From 18288773c60e7693a9d29f82ae2867da29d63c32 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Sun, 18 Oct 2026 20:20:09 +0200
Subject: [PATCH] Default to public image pulls

---
 README.md           | 2 +-
 bootstrap.sh        | 5 +----
 templates/sync.yaml | 5 -----
 3 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index c7feff3..101fe74 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ Edit only `chart-version.txt` for a new base chart version. CI packages a unique
 
 The published chart is available via `helm repo add brunner https://brunner.ninja/charts && helm repo update brunner`. `install.sh` is kept for manual deployments. CI renders the same chart and patches the named existing resources, since Helm release storage would require CI to read Kubernetes Secrets. A later manual Helm upgrade reconciles Helm's stored release revision with the latest chart.
 
-For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Set `imagePullSecret: ""` for anonymous pulls of the public Quay image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
+For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Public images need no pull secret; set `imagePullSecret` only when using a private replacement image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
 
 ## Connect a Brave browser
 
diff --git a/bootstrap.sh b/bootstrap.sh
index 47f74de..2d198ea 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -7,7 +7,4 @@ project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
   exit 1
 }
 kubectl apply --filename "${project_dir}/namespace.yaml"
-kubectl --namespace default get secret quay-pull-secret --output=json \
-  | jq 'del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.managedFields, .metadata.annotations, .metadata.ownerReferences) | .metadata.namespace = "brave-sync"' \
-  | kubectl apply --filename - >/dev/null
-echo "brave-sync namespace and Quay pull secret are ready"
+echo "brave-sync namespace is ready"
diff --git a/templates/sync.yaml b/templates/sync.yaml
index 15d85c7..950f22b 100644
--- a/templates/sync.yaml
+++ b/templates/sync.yaml
@@ -28,14 +28,9 @@ spec:
       annotations:
         checksum/schema: {{ .Files.Get "schema/table.json" | sha256sum }}
     spec:
-{{- if hasKey .Values "imagePullSecret" }}
 {{- if .Values.imagePullSecret }}
       imagePullSecrets:
         - name: {{ .Values.imagePullSecret | quote }}
-{{- end }}
-{{- else }}
-      imagePullSecrets:
-        - name: quay-pull-secret
 {{- end }}
       initContainers:
         - name: initialize-table