feat: render imagePullSecrets, nodeSelector and tolerations through tpl

[johnyrahul]

What

Renders imagePullSecrets, nodeSelector and tolerations on the PgDog Deployment through a new pgdog.tplvalues.render helper instead of plain toYaml. The same applies to prometheusCollector.nodeSelector / tolerations. Chart version bumped to v0.85.

Why

When this chart is a dependency of a parent chart, these fields can't follow the parent's global.* values. The templates read .Values.imagePullSecrets / nodeSelector / tolerations directly, and Helm values can't reference other values. Today the parent has to copy its pull secret and placement into pgdog: by hand, or bridge them with YAML anchors, which only work within a single values file. An install whose global pull secret or node pool differs then ends up with PgDog in ImagePullBackOff, or scheduled on nodes it shouldn't be on.

How

pgdog.tplvalues.render follows the Bitnami common.tplvalues.render pattern:

• a string is rendered as a template that produces the whole field, e.g. tolerations: '{{ toYaml .Values.global.tolerations }}';
• a map or list is converted with toYaml and then rendered, so individual leaves can be templated, e.g. nodeSelector: {pool: '{{ .Values.global.pool }}'}.

Values without {{ }} render exactly as before. Whole-field strings matter when the parent's value has a different shape: a list of key/value pairs becomes a nodeSelector map, and a pull-secret list may be empty. That can't be expressed by templating leaves alone.

As with any tpl-rendered value, don't put untrusted input in these fields.

Compatibility

Existing values render byte-identical. I rendered every test/values-*.yaml with v0.84 and with this branch; all match except values-tls-generate.yaml, whose generated certificate differs on every render anyway.

Tests

• New test/values-tpl-placement.yaml: whole-field templates for imagePullSecrets and tolerations, and a leaf template for nodeSelector, all pointing at global.*.
• New block in test/test.sh: asserts the rendered Deployment carries the templated values, and that the default values still produce no imagePullSecrets.

🤖 Generated with Claude Code