pelotech · emmanuel · Jul 16, 2026
diff --git a/charts/lrsql/Chart.lock b/charts/lrsql/Chart.lock
diff --git a/charts/lrsql/Chart.yaml b/charts/lrsql/Chart.yaml
@@ -21,10 +21,4 @@ version: 0.3.2
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.7.14"
-dependencies:
-  - name: common
-    repository: oci://registry-1.docker.io/bitnamicharts
-    tags:
-      - bitnami-common
-    version: 2.x
+appVersion: "v0.9.5"
diff --git a/charts/lrsql/README.md b/charts/lrsql/README.md
@@ -2,16 +2,10 @@
 
 ### version: 0.3.2<!-- x-release-please-version -->
 
-![AppVersion: v0.7.14](https://img.shields.io/badge/AppVersion-v0.7.14-informational?style=flat-square)
+![AppVersion: v0.9.5](https://img.shields.io/badge/AppVersion-v0.9.5-informational?style=flat-square)
 
 SQL LRS/lrsql helm chart
 
-## Requirements
-
-| Repository | Name | Version |
-|------------|------|---------|
-| oci://registry-1.docker.io/bitnamicharts | common | 2.x |
-
 ## Values
 
 | Key | Type | Default | Description |
@@ -55,12 +49,12 @@ SQL LRS/lrsql helm chart
 | gateway.listenerSet.https.secretName | string | `""` |  |
 | gateway.listenerSet.listeners | list | `[]` |  |
 | image.debug | bool | `false` |  |
-| image.digest | string | `""` |  |
+| image.digest | string | `"sha256:97f9dc4b081faf86ccb9b46b9f5c555539105b06c3b2935d890a0a66f8541ef9"` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.pullSecrets | list | `[]` |  |
 | image.registry | string | `"docker.io"` |  |
 | image.repository | string | `"yetanalytics/lrsql"` |  |
-| image.tag | string | `"v0.9.3@sha256:46995beb8265df5caeb0b5a8173499cf278c13bd36464e91bbace57ccf1a7512"` |  |
+| image.tag | string | `""` |  |
 | ingress.annotations | object | `{}` |  |
 | ingress.apiVersion | string | `""` |  |
 | ingress.enabled | bool | `false` |  |
@@ -72,7 +66,6 @@ SQL LRS/lrsql helm chart
 | ingress.ingressClassName | string | `""` |  |
 | ingress.path | string | `"/"` |  |
 | ingress.pathType | string | `"ImplementationSpecific"` |  |
-| ingress.secrets | list | `[]` |  |
 | ingress.tls | bool | `true` |  |
 | ingress.tlsWwwPrefix | bool | `false` |  |
 | livenessProbe.httpGet.path | string | `"/"` |  |

diff --git a/charts/lrsql/templates/_helpers.tpl b/charts/lrsql/templates/_helpers.tpl
@@ -7,10 +7,17 @@ Expand the name of the chart.
 
 {{/* vim: set filetype=mustache: */}}
 {{/*
-Return the proper lrsql image name
+Return the proper lrsql image name.
+Prefers image.digest; otherwise uses image.tag, defaulting to the chart appVersion.
 */}}
 {{- define "lrsql.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
+{{- $tag := .Values.image.tag | default .Chart.AppVersion -}}
+{{- $ref := ternary (printf "@%s" .Values.image.digest) (printf ":%s" $tag) (not (empty .Values.image.digest)) -}}
+{{- if .Values.image.registry -}}
+{{- printf "%s/%s%s" .Values.image.registry .Values.image.repository $ref -}}
+{{- else -}}
+{{- printf "%s%s" .Values.image.repository $ref -}}
+{{- end -}}
 {{- end -}}
 
 {{/*

diff --git a/charts/lrsql/templates/deployment.yaml b/charts/lrsql/templates/deployment.yaml
@@ -37,11 +37,11 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ include "lrsql.image" . }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if .Values.command }}
-          command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
+          {{- with .Values.command }}
+          command: {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if .Values.args }}
-          args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
+          {{- with .Values.args }}
+          args: {{- toYaml . | nindent 12 }}
           {{- end }}
           env:
             {{- if .Values.containerPorts.http }}
@@ -52,18 +52,20 @@ spec:
             - name: LRSQL_SSL_PORT
               value: {{ .Values.containerPorts.https | quote }}
             {{- end }}
-            {{- if .Values.extraEnvVars }}
-            {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
+            {{- with .Values.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
+          {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
           envFrom:
             {{- if .Values.extraEnvVarsCM }}
             - configMapRef:
-                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
+                name: {{ .Values.extraEnvVarsCM }}
             {{- end }}
             {{- if .Values.extraEnvVarsSecret }}
             - secretRef:
-                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
+                name: {{ .Values.extraEnvVarsSecret }}
             {{- end }}
+          {{- end }}
           ports:
             {{- if .Values.containerPorts.http }}
             - name: http

