fix(helm): URL-encode MongoDB passwords, support existingSecret/fullnameOverride (#49)

- Split auth URI into two paths: urlquery at template time when
  rootPassword is set (safe for @, :, /, %), $(VAR) expansion from
  secretKeyRef when auto-generated
- Respect mongodb.fullnameOverride for service name resolution
- Respect mongodb.auth.existingSecret for secret name resolution
- Move helmfile example from secrets: to values: (removes helm-secrets
  plugin dependency)
- Add renovate comment for auto-bumping chart version in examples
- Bump chart to 0.3.4

Author: GeiserX

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## Helm Chart [0.3.4] - 2026-03-31
+
+### Fixed
+- **Fix: URL-encode MongoDB passwords with special characters** — when `rootPassword` is set in values, the password is now percent-encoded at template time via `urlquery`, so characters like `@`, `:`, `/`, `%` no longer break the connection URI. Auto-generated passwords (empty `rootPassword`) continue to use runtime `$(VAR)` expansion (Bitnami generates alphanumeric passwords)
+- **Fix: Respect `mongodb.fullnameOverride` and `mongodb.auth.existingSecret`** — the chart now resolves the correct MongoDB service name and secret name when users override the subchart's default naming
+- **Fix: Remove undeclared `helm-secrets` plugin dependency from examples** — `genieacs-secrets.yaml` moved from Helmfile `secrets:` to `values:` so examples work without plugins
+
 ## Helm Chart [0.3.3] - 2026-03-31
 
 ### Fixed

charts/genieacs/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: genieacs
 description: A Helm chart for GenieACS - an open-source implementation of TR-069 ACS
 type: application
-version: 0.3.3
+version: 0.3.4
 appVersion: "1.2.16.0"
 keywords:
   - genieacs

charts/genieacs/templates/_helpers.tpl

@@ -52,10 +52,27 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 
 {{/*
 Create the MongoDB subchart service name.
+Respects mongodb.fullnameOverride when set.
 */}}
 {{- define "genieacs.mongodb.fullname" -}}
+{{- if .Values.mongodb.fullnameOverride -}}
+{{- .Values.mongodb.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
 {{- printf "%s-%s" .Release.Name "mongodb" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+{{- end -}}
+
+{{/*
+Resolve the MongoDB secret name.
+Uses mongodb.auth.existingSecret when set, otherwise the subchart's auto-generated secret.
+*/}}
+{{- define "genieacs.mongodb.secretName" -}}
+{{- if .Values.mongodb.auth.existingSecret -}}
+{{- .Values.mongodb.auth.existingSecret -}}
+{{- else -}}
+{{- include "genieacs.mongodb.fullname" . -}}
+{{- end -}}
+{{- end -}}
 
 {{/*
 Create the name of the service account to use

charts/genieacs/templates/deployment.yaml

@@ -37,13 +37,18 @@ spec:
               value: "{{ $value }}"
             {{- end }}
             {{- if and .Values.mongodb.enabled .Values.mongodb.auth.enabled }}
+            {{- if .Values.mongodb.auth.rootPassword }}
+            - name: GENIEACS_MONGODB_CONNECTION_URL
+              value: "mongodb://root:{{ .Values.mongodb.auth.rootPassword | urlquery }}@{{ include "genieacs.mongodb.fullname" . }}:27017/genieacs?authSource=admin"
+            {{- else }}
             - name: MONGODB_ROOT_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "genieacs.mongodb.fullname" . }}
+                  name: {{ include "genieacs.mongodb.secretName" . }}
                   key: mongodb-root-password
             - name: GENIEACS_MONGODB_CONNECTION_URL
               value: "mongodb://root:$(MONGODB_ROOT_PASSWORD)@{{ include "genieacs.mongodb.fullname" . }}:27017/genieacs?authSource=admin"
+            {{- end }}
             {{- else if .Values.mongodb.enabled }}
             - name: GENIEACS_MONGODB_CONNECTION_URL
               value: "mongodb://{{ include "genieacs.mongodb.fullname" . }}:27017/genieacs"

charts/genieacs/values.yaml

@@ -63,10 +63,12 @@ mongodb:
   enabled: true
   auth:
     enabled: false
-    # When auth.enabled is true, the chart auto-constructs an authenticated
-    # MongoDB URI using the root password from the Bitnami subchart secret.
-    # Set rootPassword here or let the subchart auto-generate one:
+    # When auth.enabled is true, the chart auto-constructs an authenticated URI.
+    # If rootPassword is set here, the password is URL-encoded at template time
+    # (safe for special characters like @, :, /, %). If left empty, the subchart
+    # auto-generates an alphanumeric password resolved at runtime via secretKeyRef.
     # rootPassword: ""
+    # existingSecret: ""  # Use a pre-existing secret instead of the subchart's
   persistence:
     enabled: true
     size: 8Gi

examples/README.md

@@ -18,13 +18,13 @@ The `helmfile.yaml` demonstrates how to deploy GenieACS on Kubernetes using [Hel
 |------|-------------|
 | `helmfile.yaml` | Main Helmfile configuration (chart repo + release) |
 | `genieacs.yaml` | GenieACS chart values (MongoDB auth enabled) |
-| `genieacs-secrets.yaml` | Secrets (MongoDB root password) — do NOT commit real values |
+| `genieacs-secrets.yaml` | MongoDB root password — do NOT commit real values (use [helm-secrets](https://github.com/jkroepke/helm-secrets) for encryption in production) |
 
 ### Usage
 
 1. Review and customize the configuration files.
 
-2. Set your MongoDB root password in `genieacs-secrets.yaml` (or use [helm-secrets](https://github.com/jkroepke/helm-secrets) for encryption).
+2. Set your MongoDB root password in `genieacs-secrets.yaml`.
 
 3. Deploy:
 

examples/helmfile.yaml

@@ -7,10 +7,9 @@ releases:
     namespace: genieacs
     chart: genieacs/genieacs
     # renovate: registryUrl=https://geiserx.github.io/genieacs-docker
-    version: 0.3.3
+    version: 0.3.4
     labels:
       app: genieacs
     values:
       - genieacs.yaml
-    secrets:
       - genieacs-secrets.yaml