" . }}
-      - name: socket-dir
-        hostPath:
-          path: /var/run/dragonfly
-          type: DirectoryOrCreate
       {{- if .Values.client.dfinit.enable }}
       - name: dfinit-config
         configMap:
diff --git a/charts/dragonfly/values.yaml b/charts/dragonfly/values.yaml
index 777499f1..828f3ba4 100644
--- a/charts/dragonfly/values.yaml
+++ b/charts/dragonfly/values.yaml
@@ -1305,12 +1305,18 @@ client:
   extraEnvVars: []
   # -- Extra volumes for dfdaemon.
   extraVolumes:
+    - name: socket-dir
+      hostPath:
+        path: /var/run/dragonfly
+        type: DirectoryOrCreate
     - name: storage
       emptyDir: {}
     - name: logs
       emptyDir: {}
   # -- Extra volumeMounts for dfdaemon.
   extraVolumeMounts:
+    - name: socket-dir
+      mountPath: /var/run/dragonfly
     - name: storage
       mountPath: /var/lib/dragonfly/
     - name: logs

From 8dd3cfc2c7dd9aa2c583992ec65cd9b1b995de87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 14:23:37 +0200
Subject: [PATCH 02/11] template config

---
 .../templates/manager/manager-deployment.yaml | 24 ++++++++++++++++++-
 charts/dragonfly/values.yaml                  |  4 ++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 05347cfe..95b02706 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -68,6 +68,23 @@ spec:
       {{- end }}
       {{- if or .Values.redis.enable .Values.mysql.enable }}
       initContainers:
+      {{- if .Values.global.templateConfig }}
+      - name: config-template
+        image: {{ template "manager.initContainer.image" . }}
+        imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
+        command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
+        volumeMounts:
+        - name: config-tmp
+          mountPath: /config-tmp
+        - name: config
+          mountPath: /config
+        resources: 
+          {{- toYaml .Values.manager.initContainer.resources | nindent 10 }}
+        envs:
+        {{- if .Values.manager.extraEnvVars }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.manager.extraEnvVars "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
       {{- if .Values.redis.enable }}
       - name: wait-for-redis
         image: {{ template "manager.initContainer.image" . }}
@@ -109,8 +126,9 @@ spec:
           protocol: TCP
         {{- end }}
         volumeMounts:
-        - name: config
+        - name: {{ if .Values.global.templateConfig }}config-tmp{{ else }}config{{ end }}
           mountPath: "/etc/dragonfly"
+          readOnly: true
         {{- if .Values.manager.extraVolumeMounts }}
         {{- toYaml .Values.manager.extraVolumeMounts | nindent 8 }}
         {{- end }}
@@ -129,6 +147,10 @@ spec:
           timeoutSeconds: 10
           failureThreshold: 5
       volumes:
+      {{- if .Values.global.templateConfig }}
+      - name: config-tmp
+        emptyDir: {}
+      {{- end }}
       - name: config
         configMap:
           name: {{ template "dragonfly.manager.fullname" . }}
diff --git a/charts/dragonfly/values.yaml b/charts/dragonfly/values.yaml
index 828f3ba4..2322ba85 100644
--- a/charts/dragonfly/values.yaml
+++ b/charts/dragonfly/values.yaml
@@ -19,6 +19,10 @@ global:
   # -- Global storageClass for Persistent Volume(s).
   storageClass: ''
 
+  # -- template (envsubst) configuration file by init-container
+  # it allows to pass secrets from env vars instead of hardcoding to config
+  templateConfig: false
+
 manager:
   # -- Enable manager.
   enable: true

From 78fb72c22c2ef222820e02fd39588d6b89d89d49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 14:36:35 +0200
Subject: [PATCH 03/11] avoid sending empty clusterIP

