Default to public image pulls

README.md

@@ -19,7 +19,7 @@ Edit only `chart-version.txt` for a new base chart version. CI packages a unique
 
 The published chart is available via `helm repo add brunner https://brunner.ninja/charts && helm repo update brunner`. `install.sh` is kept for manual deployments. CI renders the same chart and patches the named existing resources, since Helm release storage would require CI to read Kubernetes Secrets. A later manual Helm upgrade reconciles Helm's stored release revision with the latest chart.
 
-For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Set `imagePullSecret: ""` for anonymous pulls of the public Quay image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
+For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Public images need no pull secret; set `imagePullSecret` only when using a private replacement image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
 
 ## Connect a Brave browser
 

bootstrap.sh

@@ -7,7 +7,4 @@ project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
   exit 1
 }
 kubectl apply --filename "${project_dir}/namespace.yaml"
-kubectl --namespace default get secret quay-pull-secret --output=json \
-  | jq 'del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.managedFields, .metadata.annotations, .metadata.ownerReferences) | .metadata.namespace = "brave-sync"' \
-  | kubectl apply --filename - >/dev/null
-echo "brave-sync namespace and Quay pull secret are ready"
+echo "brave-sync namespace is ready"

templates/sync.yaml

@@ -28,14 +28,9 @@ spec:
       annotations:
         checksum/schema: {{ .Files.Get "schema/table.json" | sha256sum }}
     spec:
-{{- if hasKey .Values "imagePullSecret" }}
 {{- if .Values.imagePullSecret }}
       imagePullSecrets:
         - name: {{ .Values.imagePullSecret | quote }}
-{{- end }}
-{{- else }}
-      imagePullSecrets:
-        - name: quay-pull-secret
 {{- end }}
       initContainers:
         - name: initialize-table