minecraft-router: strict values.schema.json and null-safe hardening
No ingress gate: this chart has no Ingress at all (clients reach it via a NodePort), and ingress.domain appears neither in its templates nor in its values. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the entries of the mappings list, where domain and internalUrl are required. 2. Null-safety for hardening, probes and resources (#99). Two things a rebuilt default probe must not lose, both verified: - the API port is addressed by NAME ("api-port"), so the probe keeps working when server.apiPort is overridden. - mc-router still has no /health endpoint in 1.46.4, so GET /routes is the health signal, and the "Accept: application/json" header belongs to that request. The pod context keeps pinning uid/gid 10000 even though the image declares USER 65532 since 1.46.0, so the runtime identity does not silently change with the base image. mappings stays deliberately not null-safe: the chart fails loudly on a missing or empty routing table, which is the loud class #99 excludes - a router without routes is not operable and has no sensible default. Rendering with normal values is byte-identical to 2.0.0.
This commit is contained in:
4 files changed
+363
-7
No files matched your search
@@ -114,3 +114,170 @@ template-chart is the reference implementation.
|
||||
1
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Merge a user-supplied values sub-tree onto a dict of chart defaults so that a
|
||||
null / empty override falls back to the defaults instead of erasing them.
|
||||
|
||||
Input: dict "defaults" <dict> "given" <dict|nil> "path" <string, optional
|
||||
values path used in error messages>. Output: YAML of the merged dict (consume
|
||||
it with fromYaml).
|
||||
|
||||
Why this exists (issue #99): Helm merges values maps recursively, but an
|
||||
override key written without children — e.g. a leftover
|
||||
|
||||
securityContext:
|
||||
|
||||
after deleting its last remaining sub-key — is YAML null. Where the chart
|
||||
defines a default, Helm treats that null as a deletion of the default; the
|
||||
template then renders "securityContext: null": no readOnlyRootFilesystem, no
|
||||
dropped capabilities, no allowPrivilegeEscalation: false. The workload starts
|
||||
and reports healthy while being unhardened, so nothing points at the mistake.
|
||||
The same shape erases a probe (it disappears) or the resources block (no
|
||||
requests, no computed limits). This helper defines the opposite semantics: an
|
||||
empty block means "chart defaults apply".
|
||||
|
||||
Rules:
|
||||
- a nil "given" is treated as an empty dict (all defaults apply).
|
||||
- a key whose override value is null keeps the default (nulls never delete).
|
||||
- a key present in both as a map is merged recursively, so a partially
|
||||
filled block only overrides the keys it actually sets.
|
||||
- a scalar override for a key the defaults define as a map is rejected with
|
||||
a message naming the values path, instead of failing later with a template
|
||||
field error.
|
||||
- any other set value wins as given, including an explicit false or 0 —
|
||||
Helm's "default" and sprig's "mergeOverwrite" would both swallow those
|
||||
zero values, hence the explicit kindIs "invalid" nil check.
|
||||
- keys only present in the override are passed through unchanged.
|
||||
|
||||
NOTE: like the helpers above, this is duplicated into every chart's
|
||||
templates/_helpers.tpl with the chart's name as define prefix, because charts
|
||||
in this repo deliberately have no dependencies.
|
||||
*/}}
|
||||
{{- define "minecraft-router.defaultedDict" -}}
|
||||
{{- $defaults := .defaults | default dict -}}
|
||||
{{- $given := .given -}}
|
||||
{{- $path := .path | default "value" -}}
|
||||
{{- if kindIs "invalid" $given -}}
|
||||
{{- $given = dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (kindIs "map" $given) -}}
|
||||
{{- fail (printf "%s must be a mapping or null, got %s (%v)" $path (kindOf $given) $given) -}}
|
||||
{{- end -}}
|
||||
{{- $out := deepCopy $defaults -}}
|
||||
{{- range $key, $value := $given -}}
|
||||
{{- if not (kindIs "invalid" $value) -}}
|
||||
{{- $default := index $defaults $key -}}
|
||||
{{- if and (kindIs "map" $value) (kindIs "map" $default) -}}
|
||||
{{- $_ := set $out $key (fromYaml (include "minecraft-router.defaultedDict" (dict "defaults" $default "given" $value "path" (printf "%s.%s" $path $key)))) -}}
|
||||
{{- else if kindIs "map" $default -}}
|
||||
{{- fail (printf "%s.%s must be a mapping or null, got %s (%v)" $path $key (kindOf $value) $value) -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set $out $key $value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $out -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Pick one sub-block out of a values block that may itself be null.