diff --git a/charts/lrsql/templates/httproute.yaml b/charts/lrsql/templates/httproute.yaml
@@ -5,20 +5,24 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: {{ include "common.names.fullname" . }}
-  namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  name: {{ include "lrsql.fullname" . }}
+  labels:
+    {{- include "lrsql.labels" . | nindent 4 }}
   {{- if or .Values.gateway.httpRoute.annotations .Values.commonAnnotations }}
-  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.gateway.httpRoute.annotations .Values.commonAnnotations ) "context" . ) }}
-  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.gateway.httpRoute.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 spec:
   parentRefs:
     {{- if .Values.gateway.listenerSet.enabled }}
     - group: gateway.networking.k8s.io
       kind: ListenerSet
-      name: {{ include "common.names.fullname" . }}
-      namespace: {{ include "common.names.namespace" . | quote }}
+      name: {{ include "lrsql.fullname" . }}
     {{- else }}
     - group: gateway.networking.k8s.io
       kind: Gateway
@@ -51,7 +55,7 @@ spec:
             type: {{ .Values.gateway.httpRoute.pathType }}
             value: {{ .Values.gateway.httpRoute.path }}
       backendRefs:
-        - name: {{ include "common.names.fullname" . }}
+        - name: {{ include "lrsql.fullname" . }}
           port: {{ .Values.service.ports.http }}
     {{- end }}
 {{- end }}
diff --git a/charts/lrsql/templates/ingress.yaml b/charts/lrsql/templates/ingress.yaml
@@ -1,68 +1,67 @@
 {{- if .Values.ingress.enabled }}
-apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
+{{- $svcPort := ternary "http" "https" (not .Values.containerPorts.https) }}
+apiVersion: {{ .Values.ingress.apiVersion | default "networking.k8s.io/v1" }}
 kind: Ingress
 metadata:
-  name: {{ include "common.names.fullname" . }}
-  namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  name: {{ include "lrsql.fullname" . }}
+  labels:
+    {{- include "lrsql.labels" . | nindent 4 }}
   {{- if or .Values.ingress.annotations .Values.commonAnnotations }}
-  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
-  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 spec:
-  {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  {{- with .Values.ingress.ingressClassName }}
+  ingressClassName: {{ . | quote }}
   {{- end }}
   rules:
     {{- if .Values.ingress.hostname }}
-    - host: "{{ .Values.ingress.hostname }}"
+    - host: {{ .Values.ingress.hostname | quote }}
       http:
         paths:
-          {{- if .Values.ingress.extraPaths }}
-          {{- toYaml .Values.ingress.extraPaths | nindent 10 }}
-          {{- end }}
-          - path: {{ .Values.ingress.path }}
-            {{- if eq "true" (include "common.ingress.supportsPathType" .) }}
-            pathType: {{ .Values.ingress.pathType }}
-            {{- end }}
-            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" (ternary "http" "https" (not $.Values.containerPorts.https)) "context" $)  | nindent 14 }}
-    {{- else if .Values.ingress.path }}
-    - http:
-        paths:
-          {{- if .Values.ingress.extraPaths }}
-          {{- toYaml .Values.ingress.extraPaths | nindent 10 }}
+          {{- with .Values.ingress.extraPaths }}
+          {{- toYaml . | nindent 10 }}
           {{- end }}
           - path: {{ .Values.ingress.path }}
-            {{- if eq "true" (include "common.ingress.supportsPathType" .) }}
             pathType: {{ .Values.ingress.pathType }}
-            {{- end }}
-            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" (ternary "http" "https" (not .Values.containerPorts.https)) "context" $)  | nindent 14 }}
+            backend:
+              service:
+                name: {{ include "lrsql.fullname" . }}
+                port:
+                  name: {{ $svcPort }}
     {{- end }}
     {{- range .Values.ingress.extraHosts }}
     - host: {{ .name | quote }}
       http:
         paths:
           - path: {{ default "/" .path }}
-            {{- if eq "true" (include "common.ingress.supportsPathType" $) }}
             pathType: {{ default "ImplementationSpecific" .pathType }}
-            {{- end }}
-            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" (ternary "http" "https" (not $.Values.containerPorts.https)) "context" $) | nindent 14 }}
+            backend:
+              service:
+                name: {{ include "lrsql.fullname" $ }}
+                port:
+                  name: {{ $svcPort }}
     {{- end }}
-    {{- if .Values.ingress.extraRules }}
-    {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
+    {{- with .Values.ingress.extraRules }}
+    {{- tpl (toYaml .) $ | nindent 4 }}
     {{- end }}
-  {{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) (not (empty .Values.ingress.secrets)))) .Values.ingress.extraTls }}
+  {{- if or (and .Values.ingress.tls .Values.ingress.hostname) .Values.ingress.extraTls }}
   tls:
-    {{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) (not (empty .Values.ingress.secrets))) }}
+    {{- if and .Values.ingress.tls .Values.ingress.hostname }}
     - hosts:
         - {{ .Values.ingress.hostname | quote }}
-        {{- if or (.Values.ingress.tlsWwwPrefix) (eq (index .Values.ingress.annotations "nginx.ingress.kubernetes.io/from-to-www-redirect") "true" ) }}
-        - {{ printf "www.%s" (tpl .Values.ingress.hostname $) | quote }}
+        {{- if or .Values.ingress.tlsWwwPrefix (eq (index .Values.ingress.annotations "nginx.ingress.kubernetes.io/from-to-www-redirect") "true") }}
+        - {{ printf "www.%s" .Values.ingress.hostname | quote }}
         {{- end }}
       secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
     {{- end }}
-    {{- if .Values.ingress.extraTls }}
-    {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
+    {{- with .Values.ingress.extraTls }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/charts/lrsql/templates/listenerset.yaml b/charts/lrsql/templates/listenerset.yaml
@@ -2,12 +2,17 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: ListenerSet
 metadata:
-  name: {{ include "common.names.fullname" . }}
-  namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  name: {{ include "lrsql.fullname" . }}
+  labels:
+    {{- include "lrsql.labels" . | nindent 4 }}
   {{- if or .Values.gateway.listenerSet.annotations .Values.commonAnnotations }}
-  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.gateway.listenerSet.annotations .Values.commonAnnotations ) "context" . ) }}
-  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.gateway.listenerSet.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 spec:
   parentRef:

