global.existingSecretName + chart-managed MongoDB = silently broken install

[alix-graylog]

Summary

Setting global.existingSecretName with the default mongodb.communityResource.enabled=true produces a MongoDBCommunity CR that references a backup secret which is never created. MongoDB never provisions, and there is no error message to guide the user.

Root Cause

The secret creation logic in templates/config/secret/secrets.yaml is guarded by a condition:

{{- if not .Values.global.existingSecretName -}}
  {{/* All secret creation happens here, including the backup secret */}}
{{- end }}

When global.existingSecretName is set, this entire block is skipped — including the creation of the backup secret. However, the MongoDBCommunity CR in templates/custom/mongo-rs.yaml unconditionally references this backup secret at lines 26 and 41.

The MongoDB operator waits indefinitely for a secret that doesn't exist, never provisions the statefulset, and provides no error message.

Impact

• Users running GitOps (Argo CD / Flux) who set global.existingSecretName to provide their own secret, expecting chart-managed MongoDB to work
• The test-mongodb-connectivity helm test hook also references the backup secret and fails silently
• Related to C-01: GitOps secret rotation issues

Reproduction

# Create an external secret with MongoDB credentials
kubectl create secret generic my-secret \
  --from-literal=mongodb-root-password=rootpass \
  --from-literal=mongodb-db-password=dbpass \
  --from-literal=graylog-secret=peppersecret

# Install with existingSecretName + default mongodb.communityResource.enabled=true
helm install graylog . \
  --set global.existingSecretName=my-secret

# MongoDB CR renders but never provisions (waits forever for backup secret)
kubectl get mongodbcommunity
# Status stays "provisioning" indefinitely

Solution

Immediate Fix

Add a template-time fail guard in templates/config/secret/secrets.yaml:

{{- if .Values.global.existingSecretName }}
  {{- if .Values.mongodb.communityResource.enabled }}
    {{- fail "Cannot use global.existingSecretName with mongodb.communityResource.enabled=true. Either: (1) set mongodb.communityResource.enabled=false and provide a connection URI via graylog.config.mongodb.customUri, or (2) omit global.existingSecretName to use chart-managed MongoDB." }}
  {{- end }}
{{- end }}

Also gate the MongoDB connectivity test hook on chart-managed mode in templates/tests/test-mongodb-connectivity.yaml.

Related Issues

• Blocks: C-01 (GitOps users encounter this when setting global.existingSecretName)
• Production Readiness Review ID: C-06 (2026-06-12)