From 90831a55047005c775db1b641c42a6137d9af679 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sun, 19 Jul 2026 04:34:40 -0400
Subject: [PATCH] fix: guard k3s issuer template against absent values

The `issuer.yaml` chart template dereferenced `.Values.global.issuer.enabled` without guarding against the value being absent, which yaml serialization omitted for apps without a per-app email, causing a nil-pointer render error that broke every k3s web deploy.
---
 .../certificate_template_test.go              | 19 +++++++++++++++++++
 plugins/scheduler-k3s/template.go             |  2 +-
 .../scheduler-k3s/templates/chart/issuer.yaml |  2 +-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/plugins/scheduler-k3s/certificate_template_test.go b/plugins/scheduler-k3s/certificate_template_test.go
index 04a06badb..08d49d7e2 100644
--- a/plugins/scheduler-k3s/certificate_template_test.go
+++ b/plugins/scheduler-k3s/certificate_template_test.go
@@ -145,6 +145,25 @@ func TestCertificateTemplateUsesSharedClusterIssuerByDefault(t *testing.T) {
 	}
 }
 
+func TestCertificateTemplateRendersWithoutIssuerValues(t *testing.T) {
+	// Reproduces the deploy failure where global.issuer is absent from values.yaml
+	// (the common case, no per-app email). The chart must still render without a
+	// nil-pointer error, use the shared ClusterIssuer, and emit no Issuer document.
+	docs := renderCertificateChart(t, testCertificateValues("ClusterIssuer", "letsencrypt-prod", nil))
+
+	issuerRef := certificateIssuerRef(t, docs)
+	if issuerRef["kind"] != "ClusterIssuer" {
+		t.Fatalf("expected issuerRef.kind ClusterIssuer, got %#v", issuerRef["kind"])
+	}
+	if issuerRef["name"] != "letsencrypt-prod" {
+		t.Fatalf("expected issuerRef.name letsencrypt-prod, got %#v", issuerRef["name"])
+	}
+
+	if len(docs["issuer"]) != 0 {
+		t.Fatalf("expected no Issuer document when global.issuer is absent, got %#v", docs["issuer"])
+	}
+}
+
 func TestCertificateTemplateDefaultsKindWhenIssuerKindEmpty(t *testing.T) {
 	docs := renderCertificateChart(t, testCertificateValues("", "letsencrypt-prod", map[string]interface{}{"enabled": false}))
 
diff --git a/plugins/scheduler-k3s/template.go b/plugins/scheduler-k3s/template.go
index 56fe37c54..c5fbc8194 100644
--- a/plugins/scheduler-k3s/template.go
+++ b/plugins/scheduler-k3s/template.go
@@ -46,7 +46,7 @@ type GlobalValues struct {
 	AppName         string             `yaml:"app_name"`
 	DeploymentID    string             `yaml:"deployment_id"`
 	Image           GlobalImage        `yaml:"image"`
-	Issuer          AppIssuer          `yaml:"issuer,omitempty"`
+	Issuer          AppIssuer          `yaml:"issuer"`
 	Labels          ProcessLabels      `yaml:"labels,omitempty"`
 	Keda            GlobalKedaValues   `yaml:"keda"`
 	Namespace       string             `yaml:"namespace"`
diff --git a/plugins/scheduler-k3s/templates/chart/issuer.yaml b/plugins/scheduler-k3s/templates/chart/issuer.yaml
index 708e497dd..5ca1cabac 100644
--- a/plugins/scheduler-k3s/templates/chart/issuer.yaml
+++ b/plugins/scheduler-k3s/templates/chart/issuer.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.global.issuer.enabled }}
+{{- if and .Values.global.issuer .Values.global.issuer.enabled }}
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer