fix(chart): support existingSecret and provide CLUSTER_KUBECONFIG_KEY to backend

Backend now fails production validation without CLUSTER_KUBECONFIG_KEY.
Add cluster-kubeconfig-key to the chart secret and env, plus
secrets.existingSecret so GitOps deployments can use a pre-created
(sealed) Secret instead of the lookup/randAlphaNum template that churns
under Argo CD's helm template rendering.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -46,8 +46,12 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{- define "cloudhost-platform.secretName" -}}
+{{- if .Values.secrets.existingSecret }}
+{{- .Values.secrets.existingSecret }}
+{{- else }}
 {{- printf "%s-secrets" (include "cloudhost-platform.fullname" .) }}
 {{- end }}
+{{- end }}
 
 {{- define "cloudhost-platform.tlsSecretName" -}}
 {{- if .Values.ingress.tls.secretName }}

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -82,6 +82,11 @@ spec:
                 secretKeyRef:
                   name: {{ include "cloudhost-platform.secretName" . }}
                   key: jwt-refresh-secret
+            - name: CLUSTER_KUBECONFIG_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: cluster-kubeconfig-key
             - name: FRONTEND_URL
               value: {{ include "cloudhost-platform.corsOrigins" . | quote }}
             {{- range $key, $val := .Values.backend.env }}

backend/helm/cloudhost-platform/templates/secret.yaml

@@ -1,3 +1,10 @@
+{{- if not .Values.secrets.existingSecret }}
+{{/*
+NOTE: lookup only works with `helm install/upgrade` (CLI). Argo CD renders with
+`helm template` where lookup is always empty, so values would be regenerated on
+every sync. For GitOps deployments set secrets.existingSecret and manage the
+Secret out-of-band (e.g. SealedSecret in the gitops repo).
+*/}}
 {{- $existing := lookup "v1" "Secret" (include "cloudhost-platform.namespace" .) (include "cloudhost-platform.secretName" .) }}
 {{- $pgPass := .Values.postgres.password }}
 {{- if not $pgPass }}
@@ -11,6 +18,10 @@
 {{- if not $jwtRefresh }}
 {{- if $existing }}{{- $jwtRefresh = index $existing.data "jwt-refresh-secret" | b64dec }}{{- else }}{{- $jwtRefresh = randAlphaNum 32 }}{{- end }}
 {{- end }}
+{{- $kubeconfigKey := .Values.secrets.clusterKubeconfigKey }}
+{{- if not $kubeconfigKey }}
+{{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -23,3 +34,5 @@ stringData:
   postgres-password: {{ $pgPass | quote }}
   jwt-secret: {{ $jwt | quote }}
   jwt-refresh-secret: {{ $jwtRefresh | quote }}
+  cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
+{{- end }}

backend/helm/cloudhost-platform/values.yaml

@@ -77,8 +77,15 @@ frontend:
 
 # JWT secrets — set in production (values-production.example.yaml)
 secrets:
+  # Use a pre-created Secret instead of chart-managed one. Required for GitOps
+  # (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on
+  # every sync). Secret must contain keys: postgres-password, jwt-secret,
+  # jwt-refresh-secret, cluster-kubeconfig-key.
+  existingSecret: ""
   jwtSecret: ""
   jwtRefreshSecret: ""
+  # AES key for encrypting stored kubeconfigs (64 hex chars or any passphrase)
+  clusterKubeconfigKey: ""
 
 ingress:
   enabled: true