---
 charts/dragonfly/templates/client/metrics-svc.yaml          | 4 +++-
 charts/dragonfly/templates/manager/manager-svc.yaml         | 4 +++-
 charts/dragonfly/templates/manager/metrics-svc.yaml         | 4 +++-
 charts/dragonfly/templates/scheduler/scheduler-svc.yaml     | 4 +++-
 charts/dragonfly/templates/seed-client/seed-client-svc.yaml | 4 +++-
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/charts/dragonfly/templates/client/metrics-svc.yaml b/charts/dragonfly/templates/client/metrics-svc.yaml
index 3be7738e..24748707 100644
--- a/charts/dragonfly/templates/client/metrics-svc.yaml
+++ b/charts/dragonfly/templates/client/metrics-svc.yaml
@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.client.metrics.service.type }}
-  clusterIP: {{ .Values.client.metrics.service.clusterIP }}
+  {{- with .Values.client.metrics.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
   - port: {{ .Values.client.config.metrics.server.port }}
     name: http-metrics
diff --git a/charts/dragonfly/templates/manager/manager-svc.yaml b/charts/dragonfly/templates/manager/manager-svc.yaml
index 7e0cd526..fe03cc5a 100644
--- a/charts/dragonfly/templates/manager/manager-svc.yaml
+++ b/charts/dragonfly/templates/manager/manager-svc.yaml
@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.manager.service.type }}
-  clusterIP: {{ .Values.manager.service.clusterIP }}
+  {{- with .Values.manager.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.manager.restPort }}
       name: http-rest
diff --git a/charts/dragonfly/templates/manager/metrics-svc.yaml b/charts/dragonfly/templates/manager/metrics-svc.yaml
index 895f1877..08862eb7 100644
--- a/charts/dragonfly/templates/manager/metrics-svc.yaml
+++ b/charts/dragonfly/templates/manager/metrics-svc.yaml
@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.manager.metrics.service.type }}
-  clusterIP: {{ .Values.manager.metrics.service.clusterIP }}
+  {{- with .Values.manager.metrics.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
   - port: 8000
     name: http-metrics
diff --git a/charts/dragonfly/templates/scheduler/scheduler-svc.yaml b/charts/dragonfly/templates/scheduler/scheduler-svc.yaml
index 505a1ca2..cdea004b 100644
--- a/charts/dragonfly/templates/scheduler/scheduler-svc.yaml
+++ b/charts/dragonfly/templates/scheduler/scheduler-svc.yaml
@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.scheduler.service.type }}
-  clusterIP: {{ .Values.scheduler.service.clusterIP }}
+  {{- with .Values.scheduler.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.scheduler.config.server.port }}
       name: grpc
diff --git a/charts/dragonfly/templates/seed-client/seed-client-svc.yaml b/charts/dragonfly/templates/seed-client/seed-client-svc.yaml
index 66754c88..8619b74a 100644
--- a/charts/dragonfly/templates/seed-client/seed-client-svc.yaml
+++ b/charts/dragonfly/templates/seed-client/seed-client-svc.yaml
@@ -18,7 +18,9 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.seedClient.service.type }}
-  clusterIP: {{ .Values.seedClient.service.clusterIP }}
+  {{- with .Values.seedClient.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
   ports:
     - port: {{ .Values.seedClient.config.proxy.server.port }}
       name: http-proxy

From 5db36638c2b5813f85f7245132a944a88c9fad7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 14:51:11 +0200
Subject: [PATCH 04/11] fix

---
 charts/dragonfly/templates/manager/manager-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 95b02706..c43350fc 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -80,7 +80,7 @@ spec:
           mountPath: /config
         resources: 
           {{- toYaml .Values.manager.initContainer.resources | nindent 10 }}
-        envs:
+        env:
         {{- if .Values.manager.extraEnvVars }}
         {{- include "common.tplvalues.render" (dict "value" .Values.manager.extraEnvVars "context" $) | nindent 8 }}
         {{- end }}

From dbb9c793780bed353900785dd27d75de4c142605 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 14:55:43 +0200
Subject: [PATCH 05/11] fix image

