limit core to a single replica

charts/defguard/Chart.yaml

@@ -4,7 +4,7 @@ description: Defguard is an open-source enterprise WireGuard VPN with MFA and SS
 icon: https://defguard.net/favicon/favicon-512x512.png
 
 type: application
-version: 2.1.1
+version: 2.1.2
 appVersion: 2.1.1
 
 dependencies:

charts/defguard/README.md

@@ -14,6 +14,9 @@ This Helm chart can be used to deploy the whole [Defguard](https://defguard.net/
 Check our [documentation](https://docs.defguard.net/deployment-strategies/kubernetes) for deployment
 instructions.
 
+Defguard Core runs as a single instance. Keep `replicaCount: 1` and
+`autoscaling.enabled: false`; the chart rejects values that would run multiple Core replicas.
+
 ## ⚠️ Important: Postgres image tags 
 
 Due to changes in Bitnami policy the Postgres subchart now uses the `latest` tag by default.

charts/defguard/templates/defguard-deployment.yaml

@@ -1,3 +1,9 @@
+{{- if ne (int .Values.replicaCount) 1 }}
+{{- fail "Defguard Core runs as a single instance; replicaCount must be 1." }}
+{{- end }}
+{{- if .Values.autoscaling.enabled }}
+{{- fail "Defguard Core runs as a single instance; autoscaling.enabled must be false." }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/defguard/values.yaml

@@ -4,7 +4,7 @@
 proxyUrl: ""
 # this should be a URL based on ingress.web.host
 publicUrl: "http://defguard.local"
-# defguard-core pod autoscaling configuration
+# Core runs as a single instance; autoscaling must remain disabled.
 autoscaling:
   enabled: false
   minReplicas: 1
@@ -56,7 +56,7 @@ podLabels: {}
 podSecurityContext: {}
 # defguard-core container security context
 securityContext: {}
-# defguard-core container replica count
+# Keep Core at one replica; other values are rejected.
 replicaCount: 1
 # defguard-core pod resource configuration
 resources: {}