release v0.3.8: chart metadata + image tags

- Chart 0.2.3 -> 0.2.4, appVersion 0.2.1 -> 0.3.7 (metadata labels only;
  pod templates use selectorLabels, no statefulset churn)
- values-apollo image tags 0.3.7 -> 0.3.8 (backend+frontend roll once)

deploy/helm/pargar/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: pargar
 description: Pargar gated LMS - Go API, Next.js frontend, Postgres, Redis, S3-compatible storage
 type: application
-version: 0.2.3
+version: 0.2.4
-appVersion: "0.2.1"
+appVersion: "0.3.7"
 keywords:
   - lms
   - pargar

deploy/helm/pargar/templates/secret-data.yaml

@@ -8,7 +8,10 @@
 {{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
   {{- $pgPass = .Values.postgres.auth.password }}
 {{- else }}
-  {{- $pgPass = randAlphaNum 32 }}
+  {{- /* Fail loudly instead of silently minting a random password: under
+         Argo CD (helm template) `lookup` is always empty, and a random
+         value would diverge from the live service on every render. */}}
+  {{- fail "postgres.auth.password must be set: no existing pargar-postgres secret was found and .Values.postgres.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -30,7 +33,7 @@ stringData:
 {{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
   {{- $rdPass = .Values.redis.auth.password }}
 {{- else }}
-  {{- $rdPass = randAlphaNum 32 }}
+  {{- fail "redis.auth.password must be set: no existing pargar-redis secret was found and .Values.redis.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -56,7 +59,7 @@ stringData:
 {{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
   {{- $secret = .Values.rustfs.auth.secretKey }}
 {{- else }}
-  {{- $secret = randAlphaNum 40 }}
+  {{- fail "rustfs.auth.secretKey must be set: no existing pargar-rustfs secret was found and .Values.rustfs.auth.secretKey is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret

deploy/helm/pargar/templates/servicemonitor.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.backend.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "pargar.fullname" . }}-backend
+  labels:
+    {{- include "pargar.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  selector:
+    matchLabels:
+      {{- include "pargar.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: {{ .Values.backend.metrics.serviceMonitor.interval | default "30s" }}
+      scheme: http
+      # /metrics answers 401 without it; Prometheus sends it as
+      # Authorization: Bearer <token>.
+      authorization:
+        type: Bearer
+        credentials:
+          name: {{ include "pargar.appSecretName" . }}
+          key: metrics-token
+{{- end }}

deploy/helm/pargar/values-apollo.yaml

@@ -11,7 +11,7 @@ backend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-backend
-    tag: 0.3.7
+    tag: 0.3.8
   metrics:
     serviceMonitor:
       enabled: true
@@ -41,7 +41,7 @@ frontend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-frontend
-    tag: 0.3.7
+    tag: 0.3.8
   podDisruptionBudget:
     enabled: false
   replicaCount: 2
@@ -61,7 +61,7 @@ global:
 # Gitea packages are private: kubelet pulls need secret `gitea-pull`
 # (docker-registry secret for src.panahifar.ir, created in ns pargar).
 imagePullSecrets:
-  - gitea-pull
+  - name: gitea-pull
 ingress:
   enabled: true
   tls:

deploy/helm/pargar/values.yaml

@@ -25,6 +25,13 @@ backend:
     pullPolicy: IfNotPresent
   service:
     port: 8080
+  metrics:
+    # Prometheus Operator ServiceMonitor. /metrics is bearer-protected by
+    # METRICS_TOKEN, so the endpoint carries authorization credentials
+    # (pargar-app secret) instead of scraping anonymously.
+    serviceMonitor:
+      enabled: false
+      interval: 30s
   resources:
     requests:
       cpu: 50m