---
 charts/dragonfly/templates/manager/manager-deployment.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index c43350fc..412d1490 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -71,7 +71,8 @@ spec:
       {{- if .Values.global.templateConfig }}
       - name: config-template
         image: {{ template "manager.initContainer.image" . }}
-        imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
+        # TODO: parametrize image with envsubsts
+        imagePullPolicy: docker.io/tomkukral/tool
         command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
         volumeMounts:
         - name: config-tmp

From 7e4846501c4b6329595a89bb7454bbd8d58a440e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Wed, 29 Apr 2026 14:57:23 +0200
Subject: [PATCH 06/11] fix

---
 charts/dragonfly/templates/manager/manager-deployment.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 412d1490..501efc5f 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -70,9 +70,9 @@ spec:
       initContainers:
       {{- if .Values.global.templateConfig }}
       - name: config-template
-        image: {{ template "manager.initContainer.image" . }}
         # TODO: parametrize image with envsubsts
-        imagePullPolicy: docker.io/tomkukral/tool
+        image: docker.io/tomkukral/tool
+        imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
         command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
         volumeMounts:
         - name: config-tmp

From 2c7509a4e9cae387561cf0e04f2bb386fa704218 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Fri, 22 May 2026 10:56:29 +0200
Subject: [PATCH 07/11] finish existing secret

---
 charts/dragonfly/templates/_helpers.tpl       | 32 +++++++++++++++++++
 .../templates/manager/manager-configmap.yaml  |  8 ++---
 .../templates/manager/manager-deployment.yaml | 12 ++++++-
 .../scheduler/scheduler-configmap.yaml        |  8 ++---
 .../scheduler/scheduler-statefulset.yaml      | 28 +++++++++++++++-
 charts/dragonfly/values.yaml                  | 20 ++++++++++++
 6 files changed, 98 insertions(+), 10 deletions(-)

