feat (chart): add support for existing usecase secret

infrastructure/README.md

@@ -459,6 +459,16 @@ shared:
       USECASE_SECRET_ENV_VAR: ...
 ```
 
+If you manage the usecase secret via External Secrets Operator, create the Secret in the target namespace and point the chart to it:
+
+```yaml
+shared:
+  secrets:
+    usecaseExistingSecretName: "my-usecase-secret"
+```
+
+When `usecaseExistingSecretName` is set, the chart will not create the usecase secret and will reference the existing one instead.
+
 ## 2. Requirements and Setup Instructions
 
 The following section describes the requirements for the infrastructure setup and provides instructions for the local and production setup.

infrastructure/rag/templates/_helpers.tpl

@@ -15,8 +15,12 @@
 {{- end -}}
 
 {{- define "secret.usecaseName" -}}
+{{- if .Values.shared.secrets.usecaseExistingSecretName -}}
+{{- .Values.shared.secrets.usecaseExistingSecretName | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
 {{- printf "%s-usecase-secret" .Release.Name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+{{- end -}}
 
 {{/* Resolve basic auth credentials from inline values or referenced secrets. */}}
 {{- define "rag.basicAuthCredentials" -}}

infrastructure/rag/templates/secrets.yaml

@@ -9,6 +9,7 @@ data:
   S3_SECRET_ACCESS_KEY: {{ .Values.shared.secrets.s3.secretKey.value | b64enc }}
 {{- end }}
 ---
+{{- if not .Values.shared.secrets.usecaseExistingSecretName }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -18,3 +19,4 @@ data:
   {{- range $key, $value := .Values.shared.secrets.usecase }}
   {{ $key }}: {{ $value | b64enc }}
   {{- end }}
+{{- end }}

infrastructure/rag/values.yaml

@@ -531,6 +531,7 @@ shared:
         secretKeyRef:
           name: ""
           key: "S3_SECRET_ACCESS_KEY"
+    usecaseExistingSecretName: "" # Optional: existing Secret name (e.g., from ESO). If set, chart will not create usecase secret.
     usecase: {}