helm: keep the filer db credentials across uninstall and install (#12138)

* helm: keep the filer db credentials across uninstall and install

The db secret is kept on uninstall (`helm.sh/resource-policy: keep`), but it
is a pre-install hook, and Helm deletes an existing hook resource before
creating it again. The next install therefore wrote a new random password
and reset the user to YourSWUser, so the filer could no longer log in to a
database set up with the old ones, including credentials edited into the
kept Secret.

The template now reads the existing Secret with lookup and reuses its user
and password; a first install still generates them as before. A kind step
in helm_ci.yml installs, edits the Secret, uninstalls, installs again and
checks both values.

* helm: README, the db secret is kept and reused across a reinstall

* helm: make the db secret hook-delete-policy explicit

before-hook-creation is Helm's default for hook resources, but spell it
out so the reuse contract is obvious: lookup reads the kept Secret at
render time, the old copy is deleted before the hook recreates it, and
the stored credentials carry over.

---------

Co-authored-by: Chris Lu <chris.lu@gmail.com>

.github/workflows/helm_ci.yml

@@ -2034,6 +2034,38 @@ jobs:
           kubectl delete namespace "$NS"
           echo "SFTP host key lifecycle tests passed"
 
+      - name: Verify the filer db secret survives uninstall and install
+        run: |
+          set -e
+          CHART_DIR="k8s/charts/seaweedfs"
+          NS="filer-db-secret"
+          SECRET="db-seaweedfs-db-secret"
+          DB_ARGS="--set image.tag=$IMAGE_TAG --set-string filer.extraEnvironmentVars.WEED_MYSQL_ENABLED=true --set master.enabled=false --set volume.enabled=false"
+          kubectl create namespace "$NS"
+
+          echo "=== install generates the db credentials ==="
+          helm install db $CHART_DIR -n "$NS" $DB_ARGS
+          [ "$(kubectl get secret "$SECRET" -n "$NS" -o jsonpath='{.data.user}' | base64 -d)" = YourSWUser ] \
+            || { echo "FAIL: install did not create the default user"; exit 1; }
+          [ "$(kubectl get secret "$SECRET" -n "$NS" -o jsonpath='{.data.password}' | base64 -d | wc -c)" -eq 32 ] \
+            || { echo "FAIL: install did not generate a 32-character password"; exit 1; }
+
+          echo "=== credentials in the kept Secret survive uninstall and install ==="
+          PASSWORD='p"a\ss: #x {{ .Values }}'
+          kubectl patch secret "$SECRET" -n "$NS" --type merge \
+            -p "$(jq -n --arg p "$PASSWORD" '{stringData: {user: "seaweed_app", password: $p}}')"
+          helm uninstall db -n "$NS"
+          kubectl get secret "$SECRET" -n "$NS" >/dev/null || { echo "FAIL: uninstall removed the db secret"; exit 1; }
+          helm install db $CHART_DIR -n "$NS" $DB_ARGS
+          [ "$(kubectl get secret "$SECRET" -n "$NS" -o jsonpath='{.data.user}' | base64 -d)" = seaweed_app ] \
+            || { echo "FAIL: reinstall reset the db user"; exit 1; }
+          [ "$(kubectl get secret "$SECRET" -n "$NS" -o jsonpath='{.data.password}' | base64 -d)" = "$PASSWORD" ] \
+            || { echo "FAIL: reinstall replaced the db password"; exit 1; }
+
+          helm uninstall db -n "$NS"
+          kubectl delete namespace "$NS"
+          echo "Filer db secret reinstall test passed"
+
       - name: Verify JWT signing key persistence across upgrades
         run: |
           # chart-testing puts its pip-less venv first on PATH; use setup-python.