busbar 0.1.1 — fixes found by live-cluster testing

Deployed the chart to a kind cluster (default + governance); three real
bugs surfaced that lint/template could not catch:

- subPath-mount config.yaml/providers.yaml instead of the whole /etc/busbar
  dir, which was shadowing the image's built-in provider catalog (crash loop).
- Wire governance.admin_token from governance.adminTokenEnv (default
  BUSBAR_ADMIN_TOKEN); busbar refuses to boot with governance on and no token.
  Add a render-time guard that fails helm install fast when it's missing.
- Give the governance StatefulSet its own headless Service; keep busbar-data a
  normal cluster-VIP Service (fixes clusterIP-immutability on mode switch and
  preserves the traffic-plane VIP).

Verified on kind: default Deployment READY + helm test pass; governance
StatefulSet READY, PVC bound, data Service VIP + headless Service present.

Author: MattJackson

charts/busbar/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.1.1
+
+Fixes found by deploying the chart to a live (kind) cluster — none were catchable by
+`helm lint`/`helm template`:
+
+- **Config mount no longer shadows the image's provider catalog.** The ConfigMap was
+  mounted over the whole `/etc/busbar` directory, hiding the built-in
+  `/etc/busbar/providers.yaml` and crash-looping the pod. Now `config.yaml` (and
+  `providers.yaml` only when `providersCatalog` is set) mount as individual files via
+  `subPath`.
+- **Governance now wires an admin token.** busbar refuses to boot with governance
+  enabled but no `admin_token`. The chart renders `governance.admin_token: ${<env>}`
+  from the new `governance.adminTokenEnv` (default `BUSBAR_ADMIN_TOKEN`), and a
+  render-time guard fails `helm install` fast if the token isn't provided.
+- **Governance keeps a normal data Service.** The data (traffic) Service is no longer
+  made headless for the StatefulSet — a separate headless Service provides stable pod
+  identity. This keeps the traffic-plane cluster VIP and lets a release switch
+  governance on/off without hitting Service `clusterIP` immutability.
+
 ## 0.1.0
 
 Initial release of the busbar Helm chart.

charts/busbar/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: busbar
 description: A production-grade Helm chart for busbar, a Rust LLM gateway with a data plane and a separate, loopback-by-default, mTLS-gated admin plane.
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "1.4.0"
 kubeVersion: ">=1.24.0-0"
 home: https://getbusbar.com

charts/busbar/README.md

@@ -79,6 +79,10 @@ config:
 
 ### With governance
 
+Governance requires an admin token — put it in `secrets.data` under the key named by
+`governance.adminTokenEnv` (default `BUSBAR_ADMIN_TOKEN`); the chart wires
+`governance.admin_token` for you. (`helm install` fails fast if it is missing.)
+
 ```yaml
 governance:
   enabled: true
@@ -89,9 +93,6 @@ governance:
 secrets:
   data:
     BUSBAR_ADMIN_TOKEN: super-secret-admin-token
-config:
-  governance:
-    admin_token: ${BUSBAR_ADMIN_TOKEN}
 ```
 
 ### With ingress (data plane)

charts/busbar/templates/_helpers.tpl

@@ -92,3 +92,20 @@ clear message so the user never ships an un-bootable deployment.
 {{- end -}}
 {{- end -}}
 {{- end }}
+
+{{/*
+Governance boot-guard: busbar refuses to boot with governance enabled but no
+admin_token. The chart renders `admin_token: ${<adminTokenEnv>}`, so that env
+var must be supplied. When the chart renders the Secret (secrets.create) we can
+check it here and fail fast; with an existingSecret we can't introspect, so we
+trust the operator.
+*/}}
+{{- define "busbar.validateGovernance" -}}
+{{- if .Values.governance.enabled -}}
+{{- if not .Values.secrets.existingSecret -}}
+{{- if not (hasKey (default dict .Values.secrets.data) .Values.governance.adminTokenEnv) -}}
+{{ fail (printf "\n\ngovernance.enabled=true requires an admin token, but secrets.data has no %q key — busbar refuses to boot without governance.admin_token.\n\nFix: add the token to the Secret, e.g.\n  --set secrets.data.%s=<a-long-random-token>\nor set governance.adminTokenEnv to a key you already provide (or use an existingSecret that contains it).\n" .Values.governance.adminTokenEnv .Values.governance.adminTokenEnv) }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end }}

charts/busbar/templates/_pod.tpl

@@ -80,9 +80,19 @@ spec:
       resources:
         {{- toYaml .Values.resources | nindent 8 }}
       volumeMounts:
+        # Mount config.yaml (and providers.yaml only when overridden) as individual
+        # files via subPath, NOT the whole /etc/busbar dir — a directory mount would
+        # shadow the provider catalog baked into the image at /etc/busbar/providers.yaml.
         - name: config
-          mountPath: /etc/busbar
+          mountPath: /etc/busbar/config.yaml
+          subPath: config.yaml
           readOnly: true
+        {{- if .Values.providersCatalog }}
+        - name: config
+          mountPath: /etc/busbar/providers.yaml
+          subPath: providers.yaml
+          readOnly: true
+        {{- end }}
         - name: tmp
           mountPath: /tmp
         {{- if .Values.adminTLS.enabled }}

charts/busbar/templates/configmap.yaml

@@ -1,4 +1,5 @@
 {{- include "busbar.validateAdmin" . -}}
+{{- include "busbar.validateGovernance" . -}}
 {{- if not .Values.existingConfigMap -}}
 apiVersion: v1
 kind: ConfigMap
@@ -31,6 +32,7 @@ data:
     governance:
       enabled: true
       db_path: {{ .Values.governance.dbPath | quote }}
+      admin_token: ${{ printf "{%s}" .Values.governance.adminTokenEnv }}
     {{- end }}
     {{- with .Values.config }}
     {{- toYaml . | nindent 4 }}

charts/busbar/templates/service-data.yaml

@@ -10,9 +10,6 @@ metadata:
   {{- end }}
 spec:
   type: {{ .Values.service.data.type }}
-  {{- if .Values.governance.enabled }}
-  clusterIP: None
-  {{- end }}
   selector:
     {{- include "busbar.selectorLabels" . | nindent 4 }}
   ports:

charts/busbar/templates/service-headless.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.governance.enabled }}
+{{- /*
+  A headless Service that gives the governance StatefulSet stable per-pod network
+  identity (its `serviceName`). The public data Service stays a normal Service with
+  a cluster VIP for LLM traffic — the two are kept separate so switching governance
+  on/off never mutates the (immutable) clusterIP of the traffic Service.
+*/}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "busbar.fullname" . }}-headless
+  labels:
+    {{- include "busbar.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    {{- include "busbar.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: data
+      port: {{ .Values.service.data.port }}
+      targetPort: data
+      protocol: TCP
+{{- end }}

charts/busbar/templates/statefulset.yaml

@@ -9,7 +9,7 @@ spec:
   # Governance owns a single-writer SQLite DB per replica; horizontal scale of a
   # shared store is unsupported. replicas is pinned to 1.
   replicas: 1
-  serviceName: {{ include "busbar.fullname" . }}-data
+  serviceName: {{ include "busbar.fullname" . }}-headless
   selector:
     matchLabels:
       {{- include "busbar.selectorLabels" . | nindent 6 }}

charts/busbar/values.schema.json

@@ -54,6 +54,7 @@
       "additionalProperties": false,
       "properties": {
         "enabled": { "type": "boolean" },
+        "adminTokenEnv": { "type": "string", "minLength": 1 },
         "dbPath": { "type": "string", "minLength": 1 },
         "persistence": {
           "type": "object",