<p>This is how I'm trying to create a secret for my kubernetes mongodb, which gets deployed using the <a href="https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml" rel="nofollow noreferrer">bitnami mongodb helm chart</a>:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mongodb-secret
  namespace: mongodb
  labels:
    app.kubernetes.io/component: mongodb
type: Opaque
data: 
  mongodb-root-password: 'encoded value'
  mongodb-passwords: '???'
  mongodb-metrics-password: 'encoded value'
  mongodb-replica-set-key: 'encoded value'
</code></pre>
<p>The helm chart values.yaml says:</p>
<pre><code>auth:
  ## MongoDB(&amp;reg;) custom users and databases
  ## ref: https://github.com/bitnami/containers/tree/main/bitnami/mongodb#creating-a-user-and-database-on-first-run
  ## @param auth.usernames List of custom users to be created during the initialization
  ## @param auth.passwords List of passwords for the custom users set at `auth.usernames`
  ## @param auth.databases List of custom databases to be created during the initialization
  ##
  usernames: []
  passwords: []
  databases: []
  ## @param auth.existingSecret Existing secret with MongoDB(&amp;reg;) credentials (keys: `mongodb-passwords`, `mongodb-root-password`, `mongodb-metrics-password`, ` mongodb-replica-set-key`)
  ## NOTE: When it's set the previous parameters are ignored.
  ##
  existingSecret: &quot;&quot;
</code></pre>
<p>So <code>passwords</code> is an array of strings for each <code>username</code> and each <code>database</code>.</p>
<p>How do I have to implement these multiple passwords in my secret?</p>
<p>The helm template should give me a hint, but I don't understand it: <a href="https://github.com/bitnami/charts/blob/main/bitnami/mongodb/templates/secrets.yaml" rel="nofollow noreferrer">secret.yaml</a></p>
<p>Or is it a simple string with all passwords separated by <code>,</code> and encoded?</p>

<p>Should be something like:</p>
<pre><code>auth:
  usernames: [&quot;bob&quot;, &quot;alice&quot;]
  passwords: [&quot;bobpass&quot;, &quot;alicepass&quot;]
  databases: [&quot;bobdb&quot;, &quot;alicedb&quot;]
</code></pre>
<p>If you want to pass those on the cli --set flag instead, you should be able to use curly braces as per this comment: <a href="https://github.com/helm/helm/issues/1987#issuecomment-280497496" rel="nofollow noreferrer">https://github.com/helm/helm/issues/1987#issuecomment-280497496</a> - like:</p>
<pre><code>--set auth.usernames={bob,alice},auth.passwords={bobpass,alicepass},auth.databases={bobdb,alicedb}
</code></pre>
<p>This would produce a secret like following - which you can check with <code>helm template</code> command:</p>
<pre><code>---
# Source: mongodb/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: release-name-mongodb
  namespace: default
  labels:
    app.kubernetes.io/name: mongodb
    helm.sh/chart: mongodb-13.4.4
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: mongodb
type: Opaque
data:
  mongodb-root-password: &quot;Uk1tZThhYzNFZg==&quot;
  mongodb-passwords: &quot;Ym9icGFzcyxhbGljZXBhc3M=&quot;
---
</code></pre>
<p>You can decode mongodb-passwords, using:</p>
<pre><code>echo -n Ym9icGFzcyxhbGljZXBhc3M= | base64 -d
</code></pre>
<p>and notice that it looks as following: <code>bobpass,alicepass</code></p>
<p>Also note that there seems to be an option to have mongodb.createSecret flag set to false and creating that secret manually (which may be more secure depending on the exact workflow).</p>
