fix(hosting): fail the upgrade when secrets.existingSecret is missing keys

When secrets.existingSecret is set the chart generates nothing and reads
every application and control-plane key from that Secret. A chart version
that starts consuming a new key therefore breaks the webapp rollout with a
CreateContainerConfigError partway through, leaving the release half-applied.

The pre-install/pre-upgrade validation now looks the Secret up and fails with
the full list of missing keys, so a running release is left untouched. The
lookup returns nothing under helm template and client-side dry-run, where the
check is skipped rather than guessing.

Author: matt-aitken

hosting/k8s/helm/templates/validate-external-config.yaml

@@ -54,7 +54,36 @@ Application and control-plane secrets are auto-generated by templates/secrets.ya
 when left unset (retained across upgrades via lookup), so they need no fail-closed
 guard here. The webapp still rejects previously published values at startup, even
 when supplied via secrets.existingSecret.
+
+With secrets.existingSecret the chart generates nothing, so every key the workloads
+reference has to already be present in that Secret. Report missing keys up front -
+otherwise a chart version that starts consuming a new key only surfaces it as a
+CreateContainerConfigError partway through the rollout. The check is skipped when
+`lookup` returns nothing (helm template, client-side dry-run, or a Secret created
+later in the same apply): it can only report on what it can read.
 */}}
+{{- if .Values.secrets.existingSecret }}
+{{- $required := list "SESSION_SECRET" "MAGIC_LINK_SECRET" "ENCRYPTION_KEY" "PROVIDER_SECRET" "COORDINATOR_SECRET" "MANAGED_WORKER_SECRET" }}
+{{- if and .Values.s3.deploy (not .Values.s3.auth.existingSecret) }}
+{{- $required = concat $required (list "s3-auth-access-key-id" "s3-auth-secret-access-key") }}
+{{- end }}
+{{- if and (not .Values.s3.deploy) (not .Values.s3.external.existingSecret) .Values.s3.external.accessKeyId }}
+{{- $required = concat $required (list "s3-access-key-id" "s3-secret-access-key") }}
+{{- end }}
+{{- $found := lookup "v1" "Secret" .Release.Namespace .Values.secrets.existingSecret }}
+{{- if $found }}
+{{- $data := (get $found "data") | default dict }}
+{{- $missing := list }}
+{{- range $key := $required }}
+{{- if not (hasKey $data $key) }}
+{{- $missing = append $missing $key }}
+{{- end }}
+{{- end }}
+{{- if $missing }}
+{{- fail (printf "Secret %q (secrets.existingSecret) is missing required keys: %s. Add them before upgrading - while secrets.existingSecret is set the chart generates nothing and inline secrets.* values are ignored. See https://trigger.dev/docs/self-hosting/kubernetes#upgrading" .Values.secrets.existingSecret (join ", " $missing)) }}
+{{- end }}
+{{- end }}
+{{- end }}
 
 {{/*
 This template produces no output but will fail the deployment if validation fails