diff --git a/charts/dragonfly/templates/_helpers.tpl b/charts/dragonfly/templates/_helpers.tpl
index 4a59ec0b..561411b5 100644
--- a/charts/dragonfly/templates/_helpers.tpl
+++ b/charts/dragonfly/templates/_helpers.tpl
@@ -213,3 +213,35 @@ Return the proper image name (for the injector image)
 {{- define "injector.image" -}}
 {{- include "common.images.image" ( dict "imageRoot" .Values.injector.image "global" .Values.global ) -}}
 {{- end -}}
+
+{{/*
+Generate MYSQL_PASSWORD env var from existingSecret or inline value.
+Usage: include "dragonfly.mysqlPasswordEnv" (dict "auth" .Values.mysql.auth "external" .Values.externalMysql "redisEnable" .Values.redis.enable "mysqlEnable" .Values.mysql.enable)
+Caller passes the resolved auth map: dict "password" <val> "existingSecret" <name> "existingSecretPasswordKey" <key>
+*/}}
+{{- define "dragonfly.mysqlPasswordEnv" -}}
+- name: MYSQL_PASSWORD
+{{- if .existingSecret }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ .existingSecret }}
+      key: {{ default "mysql-password" .existingSecretPasswordKey }}
+{{- else }}
+  value: {{ .password | quote }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Generate REDIS_PASSWORD env var from existingSecret or inline value.
+*/}}
+{{- define "dragonfly.redisPasswordEnv" -}}
+- name: REDIS_PASSWORD
+{{- if .existingSecret }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ .existingSecret }}
+      key: {{ default "redis-password" .existingSecretPasswordKey }}
+{{- else }}
+  value: {{ .password | quote }}
+{{- end }}
+{{- end -}}
diff --git a/charts/dragonfly/templates/manager/manager-configmap.yaml b/charts/dragonfly/templates/manager/manager-configmap.yaml
index d3d9fa93..ef7e9ced 100644
--- a/charts/dragonfly/templates/manager/manager-configmap.yaml
+++ b/charts/dragonfly/templates/manager/manager-configmap.yaml
@@ -44,14 +44,14 @@ data:
       mysql:
         {{- if and .Values.mysql.enable (empty .Values.externalMysql.host)}}
         user: {{ .Values.mysql.auth.username }}
-        password: {{ .Values.mysql.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${MYSQL_PASSWORD}{{ else }}{{ .Values.mysql.auth.password }}{{ end }}
         host: {{ .Release.Name }}-{{ default "mysql" .Values.mysql.fullname }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
         port: {{ .Values.mysql.primary.service.port }}
         dbname: {{ .Values.mysql.auth.database }}
         migrate: {{ .Values.mysql.migrate }}
         {{- else }}
         user: {{ .Values.externalMysql.username }}
-        password: {{ .Values.externalMysql.password }}
+        password: {{ if .Values.global.templateConfig }}${MYSQL_PASSWORD}{{ else }}{{ .Values.externalMysql.password }}{{ end }}
         host: {{ .Values.externalMysql.host }}
         port: {{ .Values.externalMysql.port }}
         dbname: {{ .Values.externalMysql.database }}
@@ -61,13 +61,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         db: {{ .Values.externalRedis.db }}
diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 501efc5f..d3e88f23 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -79,9 +79,19 @@ spec:
           mountPath: /config-tmp
         - name: config
           mountPath: /config
-        resources: 
+        resources:
           {{- toYaml .Values.manager.initContainer.resources | nindent 10 }}
         env:
+        {{- if and .Values.mysql.enable (empty .Values.externalMysql.host) }}
+        {{- include "dragonfly.mysqlPasswordEnv" (dict "password" .Values.mysql.auth.password "existingSecret" .Values.mysql.auth.existingSecret "existingSecretPasswordKey" .Values.mysql.auth.existingSecretPasswordKey) | nindent 8 }}
+        {{- else }}
+        {{- include "dragonfly.mysqlPasswordEnv" (dict "password" .Values.externalMysql.password "existingSecret" .Values.externalMysql.existingSecret "existingSecretPasswordKey" .Values.externalMysql.existingSecretPasswordKey) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.redis.enable }}
+        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.redis.auth.password "existingSecret" .Values.redis.auth.existingSecret "existingSecretPasswordKey" .Values.redis.auth.existingSecretPasswordKey) | nindent 8 }}
+        {{- else }}
+        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.externalRedis.password "existingSecret" .Values.externalRedis.existingSecret "existingSecretPasswordKey" .Values.externalRedis.existingSecretPasswordKey) | nindent 8 }}
+        {{- end }}
         {{- if .Values.manager.extraEnvVars }}
         {{- include "common.tplvalues.render" (dict "value" .Values.manager.extraEnvVars "context" $) | nindent 8 }}
         {{- end }}
diff --git a/charts/dragonfly/templates/scheduler/scheduler-configmap.yaml b/charts/dragonfly/templates/scheduler/scheduler-configmap.yaml
index 623fd824..47f86110 100644
--- a/charts/dragonfly/templates/scheduler/scheduler-configmap.yaml
+++ b/charts/dragonfly/templates/scheduler/scheduler-configmap.yaml
@@ -20,13 +20,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
@@ -52,13 +52,13 @@ data:
         {{- if .Values.redis.enable }}
         addrs:
         - {{ .Release.Name }}-{{ default "redis" .Values.redis.fullname }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.redis.master.service.ports.redis }}
