Gateway Helm: fail on contradictory DSN + passwordSecretRef

Description

The gateway-helm-chart lets an operator configure the controller's external database (postgres/sqlserver) either via a full dsn or via individual host/port/database/user fields with the password injected separately from a Secret (passwordSecretRef). These two modes are mutually exclusive, but the chart neither enforces nor clearly documents that — leading to silent misconfiguration.

Root cause in the controller: buildPostgresDSN (gateway/gateway-controller/pkg/storage/postgres.go:140) and buildSQLServerDSN (pkg/storage/sqlserver.go) return the dsn as-is when it is non-empty and never merge the separately-configured Password. The password field is only used when dsn is empty. At the chart level, gateway-config.yaml renders the password = '{{ env … }}' line only in the non-DSN branch, so when dsn is set the injected APIP_GW_CONTROLLER_STORAGE_POSTGRES_PASSWORD env var has nothing to consume it.

Two footguns this creates:

• dsn set without a password + passwordSecretRef set → the secret is silently ignored; the controller connects with no password and crashloops on a Postgres password authentication failed error that points at the DB, not at the contradictory Helm values.
• dsn set with an inline password + passwordSecretRef set → works (DSN wins), but the mounted secret is dead weight and the password lands in the ConfigMap in plaintext.

Note — "both set" is sometimes valid: the secure DSN pattern embeds a {{ env "APIP_GW_CONTROLLER_STORAGE_POSTGRES_PASSWORD" }} token inside the dsn, which does consume passwordSecretRef at load time and keeps the password out of the ConfigMap. Any guard must allow this.

Proposed fix

• Guarded fail: in gateway-config.yaml, for both the postgres and sqlserver/database blocks, fail at template render time when dsn is set and passwordSecretRef.name is set and the dsn does not reference the password env token — with a message directing the operator to either embed the {{ env … }} token in the DSN or drop passwordSecretRef. Consistent with the chart's existing fail/required validation (removed sqlserver key, missing host/db/user, encrypt enum).
• Docs: correct the misleading values.yaml comments in the postgres/database blocks, which currently state both "Full DSN takes precedence over individual fields when set" and "Password is injected separately via … passwordSecretRef" — together implying a password-less DSN plus a separate secret works, which it does not.

Version

No response

Related Issue

No response