deploy/helm/grimmory/Chart.yaml (1)

16-16: 🛠️ Refactor suggestion | 🟠 Major

Bump chart version along with the breaking subchart switch.

The MariaDB subchart change (Bitnami → CloudPirates) is a breaking change to this chart's effective values surface (e.g. consumers who set mariadb.primary.service.ports.mysql, mariadb.auth.existingSecret semantics, etc., will silently break). Per Helm SemVer guidance, the parent chart version should be incremented (at minimum a minor bump while pre-1.0, or major if you treat it as 1.0+). Leaving it at 0.1.0 makes upgrades indistinguishable from the previous release.

📦 Suggested bump

-version: 0.1.0
+version: 0.2.0

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@deploy/helm/grimmory/Chart.yaml` at line 16, The Chart.yaml version remains
at 0.1.0 even though the MariaDB subchart was switched (a breaking change);
update the Chart.yaml `version` field to a higher SemVer so upgrades are
distinguishable—e.g., bump the Chart.yaml `version` from 0.1.0 to at least 0.2.0
(for pre-1.0 minor bump) or to a major version if you treat it as 1.x, commit
the updated Chart.yaml `version` to reflect the breaking subchart change.

deploy/helm/grimmory/templates/deployment.yaml (1)

69-77: ⚠️ Potential issue | 🔴 Critical

mariadb-password secret key does not match CloudPirates MariaDB chart defaults — use user-password instead.

The grimmory Helm chart depends on CloudPirates' MariaDB chart (v0.16.*), which creates secrets with the key user-password by default (via auth.secretKeys.userPasswordKey). The current hardcoded key: mariadb-password on line 77 will cause the pod to fail at startup: either the secret key reference will fail, or the pod will start with an empty password and fail authentication.

When using CloudPirates' default secret, replace key: mariadb-password with key: user-password. When using a custom existingSecret, respect the chart's secretKeys.userPasswordKey configuration:

Suggested fix

             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
                   {{- if .Values.mariadb.auth.existingSecret }}
                   name: {{ .Values.mariadb.auth.existingSecret }}
+                  key: {{ .Values.mariadb.auth.secretKeys.userPasswordKey | default "user-password" }}
                   {{- else }}
                   name: {{ .Release.Name }}-mariadb
+                  key: user-password
                   {{- end }}
-                  key: mariadb-password

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@deploy/helm/grimmory/templates/deployment.yaml` around lines 69 - 77, The env
var DATABASE_PASSWORD currently references a hardcoded secret key
"mariadb-password" which is incompatible with the CloudPirates MariaDB chart
default; update the secretKeyRef key to use the MariaDB chart's user password
key instead (use "user-password" as the default) and honor any configured
override in the chart values. Concretely, replace the static key:
mariadb-password with a templated expression that defaults to "user-password"
but uses .Values.mariadb.auth.secretKeys.userPasswordKey when provided (and keep
the existing logic around .Values.mariadb.auth.existingSecret and the
release-named secret unchanged).