-        password: {{ .Values.redis.auth.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.redis.auth.password }}{{ end }}
         {{- else }}
         addrs:
 {{ toYaml .Values.externalRedis.addrs | indent 10 }}
         masterName: {{ .Values.externalRedis.masterName }}
         username: {{ .Values.externalRedis.username }}
-        password: {{ .Values.externalRedis.password }}
+        password: {{ if .Values.global.templateConfig }}${REDIS_PASSWORD}{{ else }}{{ .Values.externalRedis.password }}{{ end }}
         sentinelUsername: {{ .Values.externalRedis.sentinelUsername }}
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
diff --git a/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml b/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
index f063eb60..fbb590a1 100644
--- a/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
+++ b/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
@@ -69,6 +69,28 @@ spec:
 {{ toYaml .Values.scheduler.hostAliases | indent 8 }}
       {{- end }}
       initContainers:
+      {{- if .Values.global.templateConfig }}
+      - name: config-template
+        image: docker.io/tomkukral/tool
+        imagePullPolicy: {{ .Values.scheduler.initContainer.image.pullPolicy }}
+        command: ["sh", "-c", "envsubst < /config/scheduler.yaml > /config-tmp/scheduler.yaml"]
+        volumeMounts:
+        - name: config-tmp
+          mountPath: /config-tmp
+        - name: config
+          mountPath: /config
+        resources:
+          {{- toYaml .Values.scheduler.initContainer.resources | nindent 10 }}
+        env:
+        {{- if .Values.redis.enable }}
+        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.redis.auth.password "existingSecret" .Values.redis.auth.existingSecret "existingSecretPasswordKey" .Values.redis.auth.existingSecretPasswordKey) | nindent 8 }}
+        {{- else }}
+        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.externalRedis.password "existingSecret" .Values.externalRedis.existingSecret "existingSecretPasswordKey" .Values.externalRedis.existingSecretPasswordKey) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.scheduler.extraEnvVars }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.scheduler.extraEnvVars "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
       - name: wait-for-manager
         image: {{ template "scheduler.initContainer.image" . }}
         imagePullPolicy: {{ .Values.scheduler.initContainer.image.pullPolicy }}
@@ -101,7 +123,7 @@ spec:
           protocol: TCP
         {{- end }}
         volumeMounts:
-        - name: config
+        - name: {{ if .Values.global.templateConfig }}config-tmp{{ else }}config{{ end }}
           mountPath: "/etc/dragonfly"
         {{- if .Values.scheduler.extraVolumeMounts }}
         {{- toYaml .Values.scheduler.extraVolumeMounts | nindent 8 }}
@@ -121,6 +143,10 @@ spec:
           timeoutSeconds: 10
           failureThreshold: 5
       volumes:
+      {{- if .Values.global.templateConfig }}
+      - name: config-tmp
+        emptyDir: {}
+      {{- end }}
       - name: config
         configMap:
           name: {{ template "dragonfly.scheduler.fullname" . }}
diff --git a/charts/dragonfly/values.yaml b/charts/dragonfly/values.yaml
index 2322ba85..7e966668 100644
--- a/charts/dragonfly/values.yaml
+++ b/charts/dragonfly/values.yaml
@@ -1841,6 +1841,11 @@ mysql:
     username: dragonfly
     # -- Mysql password.
     password: dragonfly
+    # -- Existing secret name containing the mysql password. When set with global.templateConfig=true,
+    # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
+    existingSecret: ''
+    # -- Key in the existing secret that holds the mysql password.
+    existingSecretPasswordKey: 'mysql-password'
     # -- Mysql database name.
     database: manager
   primary:
@@ -1857,6 +1862,11 @@ externalMysql:
   username: dragonfly
   # -- External mysql password.
   password: dragonfly
+  # -- Existing secret name containing the external mysql password. When set with global.templateConfig=true,
+  # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
+  existingSecret: ''
+  # -- Key in the existing secret that holds the external mysql password.
+  existingSecretPasswordKey: 'mysql-password'
   # -- External mysql database name.
   database: manager
   # -- External mysql port.
@@ -1874,6 +1884,11 @@ redis:
     enabled: true
     # -- Redis password.
     password: dragonfly
+    # -- Existing secret name containing the redis password. When set with global.templateConfig=true,
+    # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
+    existingSecret: ''
+    # -- Key in the existing secret that holds the redis password.
+    existingSecretPasswordKey: 'redis-password'
   master:
     service:
       ports:
@@ -1890,6 +1905,11 @@ externalRedis:
   username: ''
   # -- External redis password.
   password: ''
+  # -- Existing secret name containing the external redis password. When set with global.templateConfig=true,
+  # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
+  existingSecret: ''
+  # -- Key in the existing secret that holds the external redis password.
+  existingSecretPasswordKey: 'redis-password'
   # -- External redis sentinel addresses.
   sentinelUsername: ''
   # -- External redis sentinel password.

