OpenWA has been installed as release "{{ .Release.Name }}".

  WARNING: replicaCount must stay 1. A session lease stops two pods from launching the
  same session, but API keys and the audit log live in each pod's own main.sqlite, so a
  key revoked or narrowed on one pod stays valid on the others, and socket eviction, WS
  rate limits and bulk batches stay process-local. See docs/13-horizontal-scaling.md.

1. Wait for the pod:
     kubectl -n {{ .Release.Namespace }} rollout status statefulset/{{ include "openwa.fullname" . }}

2. Get the API key. The app seeds a key only into an empty key table, on the first boot on this
   volume or after the table was emptied: the value of secretEnv.API_MASTER_KEY if you had set one
   then (the app never prints it), or a generated one. Either way it is stored on the PVC (the file
   has no trailing newline, so copy only the key, not the prompt after it):
     kubectl -n {{ .Release.Namespace }} exec {{ include "openwa.fullname" . }}-0 -- cat {{ (.Values.env | default dict).BOOTSTRAP_KEY_FILE | default "/app/data/.api-key" }}

3. Reach the API + dashboard:
     kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "openwa.fullname" . }} 2785:{{ .Values.service.port }}
     then open http://localhost:2785 (dashboard) or call http://localhost:2785/api.
{{- if .Values.ingress.enabled }}
   Or via the ingress host: http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.ingress.host }}
{{- $env := .Values.env | default dict }}
{{- $csp := toString (get $env "CSP_UPGRADE_INSECURE_REQUESTS") }}
{{- /* An absent NODE_ENV leaves the image's NODE_ENV=production in effect; an empty one overrides it. */}}
{{- $nodeEnv := ternary (toString (get $env "NODE_ENV")) "production" (hasKey $env "NODE_ENV") }}
{{- $upgrade := or (eq $csp "true") (and (ne $csp "false") (eq $nodeEnv "production")) }}
{{- if and (not .Values.ingress.tls) $upgrade }}

   WARNING: this ingress has no TLS, but the app tells browsers to upgrade insecure requests, so
   over plain http the dashboard fetches its scripts over https and renders blank. Terminate TLS
   (ingress.tls, or in front of the ingress) or set env.CSP_UPGRADE_INSECURE_REQUESTS="false".
   See docs/12-troubleshooting-faq.md.
{{- end }}
{{- end }}