diff --git a/charts/lrsql/values.yaml b/charts/lrsql/values.yaml
@@ -7,8 +7,12 @@ replicaCount: 1
 image:
   registry: docker.io
   repository: yetanalytics/lrsql
-  tag: v0.9.3@sha256:46995beb8265df5caeb0b5a8173499cf278c13bd36464e91bbace57ccf1a7512
-  digest: ""
+  ## @param image.tag Image tag. Defaults to the chart appVersion when empty.
+  ##
+  tag: ""
+  ## @param image.digest Image digest (sha256:...). When set, pins the pull and takes precedence over the tag.
+  ##
+  digest: "sha256:97f9dc4b081faf86ccb9b46b9f5c555539105b06c3b2935d890a0a66f8541ef9"
   pullPolicy: IfNotPresent
   pullSecrets: []
   debug: false
@@ -173,8 +177,7 @@ ingress:
   ##
   ingressClassName: ""
   ## @param ingress.tls Enable TLS on the Ingress
-  ## TLS certificates will be retrieved from a TLS secret with name: {{- printf "%s-tls" .Values.ingress.hostname }}
-  ## You can use the ingress.secrets parameter to create this TLS secret or rely on cert-manager to create it
+  ## TLS certificates are read from a secret named "<hostname>-tls". Create it yourself or let cert-manager provision it.
   ##
   tls: true
   ## @param ingress.tlsWwwPrefix Adds www subdomain to default cert
@@ -205,21 +208,6 @@ ingress:
   ##   secretName: nginx.local-tls
   ##
   extraTls: []
-  ## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets
-  ## key and certificate should start with -----BEGIN CERTIFICATE----- or
-  ## -----BEGIN RSA PRIVATE KEY-----
-  ##
-  ## name should line up with a tlsSecret set further up
-  ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set
-  ##
-  ## It is also possible to create and manage the certificates outside of this helm chart
-  ## Please see README.md for more information
-  ## e.g:
-  ## - name: nginx.local-tls
-  ##   key:
-  ##   certificate:
-  ##
-  secrets: []
   ## @param ingress.extraRules The list of additional rules to be added to this ingress record. Evaluated as a template
   ## Useful when looking for additional customization, such as using different backend
   ##