Secret generation

[rainest]

Bitnami's Postgres chart has a standard-ish example of how to support either user-provided or generated passwords. Maybe more options than we want, but if you want everything, https://github.com/bitnami/charts/blob/aa557a2263807f74e02390739adaf1316771f6c2/bitnami/postgresql/templates/secrets.yaml#L9-L39 will demonstrate how to do it.

Sprig provides a password derivation function that's maybe worth considering for reproducible installs instead of total random, though the derivation algorithm doesn't appear to be formally vetted (see Masterminds/sprig#410: it's from some password manager alternative app whose author has chosen some very unsearchable security terms for both their brands 😢 ). The derivation function may suffice for toy instances, but runs a risk of leaking into prod envs if it's something provided in values.yaml.

Probably just full random with maybe an option to clobber PVCs or similar if you need to blow away and reinstall quickly.