feat: チャートをゼロから再設計(外部DB前提のYOURLS+Nginx構成に作り直し)

旧チャートは存在しないDocker Hubイメージ(yourls/yourls)を参照し、Bitnami MySQL
サブチャートに依存するなど正しく動作しない状態だったため、YOURLS公式イメージ
(docker.io/yourls, container-entrypoint.sh/config-container.php)の実装を確認した上で
WordPressチャートと同一方針(外部DB、emptyDir+PVC分離、fsGroup非root実行、
real IP取得対応)でスクラッチから再構築した。

templates/_helpers.tpl

@@ -46,4 +46,32 @@ Selector labels
 {{- define "yourls-nginx.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "yourls-nginx.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
+{{- end }}
+
+{{/*
+Secret name used for chart-managed credentials.
+*/}}
+{{- define "yourls-nginx.secretName" -}}
+{{- printf "%s-secret" (include "yourls-nginx.fullname" .) }}
+{{- end }}
+
+{{/*
+Fetch a previously-generated value from the existing chart-managed Secret, if any.
+Used so that random values (cookiekey, auto-generated admin password) survive
+"helm upgrade" instead of rotating on every release, which would otherwise
+invalidate admin login cookies and previously-issued passwords.
+Usage: {{ include "yourls-nginx.existingSecretValue" (list . "cookiekey") }}
+Returns an empty string on first install (no Secret exists yet) or when
+running "helm template" without cluster access.
+*/}}
+{{- define "yourls-nginx.existingSecretValue" -}}
+{{- $ctx := index . 0 -}}
+{{- $key := index . 1 -}}
+{{- $secret := lookup "v1" "Secret" $ctx.Release.Namespace (include "yourls-nginx.secretName" $ctx) -}}
+{{- if $secret -}}
+{{- $value := index $secret.data $key -}}
+{{- if $value -}}
+{{- $value | b64dec -}}
+{{- end -}}
+{{- end -}}
+{{- end }}