From a76b2391718146abfd2c28616088a86b882ae46f Mon Sep 17 00:00:00 2001
From: MartinHell <martin@hellstrom.it>
Date: Sat, 22 Aug 2026 01:50:29 +0200
Subject: [PATCH] fix(secret): read pinnable secrets with dig to survive
 --reuse-values

`helm upgrade --reuse-values` from any chart <= 0.3.5 to 0.3.6 failed to
render:

  secret.yaml:45:75: executing "patchmon/templates/secret.yaml" at
  <.Values.patchmon.session.secret>: nil pointer evaluating interface {}.secret

--reuse-values substitutes the previous release's values for the incoming
chart's defaults instead of merging them, so 0.3.6's new
patchmon.session.secret and patchmon.encryption.aiKey defaults are never
coalesced in. A release created before those keys existed has no
patchmon.session or patchmon.encryption map at all, and dereferencing the
absent parent aborts the render.

patchmon.jwt.secret was unaffected only because patchmon.jwt predates the
keys added in #7, so every stored release already carries it.

Reading all three through `dig` makes the parent lookup total: an absent map
yields the "" default and falls through to the existing lookup on the live
Secret, preserving the current values exactly as before. Explicitly set
values still win, and empty values still generate.

The failure is only reachable via --reuse-values; a fresh install or `-f
values.yaml` coalesces chart defaults normally, which is why CI did not catch
it. An upgrade-path test would.

Refs: #10

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8fLdB23wUNywajvRtNYbt
---
 charts/patchmon/Chart.yaml            |  2 +-
 charts/patchmon/templates/secret.yaml | 18 +++++++++++++++---
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/charts/patchmon/Chart.yaml b/charts/patchmon/Chart.yaml
index 881ff3c..1edb800 100644
--- a/charts/patchmon/Chart.yaml
+++ b/charts/patchmon/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: patchmon
 description: PatchMon v2 – Linux patch management platform with optional Gateway API, Postgres, Valkey, and Guacd
 type: application
-version: 0.3.6
+version: 0.3.7
 appVersion: "2.1.3"
 
 maintainers:
diff --git a/charts/patchmon/templates/secret.yaml b/charts/patchmon/templates/secret.yaml
index 0bdf592..4fd1668 100644
--- a/charts/patchmon/templates/secret.yaml
+++ b/charts/patchmon/templates/secret.yaml
@@ -30,6 +30,18 @@
 {{- $oldOidc = (index (index $s "data") "OIDC_CLIENT_SECRET") | b64dec -}}
 {{- end -}}
 
+{{- /*
+  Read the pinnable secrets with `dig` rather than a direct path. `helm upgrade
+  --reuse-values` substitutes the previous release's values for the incoming
+  chart's defaults instead of merging them, so a release created before these
+  keys existed has no `patchmon.session` / `patchmon.encryption` map at all and
+  a direct `.Values.patchmon.session.secret` fails to render with
+  "nil pointer evaluating interface {}.secret".
+*/ -}}
+{{- $jwtVal := dig "jwt" "secret" "" .Values.patchmon -}}
+{{- $sessionVal := dig "session" "secret" "" .Values.patchmon -}}
+{{- $aiKeyVal := dig "encryption" "aiKey" "" .Values.patchmon -}}
+
 apiVersion: v1
 kind: Secret
 metadata:
@@ -41,9 +53,9 @@ stringData:
 {{- if and (eq .Values.database.mode "internal") (not .Values.postgres.auth.existingSecret) }}
   POSTGRES_PASSWORD: {{ default (randAlphaNum 32) $oldPg | quote }}
 {{- end }}
-  JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt .Values.patchmon.jwt.secret) | quote }}
-  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession .Values.patchmon.session.secret) | quote }}
-  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey .Values.patchmon.encryption.aiKey) | quote }}
+  JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt $jwtVal) | quote }}
+  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession $sessionVal) | quote }}
+  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey $aiKeyVal) | quote }}
 {{- if .Values.valkey.auth.enabled }}
   REDIS_PASSWORD: {{ default (randAlphaNum 32) $oldRedis | quote }}
 {{- end }}