Exporter REDIS_PASSWORD overrides --redis.password-file, breaking a dedicated exporter ACL user (0.9.4+)

[jalet]

Since #141 (in 0.9.4 / 0.10.0), the metrics exporter always receives REDIS_PASSWORD sourced from the default user's password:

# templates/deploy_valkey.yaml
- name: REDIS_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ .Values.auth.usersExistingSecret }}
      key: {{ $passwordKey }}   # the *default* user's key

redis_exporter intentionally lets --redis.password/REDIS_PASSWORD win over --redis.password-file (README: the password file "only takes effect when redis.password == """). The problem is that the chart sets REDIS_PASSWORD (to the default user's value) with no way to opt out, which silently clobbers the --redis.password-file the chart itself lets you configure via metrics.exporter.args.

So pointing the exporter at a dedicated read-only ACL user authenticates as that user but with the default user's password → WRONGPASS → redis_up 0. This worked on 0.9.3 (no REDIS_PASSWORD injected).

Minimal repro:

auth:
  enabled: true
  usersExistingSecret: valkey-creds      # keys: default, exporter
  aclUsers:
    default:  { permissions: "~* &* +@all" }
    exporter: { permissions: "~* +@read +info +ping +config|get" }
metrics:
  enabled: true
  exporter:
    args:
      - --redis.user=exporter
      - --redis.password-file=/secret/exporter   # silently ignored

Result: Couldn't connect to redis instance / redis_up 0.

Workaround (keeps read-only perms, but couples the passwords): give the exporter user the default user's password.

aclUsers:
  exporter:
    permissions: "..."
    passwordKey: default

Request: a way to give the exporter a non-default user's password -- e.g. honor --redis.password-file/--redis.password from metrics.exporter.args, or a value to choose which user/passwordKey feeds REDIS_PASSWORD.