docs: GitOps and own-Secrets examples for 2.0.0's defaults

[levivannoort]

What

Checking the docs against 2.0.0's S3 changes found one real breakage and some imprecise naming.

The generate: false examples no longer rendered. Both the GitOps example (docs/gitops.md, the warning block and the Argo CD Application) and the own-Secrets example (docs/security.md) failed with No value for executor-secret: provide it explicitly or through an existing Secret (appwrite.secrets.generate is false). The built-in object storage's keys would have failed next. Since 2.0.0, Functions and Sites and the built-in store are on by default, and with generation off their credentials have to come from Secrets too.

• Both examples now set storage.s3.accessKeyId and secretAccessKey, which the built-in store needs as well, plus compute.secrets.existingSecret and compute.executor.existingSecret.
• The text explains the executor's copy of its Secret, and how to leave Functions and Sites out instead (compute.enabled: false, no compute block).
• The Application example keeps a single storage block.
• The credentials table's "Needed when" column says these are needed by default.

S3 key names:

• storage.md's provider table and AWS note say storage.s3.external.endpoint and external.region, not bare endpoint and region.
• The S3 troubleshooting entry names the external keys, links to Your own S3 store, and adds what to check with the built-in store.

Everything else checked out: no storage.s3.endpoint or .region is left at the old level. Every endpoint: in the docs, examples and CI values sits under external:, except the deliberate "Before" snippet in the upgrade notes.

Sysbox needs privileged: false. compute.executor.privileged defaults to true since 2.0.0, so setting only runtimeClassName: sysbox-runc still renders a privileged container (checked with helm template). security.md, the troubleshooting FAQ and the values.yaml comments now say to set privileged: false with the runtime class, as executor.md already did. hansi-codes found this on the announcement PR (appwrite/appwrite#14402).

skip-changelog: docs and values comments only.

Testing

• Rendered against the chart: the GitOps warning example, its no-compute variant, the Argo CD Application's valuesObject, and the security.md example. All four render now; the first, third and fourth failed before.
• make test passes.

[hansi-codes]

🔵 Tier A · Mergeable after minor fixes

The two previously reported documentation findings remain open in docs/gitops.md.

Updates the GitOps and own-Secrets examples for the chart’s default compute and built-in S3 configuration, and corrects the external S3 value paths and troubleshooting guidance. It also documents the Sysbox configuration for running the executor without a privileged container.

Latest changes: The latest commits clarify that Sysbox requires privileged: false together with runtimeClassName, and update the values descriptions and generated chart documentation accordingly.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	2

Fix with agent prompt

### Issue 1
docs/gitops.md:40-49
**The documented Secret creation command omits these required keys**

The `kubectl create secret` example below creates `appwrite-credentials` without `s3-access-key`, `s3-secret-key`, `executor-secret` or `orchestrator-secret`, but this values example now points S3 and compute credentials at that Secret. Following the documented setup therefore leaves required keys absent; please add them to the creation instructions or mark that command as partial.

### Issue 2
docs/gitops.md:56-57
**The no-compute instructions contradict each other**

This says to set `compute.enabled: false` and leave out the entire `compute` block, but the setting itself must be in that block (and compute is enabled by default). A user omitting the block will still render Functions and Sites; clarify that they need a minimal `compute: { enabled: false }` setting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 7

File	Change
charts/appwrite/README.md	Refreshes the generated executor privilege and RuntimeClass descriptions.
charts/appwrite/values.schema.json	Refreshes the generated schema descriptions for executor privilege and RuntimeClass.
charts/appwrite/values.yaml	Clarifies the Sysbox configuration in the executor value descriptions.
docs/gitops.md	Updates GitOps examples for generated-disabled credentials and default compute and S3.
docs/security.md	Expands the own-Secrets example and clarifies executor privilege and Sysbox options.
docs/storage.md	Uses the external S3 endpoint and region paths in the provider guidance.
docs/troubleshooting.md	Adds the required unprivileged setting to the Sysbox troubleshooting instructions and clarifies S3 checks.

⏳ Still open from earlier reviews · 2

• 🟡 The documented Secret creation command omits these required keys · docs/gitops.md:40
• 🟡 The no-compute instructions contradict each other · docs/gitops.md:56

---

_{Reviewed the commits since b812990 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary

[hansi-codes]

The documented Secret creation command omits these required keys

The kubectl create secret example below creates appwrite-credentials without s3-access-key, s3-secret-key, executor-secret or orchestrator-secret, but this values example now points S3 and compute credentials at that Secret. Following the documented setup therefore leaves required keys absent; please add them to the creation instructions or mark that command as partial.

Prompt To Fix With AI

This is a comment left during a code review.
Path: docs/gitops.md
Line: 40-49

Comment:
**The documented Secret creation command omits these required keys**

The `kubectl create secret` example below creates `appwrite-credentials` without `s3-access-key`, `s3-secret-key`, `executor-secret` or `orchestrator-secret`, but this values example now points S3 and compute credentials at that Secret. Following the documented setup therefore leaves required keys absent; please add them to the creation instructions or mark that command as partial.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟡 Minor · documentation · Reply if this doesn't apply.}

[hansi-codes]

The no-compute instructions contradict each other

This says to set compute.enabled: false and leave out the entire compute block, but the setting itself must be in that block (and compute is enabled by default). A user omitting the block will still render Functions and Sites; clarify that they need a minimal compute: { enabled: false } setting.

Prompt To Fix With AI

This is a comment left during a code review.
Path: docs/gitops.md
Line: 56-57

Comment:
**The no-compute instructions contradict each other**

This says to set `compute.enabled: false` and leave out the entire `compute` block, but the setting itself must be in that block (and compute is enabled by default). A user omitting the block will still render Functions and Sites; clarify that they need a minimal `compute: { enabled: false }` setting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟡 Minor · documentation · Reply if this doesn't apply.}