fix: correct imagePullSecrets schema to use LocalObjectReference format

[williamtrelawny]

Summary

• imagePullSecrets was defined in the schema as an array of strings, but Kubernetes requires []LocalObjectReference (objects with a name field)
• This mismatch caused schema validation errors when using the correct K8s format, forcing users to pass --skip-schema-validation
• Fixes global.imagePullSecrets, graylog.image.imagePullSecrets, and datanode.image.imagePullSecrets

Closes #84

Usage after fix

# values.yaml
global:
  imagePullSecrets:
    - name: my-pull-secret

# --set flag
--set global.imagePullSecrets[0].name=my-pull-secret

Reviewer validation steps

1. Confirm correct format passes schema validation:

helm lint charts/graylog --set-json 'global.imagePullSecrets=[{"name":"my-pull-secret"}]'
# Expected: no schema validation errors

2. Confirm plain string format is now rejected:

helm lint charts/graylog --set-json 'global.imagePullSecrets=["my-pull-secret"]'
# Expected: schema validation error

3. Confirm the pod spec renders correctly:

helm template charts/graylog --set-json 'global.imagePullSecrets=[{"name":"my-pull-secret"}]' \
  | grep -A5 'imagePullSecrets'
# Expected output in both StatefulSets:
#   imagePullSecrets:
#     - name: my-pull-secret

4. Confirm per-component override also works:

helm template charts/graylog \
  --set-json 'graylog.image.imagePullSecrets=[{"name":"graylog-secret"}]' \
  --set-json 'datanode.image.imagePullSecrets=[{"name":"datanode-secret"}]' \
  | grep -A5 'imagePullSecrets'
# Expected: each StatefulSet uses its own secret

Test plan

• Helm schema validation passes with imagePullSecrets: [{name: my-pull-secret}]
• Helm schema validation rejects imagePullSecrets: [my-pull-secret] (plain string)
• Pod spec renders correctly with imagePullSecrets set for both graylog and datanode statefulsets

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes Helm values schema validation for imagePullSecrets by aligning the schema with Kubernetes’ required []LocalObjectReference format (objects containing a name field), preventing users from needing --skip-schema-validation.

Changes:

• Update global.imagePullSecrets schema items from string to { name: string } with name required.
• Update graylog.image.imagePullSecrets schema to require [{ name: ... }] items (instead of an untyped array).
• Update datanode.image.imagePullSecrets schema to require [{ name: ... }] items (instead of an untyped array).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[monrax]

We could also allow for both.

Currently, this takes {"name": ... } objects, leeping a 1:1 correspondence with the imagePullSecrets in the renderedPodSpec:

{{- with .Values.graylog.image.imagePullSecrets | default .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- toYaml . | nindent 8 }}
{{- end }}

We could also allow string values:

{{- range (.Values.graylog.image.imagePullSecrets | default .Values.global.imagePullSecrets) }}
imagePullSecrets:
  - name: {{ . }}
{{- end }}

But we would need a helper to merge both kinds depending on the passed type. More complexity that can be added in a follow-up. This works for now.

LGTM 🚀 (thank you for your patience @williamtrelawny!)