From 8f657dcd36cc8c8f89b5e493307ff9cf125b4038 Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Tue, 30 Jun 2026 10:51:21 -0700
Subject: [PATCH] fix mongo namespace

---
 charts/helm/checkmate/templates/secrets.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/charts/helm/checkmate/templates/secrets.yaml b/charts/helm/checkmate/templates/secrets.yaml
index af104e7d1..9c99395f4 100644
--- a/charts/helm/checkmate/templates/secrets.yaml
+++ b/charts/helm/checkmate/templates/secrets.yaml
@@ -4,6 +4,14 @@
   {{- fail "secrets.JWT_SECRET must be overridden and cannot be 'change_me'" }}
 {{- end }}
 
+{{- /*
+  The bundled Mongo service ("checkmate-mongodb") lives in .Release.Namespace. App pods reach it
+  by bare name, but the KEDA operator runs in its own namespace and a bare name is NXDOMAIN there,
+  so worker autoscaling fails to query the backlog. Qualify the in-cluster host to its FQDN here so
+  the one connection string resolves from every namespace. External/already-qualified hosts are not
+  matched (the char after the host name is "." for an FQDN, which the pattern excludes).
+*/}}
+{{- $mongoFqdn := printf "checkmate-mongodb.%s.svc.cluster.local" .Release.Namespace }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -11,5 +19,9 @@ metadata:
 type: Opaque
 stringData:
 {{- range $key, $value := $secrets }}
+{{- if eq $key "DB_CONNECTION_STRING" }}
+  {{ $key }}: {{ regexReplaceAll "(//|@)checkmate-mongodb([:/,]|$)" $value (printf "${1}%s${2}" $mongoFqdn) | quote }}
+{{- else }}
   {{ $key }}: {{ $value | quote }}
+{{- end }}
 {{- end }}
\ No newline at end of file