Setting further sane chart defaults

.github/workflows/ci.yml

@@ -310,7 +310,6 @@ jobs:
         if: steps.gate.outputs.skip != 'true' && steps.version.outputs.skip != 'true'
         env:
           VERSION: ${{ steps.version.outputs.version }}
-          IMAGE: ${{ steps.version.outputs.image }}
         run: |
           set -euo pipefail
           chart="${RUNNER_TEMP}/squirrelbot"
@@ -321,7 +320,6 @@ jobs:
           from pathlib import Path
 
           version = os.environ["VERSION"]
-          image = os.environ["IMAGE"]
           root = Path(os.environ["CHART_DIR"])
 
           chart = root / "Chart.yaml"
@@ -338,18 +336,6 @@ jobs:
           if not saw_version or not saw_app:
               raise SystemExit("Chart.yaml is missing version or appVersion")
           chart.write_text("\n".join(lines) + "\n")
-
-          values = root / "values.yaml"
-          lines = values.read_text().splitlines()
-          found = False
-          for i, line in enumerate(lines):
-              if line.startswith("  repository:"):
-                  lines[i] = f"  repository: {image}"
-                  found = True
-                  break
-          if not found:
-              raise SystemExit("image.repository is missing from values.yaml")
-          values.write_text("\n".join(lines) + "\n")
           PY
           helm package "$chart" --destination dist
           (

README.md

@@ -67,14 +67,14 @@ The chart is `deploy/helm/squirrelbot`. It runs one replica with the Recreate st
 ```sh
 helm upgrade --install squirrelbot deploy/helm/squirrelbot \
   --set publicUrl=https://mod.example.com \
-  --set secrets.databaseUrl='postgres://squirrelbot:PASSWORD@db:5432/squirrelbot?sslmode=disable' \
+  --set secrets.databaseUrl='postgres://squirrelbot:PASSWORD@db:5432/squirrelbot' \
   --set secrets.discordToken=TOKEN \
   --set secrets.discordClientId=CLIENT_ID \
   --set secrets.discordClientSecret=CLIENT_SECRET \
   --set secrets.sessionSecret=AT_LEAST_32_RANDOM_CHARACTERS
 ```
 
-Set `postgres.bundled=true` and `postgres.auth.password` to start a bundled Postgres StatefulSet. That database is for a single cluster and a small server. Use an external Postgres for anything you need to restore. `postgres.sslMode` sets the libpq mode on `DATABASE_URL` when the chart writes that URL. The default is `disable`. An `sslmode` already present in `secrets.databaseUrl` is left as written.
+Set `postgres.bundled=true` and `postgres.auth.password` to start a bundled Postgres StatefulSet. That database is for a single cluster and a small server. Use an external Postgres for anything you need to restore. `postgres.sslMode` sets the libpq mode on `DATABASE_URL` when the chart writes that URL. Bundled Postgres uses `disable`. An external database uses `require`. An `sslmode` already present in `secrets.databaseUrl` is left as written.
 
 `make image` builds `squirrelbot:latest` and the next patch version from the repository root. The first build is one patch above the chart app version. Later builds increment the patch again. The last version is stored in `build/image-version`. Set `imagePullSecrets` when the registry is private.
 
@@ -90,7 +90,7 @@ Each release includes:
 - The image `ghcr.io/boxingoctopuscreative/squirrelbot`, tagged with the version and with `latest`.
 - The Helm chart, attached to the GitHub release and published to `oci://ghcr.io/boxingoctopuscreative/charts/squirrelbot`. Each release also carries an `index.yaml`, so Helm can add the release archive as a chart repository.
 