From 5fcb06919b392f3ddd283bcec63f2eba599ff7ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Fri, 22 May 2026 15:25:44 +0200
Subject: [PATCH 08/11] load jtw key from secret

---
 charts/dragonfly/templates/_helpers.tpl       | 33 +++----------------
 .../templates/manager/manager-deployment.yaml | 22 +++++++++----
 .../scheduler/scheduler-statefulset.yaml      | 11 ++++---
 charts/dragonfly/values.yaml                  | 13 +++++---
 4 files changed, 36 insertions(+), 43 deletions(-)

diff --git a/charts/dragonfly/templates/_helpers.tpl b/charts/dragonfly/templates/_helpers.tpl
index 561411b5..e6aecb9a 100644
--- a/charts/dragonfly/templates/_helpers.tpl
+++ b/charts/dragonfly/templates/_helpers.tpl
@@ -215,33 +215,10 @@ Return the proper image name (for the injector image)
 {{- end -}}
 
 {{/*
-Generate MYSQL_PASSWORD env var from existingSecret or inline value.
-Usage: include "dragonfly.mysqlPasswordEnv" (dict "auth" .Values.mysql.auth "external" .Values.externalMysql "redisEnable" .Values.redis.enable "mysqlEnable" .Values.mysql.enable)
-Caller passes the resolved auth map: dict "password" <val> "existingSecret" <name> "existingSecretPasswordKey" <key>
-*/}}
-{{- define "dragonfly.mysqlPasswordEnv" -}}
-- name: MYSQL_PASSWORD
-{{- if .existingSecret }}
-  valueFrom:
-    secretKeyRef:
-      name: {{ .existingSecret }}
-      key: {{ default "mysql-password" .existingSecretPasswordKey }}
-{{- else }}
-  value: {{ .password | quote }}
-{{- end }}
-{{- end -}}
-
-{{/*
-Generate REDIS_PASSWORD env var from existingSecret or inline value.
+Generate an envFrom secretRef entry for an existing secret.
+Usage: include "dragonfly.envFromSecret" (dict "secretName" <name>)
 */}}
-{{- define "dragonfly.redisPasswordEnv" -}}
-- name: REDIS_PASSWORD
-{{- if .existingSecret }}
-  valueFrom:
-    secretKeyRef:
-      name: {{ .existingSecret }}
-      key: {{ default "redis-password" .existingSecretPasswordKey }}
-{{- else }}
-  value: {{ .password | quote }}
-{{- end }}
+{{- define "dragonfly.envFromSecret" -}}
+- secretRef:
+    name: {{ .secretName }}
 {{- end -}}
diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index d3e88f23..24be66e8 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -81,18 +81,26 @@ spec:
           mountPath: /config
         resources:
           {{- toYaml .Values.manager.initContainer.resources | nindent 10 }}
-        env:
+        envFrom:
         {{- if and .Values.mysql.enable (empty .Values.externalMysql.host) }}
-        {{- include "dragonfly.mysqlPasswordEnv" (dict "password" .Values.mysql.auth.password "existingSecret" .Values.mysql.auth.existingSecret "existingSecretPasswordKey" .Values.mysql.auth.existingSecretPasswordKey) | nindent 8 }}
-        {{- else }}
-        {{- include "dragonfly.mysqlPasswordEnv" (dict "password" .Values.externalMysql.password "existingSecret" .Values.externalMysql.existingSecret "existingSecretPasswordKey" .Values.externalMysql.existingSecretPasswordKey) | nindent 8 }}
+        {{- if .Values.mysql.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.mysql.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalMysql.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalMysql.existingSecret) | nindent 8 }}
         {{- end }}
         {{- if .Values.redis.enable }}
-        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.redis.auth.password "existingSecret" .Values.redis.auth.existingSecret "existingSecretPasswordKey" .Values.redis.auth.existingSecretPasswordKey) | nindent 8 }}
-        {{- else }}
-        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.externalRedis.password "existingSecret" .Values.externalRedis.existingSecret "existingSecretPasswordKey" .Values.externalRedis.existingSecretPasswordKey) | nindent 8 }}
+        {{- if .Values.redis.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.redis.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalRedis.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalRedis.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- if .Values.manager.config.auth.jwt.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.manager.config.auth.jwt.existingSecret) | nindent 8 }}