|
||||
|
||||
Input: dict "block" <dict|nil> "key" <string> "path" <string>.
|
||||
Returns YAML of dict "value" <the sub-block, may be nil>, after rejecting a
|
||||
non-mapping block with a message that names the values path. Needed because
|
||||
".Values.server.securityContext" can itself be erased.
|
||||
*/}}
|
||||
{{- define "minecraft-router.subBlock" -}}
|
||||
{{- $block := .block -}}
|
||||
{{- if kindIs "invalid" $block -}}
|
||||
{{- $block = dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (kindIs "map" $block) -}}
|
||||
{{- fail (printf "%s must be a mapping or null, got %s (%v)" .path (kindOf $block) $block) -}}
|
||||
{{- end -}}
|
||||
{{- toYaml (dict "value" (index $block .key)) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The effective security contexts, probes and resources (issue #99).
|
||||
|
||||
The defaults below MUST stay in sync with the corresponding blocks in
|
||||
values.yaml, which stays the documented, user-facing place for them; this copy
|
||||
is only the fallback for the case where an override has erased the block.
|
||||
|
||||
Two things a rebuilt default probe must not lose:
|
||||
- the API port is addressed by NAME ("api-port"), not by number, so the probe
|
||||
keeps working if server.apiPort is overridden.
|
||||
- mc-router has no /health endpoint even in 1.46.4, so GET /routes is the
|
||||
health signal, and the "Accept: application/json" header belongs to it (it
|
||||
was mandatory in 1.25.1 and is the correct request for a JSON endpoint).
|
||||
|
||||
The pod context deliberately pins uid/gid 10000 even though the image declares
|
||||
USER 65532 since 1.46.0, so the runtime identity does not silently change with
|
||||
the base image.
|
||||
*/}}
|
||||
{{- define "minecraft-router.podSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "minecraft-router.subBlock" (dict "block" . "key" "pod" "path" "server.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"runAsNonRoot" true
|
||||
"runAsUser" 10000
|
||||
"runAsGroup" 10000
|
||||
"fsGroup" 10000
|
||||
"fsGroupChangePolicy" "Always" -}}
|
||||
{{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" $given "path" "server.securityContext.pod") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minecraft-router.containerSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "minecraft-router.subBlock" (dict "block" . "key" "container" "path" "server.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"allowPrivilegeEscalation" false
|
||||
"readOnlyRootFilesystem" true
|
||||
"runAsNonRoot" true
|
||||
"capabilities" (dict "drop" (list "ALL") "add" (list)) -}}
|
||||
{{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" $given "path" "server.securityContext.container") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minecraft-router.probeHttpGet" -}}
|
||||
{{- dict "path" "/routes" "port" "api-port" "httpHeaders" (list (dict "name" "Accept" "value" "application/json")) | toYaml -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minecraft-router.livenessProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (fromYaml (include "minecraft-router.probeHttpGet" .))
|
||||
"periodSeconds" 10
|
||||
"timeoutSeconds" 5
|
||||
"failureThreshold" 3 -}}
|
||||
{{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" . "path" "server.livenessProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minecraft-router.readinessProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (fromYaml (include "minecraft-router.probeHttpGet" .))
|
||||
"periodSeconds" 10
|
||||
"timeoutSeconds" 5
|
||||
"failureThreshold" 3 -}}
|
||||
{{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" . "path" "server.readinessProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minecraft-router.startupProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (fromYaml (include "minecraft-router.probeHttpGet" .))
|
||||
"periodSeconds" 2
|
||||
"timeoutSeconds" 5
|
||||
"failureThreshold" 15 -}}
|
||||
{{- include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" . "path" "server.startupProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The effective resources block, fed into the resources helper above so that an
|
||||
erased "resources:" still yields the chart's requests and computed limits
|
||||
instead of a container without any resource accounting.
|
||||
*/}}
|
||||
{{- define "minecraft-router.effectiveResources" -}}
|
||||
{{- $defaults := dict
|
||||
"limitFactor" 3
|
||||
"requests" (dict "cpu" "100m" "memory" "50Mi" "ephemeral-storage" "50Mi") -}}
|
||||
{{- $merged := fromYaml (include "minecraft-router.defaultedDict" (dict "defaults" $defaults "given" . "path" "server.resources")) -}}
|
||||
{{- include "minecraft-router.resources" $merged -}}
|
||||
{{- end -}}
|
||||
Reference in new issue
Block a user