Clean up Helm chart for Python backend

- Remove configmap.yaml (Python uses env vars, not YAML config)
- Remove migration-job.yaml (SQLAlchemy creates tables on startup)
- Rename migrations.enabled to waitForDatabase
- Set readOnlyRootFilesystem: false (Python needs __pycache__)

helm/orchard/templates/configmap.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "orchard.fullname" . }}-config
-  labels:
-    {{- include "orchard.labels" . | nindent 4 }}
-data:
-  config.yaml: |
-    server:
-      host: {{ .Values.orchard.server.host | quote }}
-      port: {{ .Values.orchard.server.port }}
-    database:
-      host: {{ include "orchard.postgresql.host" . | quote }}
-      port: {{ .Values.orchard.database.port }}
-      user: {{ .Values.orchard.database.user | default .Values.postgresql.auth.username | quote }}
-      dbname: {{ .Values.orchard.database.dbname | default .Values.postgresql.auth.database | quote }}
-      sslmode: {{ .Values.orchard.database.sslmode | quote }}
-    s3:
-      endpoint: {{ include "orchard.minio.host" . | quote }}
-      region: {{ .Values.orchard.s3.region | quote }}
-      bucket: {{ .Values.orchard.s3.bucket | quote }}
-      use_path_style: {{ .Values.orchard.s3.usePathStyle }}

helm/orchard/templates/deployment.yaml

@@ -14,7 +14,6 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
         checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
       {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
@@ -33,7 +32,7 @@ spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       initContainers:
-        {{- if .Values.migrations.enabled }}
+        {{- if .Values.waitForDatabase }}
         - name: wait-for-db
           image: "{{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}"
           imagePullPolicy: {{ .Values.initContainer.image.pullPolicy }}

helm/orchard/templates/migration-job.yaml

@@ -1,52 +0,0 @@
-{{- if .Values.migrations.enabled }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ include "orchard.fullname" . }}-migrations
-  labels:
-    {{- include "orchard.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-spec:
-  template:
-    metadata:
-      labels:
-        {{- include "orchard.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      restartPolicy: Never
-      initContainers:
-        - name: wait-for-db
-          image: "{{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}"
-          imagePullPolicy: {{ .Values.initContainer.image.pullPolicy }}
-          command: ['sh', '-c', 'until nc -z {{ include "orchard.postgresql.host" . }} 5432; do echo waiting for database; sleep 2; done;']
-      containers:
-        - name: migrations
-          image: "{{ .Values.migrations.image.repository }}:{{ .Values.migrations.image.tag | default .Chart.AppVersion }}"
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              # The orchard-server automatically runs migrations on startup
-              # This job just verifies connectivity
-              echo "Database is ready at {{ include "orchard.postgresql.host" . }}:5432"
-          env:
-            - name: ORCHARD_DATABASE_HOST
-              value: {{ include "orchard.postgresql.host" . | quote }}
-            - name: ORCHARD_DATABASE_PORT
-              value: {{ .Values.orchard.database.port | quote }}
-            - name: ORCHARD_DATABASE_USER
-              value: {{ .Values.orchard.database.user | default .Values.postgresql.auth.username | quote }}
-            - name: ORCHARD_DATABASE_DBNAME
-              value: {{ .Values.orchard.database.dbname | default .Values.postgresql.auth.database | quote }}
-            - name: ORCHARD_DATABASE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "orchard.postgresql.secretName" . }}
-                  key: {{ include "orchard.postgresql.passwordKey" . }}
-  backoffLimit: 3
-{{- end }}

helm/orchard/values.yaml

@@ -28,7 +28,7 @@ podLabels: {}
 podSecurityContext: {}
 
 securityContext:
-  readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: false  # Python needs to write __pycache__
   runAsNonRoot: true
   runAsUser: 1000
 
@@ -165,12 +165,8 @@ redis:
       enabled: true
       size: 1Gi
 
-# Database migrations
+# Wait for database before starting (SQLAlchemy creates tables on startup)
-migrations:
+waitForDatabase: true
-  enabled: false
-  image:
-    repository: orchard-server
-    tag: ""
 
 global:
   security: