Values file imagePullSecrets format is invalid for the Graylog Helm chart

[ryankenney-dev]

The Problem

I see this values.yaml option:

global:
  imagePullSecrets: []

... which I set to:

global:
  imagePullSecrets: [ "my-pull-secret" ]

... which results in this error:

StatefulSet in version "v1" cannot be handled as a StatefulSet: json: cannot unmarshal string into Go struct field PodSpec.spec.template.spec.imagePullSecrets of type v1.LocalObjectReference

If I convert the vales.yaml structure to the form I believe the Pod spec can handle:

global:
  imagePullSecrets:
  - name: "my-pull-secret"

... which results in this error:

Error: UPGRADE FAILED: values don't meet the specifications of the schema(s) in the following chart(s):
graylog:
- at '/global/imagePullSecrets/0': got object, want string

I see this spec in graylog's values.schema.json:

"global": {
  "type": "object",
  "properties": {
    "imagePullSecrets": {
      "type": "array",
      "items": { "type": "string" }
    },
    "storageClass": { "type": "string" },
    "existingSecretName": { "type": "string", "description": "Name of existing Graylog secret containing GRAYLOG_MONGODB_URI, GRAYLOG_ROOT_USERNAME, GRAYLOG_PASSWORD_SECRET, and GRAYLOG_ROOT_PASSWORD_SHA2" }
  }
},

I see this logic in graylog's statefulsets/graylog.yaml template:

spec:
  dnsPolicy: ClusterFirst
  {{- with .Values.graylog.image.imagePullSecrets | default .Values.global.imagePullSecrets }}
  imagePullSecrets:
    {{- toYaml . | nindent 8 }}

Workaround

For now, I can work around the problem by disabling schema validation and forcing the value to the structure the chart assumes:

helm install \
  --skip-schema-validation \
  --set-json 'global.imagePullSecrets=[{"name":"my-pull-secret"}]' \
  graylog graylog

[williamtrelawny]

Thanks @ryankenney-dev for reporting this! This is precisely why we released this public beta- testing all the edge cases we didn't think about.

It is indeed a bug and should be fixed in the PR above (#93). I've already verified it but you can check out the fix/imagePullSecret-schema branch yourself if you want to test before this is merged to main.