         {{- end }}
         {{- if .Values.manager.extraEnvVars }}
+        env:
         {{- include "common.tplvalues.render" (dict "value" .Values.manager.extraEnvVars "context" $) | nindent 8 }}
         {{- end }}
       {{- end }}
diff --git a/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml b/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
index fbb590a1..0d9d2013 100644
--- a/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
+++ b/charts/dragonfly/templates/scheduler/scheduler-statefulset.yaml
@@ -81,13 +81,16 @@ spec:
           mountPath: /config
         resources:
           {{- toYaml .Values.scheduler.initContainer.resources | nindent 10 }}
-        env:
+        envFrom:
         {{- if .Values.redis.enable }}
-        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.redis.auth.password "existingSecret" .Values.redis.auth.existingSecret "existingSecretPasswordKey" .Values.redis.auth.existingSecretPasswordKey) | nindent 8 }}
-        {{- else }}
-        {{- include "dragonfly.redisPasswordEnv" (dict "password" .Values.externalRedis.password "existingSecret" .Values.externalRedis.existingSecret "existingSecretPasswordKey" .Values.externalRedis.existingSecretPasswordKey) | nindent 8 }}
+        {{- if .Values.redis.auth.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.redis.auth.existingSecret) | nindent 8 }}
+        {{- end }}
+        {{- else if .Values.externalRedis.existingSecret }}
+        {{- include "dragonfly.envFromSecret" (dict "secretName" .Values.externalRedis.existingSecret) | nindent 8 }}
         {{- end }}
         {{- if .Values.scheduler.extraEnvVars }}
+        env:
         {{- include "common.tplvalues.render" (dict "value" .Values.scheduler.extraEnvVars "context" $) | nindent 8 }}
         {{- end }}
       {{- end }}
diff --git a/charts/dragonfly/values.yaml b/charts/dragonfly/values.yaml
index 7e966668..49d44979 100644
--- a/charts/dragonfly/values.yaml
+++ b/charts/dragonfly/values.yaml
@@ -183,6 +183,11 @@ manager:
         # encoded base64 of dragonfly.
         # Please change the key in production.
         key: 'ZHJhZ29uZmx5Cg=='
+        # -- existingSecret is the name of an existing Kubernetes Secret containing the JWT signing key.
+        # When set, the key field is ignored and the secret value is used instead.
+        existingSecret: ''
+        # -- existingSecretKey is the key within the existing secret that holds the JWT signing key.
+        existingSecretKey: 'JWT_KEY'
         # -- Timeout is duration that a jwt token is valid,
         # default duration is two days.
         timeout: 48h
@@ -1845,7 +1850,7 @@ mysql:
     # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
     existingSecret: ''
     # -- Key in the existing secret that holds the mysql password.
-    existingSecretPasswordKey: 'mysql-password'
+    existingSecretKey: 'MYSQL_PASSWORD'
     # -- Mysql database name.
     database: manager
   primary:
@@ -1866,7 +1871,7 @@ externalMysql:
   # the password is injected via MYSQL_PASSWORD env var rather than hardcoded in the configmap.
   existingSecret: ''
   # -- Key in the existing secret that holds the external mysql password.
-  existingSecretPasswordKey: 'mysql-password'
+  existingSecretKey: 'MYSQL_PASSWORD'
   # -- External mysql database name.
   database: manager
   # -- External mysql port.
@@ -1888,7 +1893,7 @@ redis:
     # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
     existingSecret: ''
     # -- Key in the existing secret that holds the redis password.
-    existingSecretPasswordKey: 'redis-password'
+    existingSecretKey: 'REDIS_PASSWORD'
   master:
     service:
       ports:
@@ -1909,7 +1914,7 @@ externalRedis:
   # the password is injected via REDIS_PASSWORD env var rather than hardcoded in the configmap.
   existingSecret: ''
   # -- Key in the existing secret that holds the external redis password.
-  existingSecretPasswordKey: 'redis-password'
+  existingSecretKey: 'REDIS_PASSWORD'
   # -- External redis sentinel addresses.
   sentinelUsername: ''
   # -- External redis sentinel password.

