feat: improve parsing of secret envs

[Demonsthere]

Related issue(s)

• Fixes Space character in secret.system value hydra#2609

Checklist

• I have read the contributing guidelines
  and signed the CLA.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got green light (please contact
  security@ory.sh) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added necessary documentation within the code base (if
  appropriate).

Further comments

[zepatrik]

This will print single quotes around values? That is currently not properly parsed by hydra, see upstream PR ory/x#373

[Demonsthere]

This will print the supplied secrets as SECRETS_SYSTEM='foo bar 123 456 lorem','foo bar 123 456 lorem 1','foo bar 123 456 lorem 2','foo bar 123 456 lorem 3'. It seems to be working aka, hydra is running and not complaining about them

[zepatrik]

yes it is not complaining but the secrets are now actually including the quote, therefore they are different

[zepatrik]

and then hydra fails when trying to use those secrets later on for older records

[zepatrik]

TL;DR
We have to use some csv encoding function here instead, that also properly escapes commas and double quotes.

[Demonsthere]

yes i think it makes the most sense, currently we force a string, which can be either a simple value or stringied json array

[zepatrik]

OK not the best user experience though.
Why not

{{- define "hydra.secrets.system" -}}
  {{- if .Values.hydra.config.secrets.system -}}
    {{- if kindIs "[]string" .Values.hydra.config.secrets.system -}}
      {{- mustToRawJson .Values.hydra.config.secrets.system -}}
    {{- else -}}
      {{- fail "Expected .Values.hydra.config.secrets.system to be a list of strings" -}}
    {{- end -}}
  {{- else if .Values.demo -}}
  ["a-very-insecure-secret-for-checking-out-the-demo"]
  {{- end -}}

[Demonsthere]

This could also work, we just need to stringify at the end, as the result would be interpreted in bash [ string1 string2] and hydra doesn't like that

[zepatrik]

It is up to you, I just think that it would be a bad user experience to put raw JSON into the yaml, instead of automatically encoding the yaml values when rendering the template.

[Demonsthere]

I had to modify it slightly, but was able to make it work ;)

[zepatrik]

Looks good to me 😉

[Demonsthere]

@aeneasr What do you think?