fix(chart): fail loudly instead of generating random secrets on lookup miss

randAlphaNum fallbacks silently minted new db/redis/rustfs passwords on every cluster-less render (always the case under Argo CD's helm template), overwriting live credentials. Fresh installs now get a clear error demanding explicit values; helm upgrades are unaffected (lookup preserves existing secrets).
fix(deploy): imagePullSecrets items must be objects ({name: ...}), not bare strings
2026-10-18 23:20:22 +03:30 · 2026-10-18 22:59:04 +03:30 · 2026-10-18 22:14:50 +03:30
2 changed files with 10 additions and 4 deletions
@@ -8,7 +8,10 @@
 {{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
  {{- $pgPass = .Values.postgres.auth.password }}
 {{- else }}
-  {{- $pgPass = randAlphaNum 32 }}
+  {{- /* Fail loudly instead of silently minting a random password: under
+         Argo CD (helm template) `lookup` is always empty, and a random
+         value would diverge from the live service on every render. */}}
+  {{- fail "postgres.auth.password must be set: no existing pargar-postgres secret was found and .Values.postgres.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -30,7 +33,7 @@ stringData:
 {{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
  {{- $rdPass = .Values.redis.auth.password }}
 {{- else }}
-  {{- $rdPass = randAlphaNum 32 }}
+  {{- fail "redis.auth.password must be set: no existing pargar-redis secret was found and .Values.redis.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -56,7 +59,7 @@ stringData:
 {{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
  {{- $secret = .Values.rustfs.auth.secretKey }}
 {{- else }}
-  {{- $secret = randAlphaNum 40 }}
+  {{- fail "rustfs.auth.secretKey must be set: no existing pargar-rustfs secret was found and .Values.rustfs.auth.secretKey is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -58,7 +58,10 @@ global:
  # Images published by .gitea/workflows/build-and-push.yaml on tag push.
  imageRegistry: src.panahifar.ir/ahp
  publicUrl: https://pargar.panahifar.ir
-imagePullSecrets: []
+# Gitea packages are private: kubelet pulls need secret `gitea-pull`
+# (docker-registry secret for src.panahifar.ir, created in ns pargar).
+imagePullSecrets:
+  - name: gitea-pull
 ingress:
  enabled: true
  tls:
Author	SHA1	Message	Date
ahp	943897044a	fix(chart): fail loudly instead of generating random secrets on lookup miss build-and-push / build (push) Successful in 28s Details randAlphaNum fallbacks silently minted new db/redis/rustfs passwords on every cluster-less render (always the case under Argo CD's helm template), overwriting live credentials. Fresh installs now get a clear error demanding explicit values; helm upgrades are unaffected (lookup preserves existing secrets).	2026-10-18 23:20:22 +03:30
ahp	53c8c8e94c	fix(deploy): imagePullSecrets items must be objects ({name: ...}), not bare strings build-and-push / build (push) Successful in 30s Details Bare string items rendered an invalid Deployment spec (LocalObjectReference is a struct) which made Argo CD's strategic-merge patch fail with 'cannot restore struct from: string' on both Deployments.	2026-10-18 22:59:04 +03:30
ahp	c4c9f37bbc	release: pull private Gitea packages via gitea-pull secret (ns pargar) build-and-push / build (push) Successful in 29s Details	2026-10-18 22:14:50 +03:30