From 715a3aa356148809f76f08fa0a218681061b0968 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Tue, 26 May 2026 09:57:09 +0200
Subject: [PATCH 09/11] parametrize jtw key

---
 charts/dragonfly/templates/manager/manager-configmap.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-configmap.yaml b/charts/dragonfly/templates/manager/manager-configmap.yaml
index ef7e9ced..8d973e1f 100644
--- a/charts/dragonfly/templates/manager/manager-configmap.yaml
+++ b/charts/dragonfly/templates/manager/manager-configmap.yaml
@@ -39,7 +39,11 @@ data:
       cacheDir: {{ .Values.manager.config.server.cacheDir }}
       pluginDir: {{ .Values.manager.config.server.pluginDir }}
     auth:
-{{ toYaml .Values.manager.config.auth | indent 6 }}
+      jwt:
+        realm: {{ .Values.manager.config.auth.jwt.realm }}
+        key: {{ if and .Values.global.templateConfig .Values.manager.config.auth.jwt.existingSecret }}${JWT_KEY}{{ else }}{{ .Values.manager.config.auth.jwt.key }}{{ end }}
+        timeout: {{ .Values.manager.config.auth.jwt.timeout }}
+        maxRefresh: {{ .Values.manager.config.auth.jwt.maxRefresh }}
     database:
       mysql:
         {{- if and .Values.mysql.enable (empty .Values.externalMysql.host)}}

From 193a119af2f1f79888412f4a1ad4936f2b147e7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Tue, 26 May 2026 13:04:41 +0200
Subject: [PATCH 10/11] print config

---
 charts/dragonfly/templates/manager/manager-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 24be66e8..38677134 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -73,7 +73,7 @@ spec:
         # TODO: parametrize image with envsubsts
         image: docker.io/tomkukral/tool
         imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
-        command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
+        command: ["sh", "-c", "envsubst < /config/manager.yaml | tee /config-tmp/manager.yaml"]
         volumeMounts:
         - name: config-tmp
           mountPath: /config-tmp

From 8bbdb926d3e5ac9c7c0f2b9ce8ec996d6535c2ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kukr=C3=A1l?= <noreply@6shore.net>
Date: Tue, 26 May 2026 13:07:48 +0200
Subject: [PATCH 11/11] Revert "print config"

This reverts commit 193a119af2f1f79888412f4a1ad4936f2b147e7f.
---
 charts/dragonfly/templates/manager/manager-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/dragonfly/templates/manager/manager-deployment.yaml b/charts/dragonfly/templates/manager/manager-deployment.yaml
index 38677134..24be66e8 100644
--- a/charts/dragonfly/templates/manager/manager-deployment.yaml
+++ b/charts/dragonfly/templates/manager/manager-deployment.yaml
@@ -73,7 +73,7 @@ spec:
         # TODO: parametrize image with envsubsts
         image: docker.io/tomkukral/tool
         imagePullPolicy: {{ .Values.manager.initContainer.image.pullPolicy }}
-        command: ["sh", "-c", "envsubst < /config/manager.yaml | tee /config-tmp/manager.yaml"]
+        command: ["sh", "-c", "envsubst < /config/manager.yaml > /config-tmp/manager.yaml"]
         volumeMounts:
         - name: config-tmp
           mountPath: /config-tmp