* feat(chart): support referencing a pre-existing Secret via existingSecret
Add an existingSecret value to the k3s chart so operators can supply a
cluster-managed Secret instead of letting the chart generate one.
- existingSecret non-empty: skip rendering secret.yaml; Deployment envFrom
references the named Secret; checksum/env-secret annotation omitted (the
chart does not promise to roll on external Secret content changes).
- existingSecret empty: behavior unchanged (chart creates <release>-env and
references it; full backward compatibility).
- When existingSecret is set, .Values.env.* required validations are skipped
via the conditional render (no conflict detection with env.*).
- No per-key mapping (still envFrom), no lookup/verification of the external
Secret, no new NOTES.txt/README — the chart's documentation surface is left
as-is.
Verified with helm template in both modes.
Closes#595
Co-Authored-By: Claude <noreply@anthropic.com>
* test(chart): assert envFrom resolves to envSecretRefName for existingSecret
The k3sAssets guard asserted envFrom referenced metapi.envSecretName, but the
existingSecret feature renamed the envFrom binding to metapi.envSecretRefName
(secretRef.name falls back to the helper when existingSecret is unset). Update
the assertion to match and pin the new existingSecret branch with guards on the
envSecretRefName define and the .Values.existingSecret branch in _helpers.tpl.
Co-Authored-By: Claude <noreply@anthropic.com>
* docs(k3s): document existingSecret mode, required keys, and roll caveat
Add a dedicated section to the k3s update-center doc covering the chart's
existingSecret value: the chart-managed Secret vs an operator-supplied one, the
fixed 11 keys the external Secret must provide, and the behavioral change that
the checksum/env-secret auto-roll on Secret change is omitted under
existingSecret (operators must drive rollouts via Reloader or manual restart).
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* add k3s update center
* fix update center status timeouts
* Polish update center settings UI
* Document k3s update center
* Refocus update center docs for users
* Clarify k3s migration path in docs
