From b31a18918c383a28d05fefd385af3b6ad024172a Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Wed, 14 Oct 2026 21:21:35 +0000 Subject: [PATCH] docs(gotenberg): point the values comments at the switch, not at extraPorts Two leftovers from before the switch existed. The summary still told the reader to set egress.extraPorts: [80, 443] for remote assets, and the extraPorts hint still offered the same pair as its headline case - both now say to use egress.remoteAssets instead, and the extraPorts hint says why: a bare 80/443 in that list records no reason, which is the whole argument for the named value. Also sharpens the sentence that matters: HTML conversion keeps the EMBEDDED content and loses the images it would have FETCHED. The two words were doing the work and the old wording blurred them. Part of #5 --- gotenberg/values.yaml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/gotenberg/values.yaml b/gotenberg/values.yaml index 706fb5f..9794e8b 100644 --- a/gotenberg/values.yaml +++ b/gotenberg/values.yaml @@ -106,10 +106,10 @@ networkPolicy: # this service fetch arbitrary URLs through it - and 3000 is the probe port, # so the whole cluster can POST to it by default. The cost is the # remote-asset half of HTML conversion: a converted page keeps its inline - # content and silently loses images it would have fetched. That is a degraded - # PDF, not a dead pod, which is exactly why it is written down here. A - # deployment that needs remote assets sets egress.extraPorts: [80, 443] - # knowingly. + # content and silently loses the images it would have FETCHED. That is a + # degraded PDF, not a dead pod, which is exactly why it is written down here. + # A deployment that needs those images sets egress.remoteAssets: true below - + # a named switch, knowingly, rather than a port pair in extraPorts. # # And like every chart here: 3000 is not restricted by source in the default # (probe port), and a policy is only a boundary where the CNI enforces one. @@ -184,7 +184,8 @@ networkPolicy: # permits its port to ANY destination. What the cap still buys is real: a # compromised pod cannot open arbitrary outbound connections. # - # [80, 443] is the entry to add if this release must fetch remote assets or - # convert URLs - and see the SSRF note above before adding it. A - # paperless-ngx that only converts mail bodies does not need it. + # Normally empty. Remote assets have their own switch above + # (egress.remoteAssets) and do NOT belong here, because a bare 80/443 in + # this list records no reason. Add a port here only for something neither + # the switch nor the chart covers. extraPorts: []