Hotfix: allows new secret creation when service enabled

[ArtisKrumins]

https://wunder.atlassian.net/browse/SLT-1325

[Copilot]

Pull request overview

This PR adjusts the Drupal Helm chart’s pre-/post-release hook Jobs to stop using the shared drupal.php-container helper and instead render the PHP image and environment variables explicitly, while factoring shared env vars into a new drupal.env-common helper.

Changes:

• Updated pre-release and post-release Job templates to set image and env directly rather than including drupal.php-container.
• Introduced drupal.env-common and drupal.pre-release-env helpers and refactored drupal.env to reuse the common env block.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
drupal/templates/pre-release.yaml	Switches pre-release Job container rendering to explicit image + included env helper.
drupal/templates/post-release.yaml	Switches post-release Job container rendering to explicit image + included env helper.
drupal/templates/_helpers.tpl	Refactors env helpers by introducing drupal.env-common and a new hook env helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

drupal/templates/post-release.yaml:27

• The post-release hook runs after regular release resources have been applied, so it should keep the full runtime environment. Pointing it at the pre-release-specific helper either leaves that helper identical (and preserves the pre-upgrade bug) or, once the helper is correctly reduced, deprives post-install/post-upgrade commands of service credentials. Use drupal.env here and reserve drupal.pre-release-env for the pre-upgrade Job.

        {{- include "drupal.pre-release-env" . | nindent 8 }}

[ArtisKrumins]

What is your suggestion for solution?

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

drupal/templates/post-release.yaml:27

• A post-install/post-upgrade hook runs after the chart resources have been submitted, so it should keep the normal required Secret references. Making them optional here means the Job can start before a delayed Secret exists; Kubernetes then permanently omits that environment variable from this container, and the post-release commands can run with missing Redis/SMTP/Varnish credentials instead of waiting. Use drupal.env here and reserve drupal.pre-release-env for the pre-upgrade hook.

        {{- include "drupal.pre-release-env" . | nindent 8 }}

drupal/templates/_helpers.tpl:212

• The pre-release context still leaves the conditional database Secrets required: drupal.db-env emits mandatory *-mariadb and PXC secretKeyRefs. For example, upgrading with pxc-db.enabled=true while MariaDB remains primary guarantees that the pre-upgrade Job references the new PXC Secret before that resource can be created, so the same CreateContainerConfigError remains for this service. Propagate optionalSecrets to all four conditional database references (or omit auxiliary DB credentials from this hook); if changing the primary database is supported, the hook also needs to retain the old primary connection rather than wait for the not-yet-created service.

{{- include "drupal.env-common" (merge (dict "optionalSecrets" true) .) }}

[Jancis]

optionalSecrets.opional is an excellent idea!