feat(yeti): consolidate agents secret configuration under .Values.agents

charts/osdfir-infrastructure/Chart.lock

@@ -4,7 +4,7 @@ dependencies:
   version: 2.5.6
 - name: yeti
   repository: file://charts/yeti
-  version: 2.6.0
+  version: 2.7.0
 - name: openrelik
   repository: file://charts/openrelik
   version: 2.4.2
@@ -14,5 +14,5 @@ dependencies:
 - name: hashr
   repository: file://charts/hashr
   version: 2.0.1
-digest: sha256:8fecf0dc21ff91e7e31bb3aeb8dc674dfe1626910cec03718e4cafec56889e7b
-generated: "2026-08-31T14:24:01.276081487Z"
+digest: sha256:d2cef67f8b863c638a70ecca2c2944b2823aefa1dba8d8cb1d47ce4d3e5972b1
+generated: "2026-08-31T20:18:14.07591851Z"

charts/osdfir-infrastructure/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: osdfir-infrastructure
-version: 2.12.0
+version: 2.13.0
 description: A Helm chart for Open Source Digital Forensics Kubernetes deployments.
 keywords:
 - timesketch
@@ -18,7 +18,7 @@ dependencies:
 - condition: global.yeti.enabled
   name: yeti
   repository: file://charts/yeti
-  version: 2.6.0
+  version: 2.7.0
 - condition: global.openrelik.enabled
   name: openrelik
   repository: file://charts/openrelik

charts/osdfir-infrastructure/charts/yeti/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: yeti
-version: 2.6.0
+version: 2.7.0
 description: A Helm chart for Yeti Kubernetes deployments.
 keywords:
 - yeti

charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl

@@ -34,8 +34,8 @@ Emits a non-empty string when true, so callers test it with `if`.
 {{- if and (not .Values.agents.googleApiKeySecret) (ne .Values.agents.llmProvider "ollama") -}}
 {{- fail (printf "\n\nagents.enabled is true but agents.googleApiKeySecret is not set.\nThe Yeti Agents service reads GOOGLE_API_KEY at startup and cannot run without it.\n\nCreate the secret and pass its name:\n  kubectl create secret generic yeti-google-api-secret \\\n    --namespace %s --from-literal=google-api-key=$GOOGLE_API_KEY\n  helm upgrade ... --set agents.googleApiKeySecret=yeti-google-api-secret\n\nAlternatively set agents.llmProvider=ollama to use a local model, or\nagents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}}
 {{- end -}}
-{{- if not .Values.global.yeti.apiKeySecret -}}
-{{- fail (printf "\n\nagents.enabled is true but global.yeti.apiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n  kubectl create secret generic yeti-api-secret \\\n    --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n  helm upgrade ... --set global.yeti.apiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}}
+{{- if not .Values.agents.yetiApiKeySecret -}}
+{{- fail (printf "\n\nagents.enabled is true but agents.yetiApiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n  kubectl create secret generic yeti-api-secret \\\n    --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n  helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}}
 {{- end -}}
 true
 {{- end -}}

charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml

@@ -41,11 +41,11 @@ spec:
           {{- include "yeti.envs" . | nindent 12 }}
             - name: YETI_API_ROOT
               value: "http://{{ .Release.Name }}-yeti-api:8000"
-            {{- if .Values.global.yeti.apiKeySecret }}
+            {{- if .Values.agents.yetiApiKeySecret }}
             - name: YETI_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.global.yeti.apiKeySecret | quote }}
+                  name: {{ .Values.agents.yetiApiKeySecret | quote }}
                   key: "yeti-api"
             {{- end }}
             {{- if .Values.agents.googleApiKeySecret }}

charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml

@@ -24,7 +24,7 @@ spec:
       containers:
         - name: bloomcheck
           image: "{{ .Values.bloomcheck.image.repository }}:{{ .Values.bloomcheck.image.tag }}"
-          imagePullPolicy: {{ .Values.config.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.bloomcheck.image.pullPolicy | default .Values.config.imagePullPolicy }}
           command: ["/bin/sh", "-c"]
           args:
             - |

charts/osdfir-infrastructure/charts/yeti/values.yaml

@@ -163,6 +163,9 @@ bloomcheck:
     ## @param bloomcheck.image.tag Overrides the image tag whose default is the chart appVersion
     ##
     tag: dev
+    ## @param bloomcheck.image.pullPolicy
+    ##
+    pullPolicy: Always
   ## Yeti bloomcheck resource requests and limits
   ## ref: https://kubernetes.io/docs/user-guide/compute-resources/
   ## @param bloomcheck.resources.limits Resource limits for the bloomcheck container
@@ -185,9 +188,9 @@ bloomcheck:
 ##
 agents:
   ## @param agents.enabled Whether to enable Yeti Agents microservice
-  ## Enabling this requires agents.googleApiKeySecret (or llmProvider "ollama")
-  ## and global.yeti.apiKeySecret. The install fails with instructions if either
-  ## is missing, rather than deploying a service that cannot answer.
+  ## Enabling this requires a Google API key for Gemini (agents.googleApiKeySecret)
+  ## and Yeti API credentials (agents.yetiApiKeySecret or global.yeti.apiKeySecret).
+  ## The install fails with instructions if either is missing.
   ##
   enabled: false
   image:
@@ -199,15 +202,16 @@ agents:
     tag: dev
     ## @param agents.image.pullPolicy
     ##
-    pullPolicy: IfNotPresent
+    pullPolicy: Always
+  ## @param agents.yetiApiKeySecret Existing secret containing the Yeti API key (key: "yeti-api").
+  ## Defaults to global.yeti.apiKeySecret if set.
+  ## (e.g. kubectl create secret generic yeti-api-secret --from-literal=yeti-api=${YETI_API_KEY})
+  ##
+  yetiApiKeySecret: ""
   ## @param agents.googleApiKeySecret Existing secret containing the Google API key for Gemini.
   ## Required when agents.llmProvider is "gemini".
   ## (e.g. kubectl create secret generic yeti-google-api-secret --from-literal=google-api-key=${GOOGLE_API_KEY})
   ##
-  ## The agents workload is only deployed once it can actually run, which also
-  ## requires global.yeti.apiKeySecret: the agents reach Yeti over its API, and
-  ## without those credentials they start but every tool call fails.
-  ##
   googleApiKeySecret: ""
   ## @param agents.llmProvider LLM backend for the agents service ("gemini" or "ollama")
   ##