-The published chart uses that GHCR image. The chart in this repository keeps the local image name `squirrelbot`, which matches `make image`. Install the published chart with the same `--set` values as the local chart, and set `--version` to the release you want.
+The chart pulls `ghcr.io/boxingoctopuscreative/squirrelbot`. `make image` builds the local name `squirrelbot`. Set `image.repository=squirrelbot` to use that image. Install the published chart with the same `--set` values as the local chart, and set `--version` to the release you want.
 
 ```sh
 helm repo add squirrelbot https://github.com/BoxingOctopusCreative/SquirrelBot/releases/latest/download

deploy/helm/squirrelbot/templates/_helpers.tpl

@@ -29,12 +29,22 @@
 {{- end }}
 
 {{- define "squirrelbot.image" -}}
-{{- $tag := .Values.image.tag | default "latest" }}
-{{- printf "%s:%s" .Values.image.repository $tag }}
+{{- $image := .Values.image | default dict }}
+{{- $repository := $image.repository | default "ghcr.io/boxingoctopuscreative/squirrelbot" }}
+{{- $tag := $image.tag | default "latest" }}
+{{- printf "%s:%s" $repository $tag }}
 {{- end }}
 
 {{- define "squirrelbot.sslMode" -}}
-{{- $mode := .Values.postgres.sslMode | default "disable" -}}
+{{- $postgres := .Values.postgres | default dict -}}
+{{- $mode := $postgres.sslMode -}}
+{{- if not $mode -}}
+{{- if $postgres.bundled -}}
+{{- $mode = "disable" -}}
+{{- else -}}
+{{- $mode = "require" -}}
+{{- end -}}
+{{- end -}}
 {{- $allowed := list "disable" "allow" "prefer" "require" "verify-ca" "verify-full" -}}
 {{- if not (has $mode $allowed) -}}
 {{- fail "postgres.sslMode must be disable, allow, prefer, require, verify-ca, or verify-full" -}}

deploy/helm/squirrelbot/templates/deployment.yaml

@@ -34,7 +34,7 @@ spec:
       containers:
         - name: squirrelbot
           image: {{ include "squirrelbot.image" . | quote }}
-          imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }}
+          imagePullPolicy: {{ ((.Values.image | default dict).pullPolicy) | default "IfNotPresent" }}
           ports:
             - name: http
               containerPort: 8080
@@ -64,7 +64,9 @@ spec:
             initialDelaySeconds: 10
             periodSeconds: 20
           resources:
-            {{- toYaml .Values.resources | nindent 12 }}
+            {{- $defaults := dict "requests" (dict "cpu" "50m" "memory" "64Mi") "limits" (dict "memory" "256Mi") }}
+            {{- $set := .Values.resources | default dict }}
+            {{- toYaml (mergeOverwrite (deepCopy $defaults) $set) | nindent 12 }}
       volumes:
         - name: tmp
           emptyDir: {}

deploy/helm/squirrelbot/templates/postgres.yaml

@@ -74,7 +74,12 @@ spec:
               command: ["pg_isready", "-U", {{ .Values.postgres.auth.username | quote }}]
             periodSeconds: 10
           resources:
-            {{- toYaml .Values.postgres.resources | nindent 12 }}
+            {{- $defaults := dict "requests" (dict "cpu" "50m" "memory" "128Mi") "limits" (dict "memory" "512Mi") }}
+            {{- $set := dict }}
+            {{- if .Values.postgres }}
+            {{- $set = .Values.postgres.resources | default dict }}
+            {{- end }}
+            {{- toYaml (mergeOverwrite (deepCopy $defaults) $set) | nindent 12 }}
   volumeClaimTemplates:
     - metadata:
         name: data

deploy/helm/squirrelbot/templates/service.yaml

@@ -12,5 +12,9 @@ spec:
     app.kubernetes.io/instance: {{ .Release.Name }}
   ports:
     - name: http
-      port: {{ .Values.service.port }}
+      {{- if .Values.service }}
+      port: {{ .Values.service.port | default 8080 }}
+      {{- else }}
+      port: 8080
+      {{- end }}
       targetPort: http

deploy/helm/squirrelbot/values.yaml

@@ -1,19 +1,8 @@
-nameOverride: ""
-fullnameOverride: ""
-
-image:
-  repository: squirrelbot
-  tag: latest
-  pullPolicy: IfNotPresent
-
 imagePullSecrets: []
 
 # The Discord gateway allows one session per bot token. The Deployment
 # hardcodes replicas to 1 and uses Recreate. Do not scale this chart.
 
-service:
-  port: 8080
-
 publicUrl: ""
 
 existingSecret: ""
@@ -41,23 +30,14 @@ ingress:
   certResolver: letsencrypt
   tlsSecretName: squirrelbot-tls
 
-resources:
-  requests:
-    cpu: 50m
-    memory: 64Mi
-  limits:
-    memory: 256Mi
-
 # bundled starts a Postgres StatefulSet for this release.
 # Leave it false and set secrets.databaseUrl for an external database.
 # sslMode is the libpq mode: disable, allow, prefer, require,
 # verify-ca, or verify-full. The bundled server does not terminate
-# TLS, so leave sslMode at disable for that database. For an external
-# database, an sslmode already in secrets.databaseUrl is kept. When
-# that URL omits sslmode, the chart adds this value.
+# TLS, so that database uses disable. An external database uses
+# require. An sslmode already in secrets.databaseUrl is kept.
 postgres:
   bundled: false
-  sslMode: disable
   image: postgres:16-alpine
   auth:
     database: squirrelbot
@@ -66,9 +46,3 @@ postgres:
   persistence:
     size: 8Gi
     storageClass: ""
-  resources:
-    requests:
-      cpu: 50m
-      memory: 128Mi
-    limits:
-      memory: 512Mi