Minecraft-router chart: naming scheme, hardening, probes, values interface

Stage 2 of the Fleet migration for minecraft-router: bring the chart up to the repo style guidelines. Chart 0.1.1+up1.25.1 -> 1.0.0+up1.25.1 (major: resource renames, mappings becomes required, probes and security hardening change the runtime behavior; appVersion unchanged). - Resources renamed to {{ .Release.Name }}-{{ .Chart.Name }}-<kind>, templates to <chart>.<kind>.yaml; the deployment label now matches its own selector. - mappings is required and must not be empty (the old default rendered "<nil>": "<nil>:25565"); every entry needs domain and internalUrl. - Ports come from values: server.port (router listen port, also passed as --port), server.backendPort (default backend port, overridable per mapping), server.apiPort (--api-binding, used by the probes). Defaults stay 25565 / 25565 / 8080, server.outwardPort keeps its 25565 default and comment. - _helpers.tpl added (resources/limitFactor and replicas/scaleDown helpers), resources come from values, no CPU limit. - replicas value plus the chart-global scaleDown flag. - Additive env block rendered through tpl (value / secretKeyRef / configMapKeyRef). - Values-configurable securityContext.pod / .container with hardened defaults: non-root uid/gid 10000, readOnlyRootFilesystem, no privilege escalation, all capabilities dropped. - Liveness, readiness and startup probes on the mc-router API: GET /routes with an "Accept: application/json" header (the API router matches on that header and answers 404 without it). - icon added to Chart.yaml. - CI fixture supplies mappings; README chart table entry updated.
2026-08-23 15:14:49 +02:00
1 parent 0e3ba0a92f
commit c20ad389f2
@@ -0,0 +1,116 @@
+{{/*
+Render the body of a container "resources:" block from a values dict of the form
+
+  resources:
+    limitFactor: 3          # optional, default 3
+    requests: { cpu, memory, ephemeral-storage / ephemeralStorage, ... }
+    limits:   { ... }       # optional, every entry optional
+
+Rules (variant B, see issue #19):
+  - requests are rendered as given (camelCase "ephemeralStorage" is normalized
+    to the Kubernetes key "ephemeral-storage").
+  - an explicitly set limit always wins.
+  - a missing memory / ephemeral-storage limit is computed as
+    limitFactor x the corresponding request.
+  - a missing cpu limit is NOT set at all (the kubelet then treats CPU as
+    unlimited; CPU is compressible, so this cannot kill the workload).
+
+Usage (the values path to the resources dict varies per chart):
+  resources:
+    {{- include "minecraft-router.resources" .Values.<app>.resources | nindent 12 }}
+
+NOTE: charts in this repo deliberately have no dependencies, so this helper is
+duplicated into every chart's templates/_helpers.tpl with the chart's name as
+define prefix. This file in template-chart is the reference implementation.
+*/}}
+{{- define "minecraft-router.resources" -}}
+{{- $resources := . | default dict -}}
+{{- $factor := 3.0 -}}
+{{- if not (kindIs "invalid" $resources.limitFactor) -}}
+{{- $factor = float64 $resources.limitFactor -}}
+{{- end -}}
+{{- $requests := dict -}}
+{{- range $key, $value := ($resources.requests | default dict) -}}
+{{- if not (kindIs "invalid" $value) -}}
+{{- $_ := set $requests (include "minecraft-router.resourceKey" $key) $value -}}
+{{- end -}}
+{{- end -}}
+{{- $limits := dict -}}
+{{- range $key, $value := ($resources.limits | default dict) -}}
+{{- if not (kindIs "invalid" $value) -}}
+{{- $_ := set $limits (include "minecraft-router.resourceKey" $key) $value -}}
+{{- end -}}
+{{- end -}}
+{{- range $key, $request := $requests -}}
+{{- if and (ne $key "cpu") (not (hasKey $limits $key)) -}}
+{{- $_ := set $limits $key (include "minecraft-router.multiplyQuantity" (dict "quantity" $request "factor" $factor)) -}}
+{{- end -}}
+{{- end -}}
+{{- $out := dict -}}
+{{- with $requests }}{{- $_ := set $out "requests" . }}{{- end -}}
+{{- with $limits }}{{- $_ := set $out "limits" . }}{{- end -}}
+{{- toYaml $out -}}
+{{- end -}}
+
+{{/*
+Normalize a resource name from values to its Kubernetes key.
+*/}}
+{{- define "minecraft-router.resourceKey" -}}
+{{- if eq . "ephemeralStorage" -}}ephemeral-storage{{- else -}}{{ . }}{{- end -}}
+{{- end -}}
+
+{{/*
+Multiply a Kubernetes quantity by a factor, keeping its suffix.
+Input: dict "quantity" <string|number> "factor" <float64>.
+Handles plain numbers ("2", "0.5", 1073741824), decimal ("1.5Gi"), binary
+("512Mi", "1Gi", "10Ki") and milli/SI suffixes ("100m", "500M"). Integer
+results are printed without a decimal point.
+*/}}
+{{- define "minecraft-router.multiplyQuantity" -}}
+{{- $quantity := printf "%v" .quantity -}}
+{{- $number := regexFind "^[0-9]+(\\.[0-9]+)?" $quantity -}}
+{{- if not $number -}}
+{{- fail (printf "cannot parse resource quantity %q" $quantity) -}}
+{{- end -}}
+{{- $suffix := trimPrefix $number $quantity -}}
+{{- if not (regexMatch "^(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$" $suffix) -}}
+{{- fail (printf "unsupported resource quantity suffix %q in %q" $suffix $quantity) -}}
+{{- end -}}
+{{- $product := mulf (float64 $number) .factor -}}
+{{- if eq $product (floor $product) -}}
+{{- printf "%d%s" (int64 $product) $suffix -}}
+{{- else -}}
+{{- printf "%v%s" $product $suffix -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Render the replica count for a Deployment/StatefulSet.
+
+Input: dict
+  "scaleDown"  the chart-global .Values.scaleDown flag (may be nil)
+  "replicas"   the workload's replicas value (may be nil)
+
+Rules (issue #25):
+  - scaleDown: true takes precedence and always yields 0.
+  - otherwise an explicitly set replicas value is used as given, including an
+    explicit 0 — Helm's "default" would swallow 0, hence the explicit
+    kindIs "invalid" nil check.
+  - a missing replicas value defaults to 1.
+
+Usage (the values path to the workload's replicas varies per chart):
+  replicas: {{ include "minecraft-router.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.<app>.replicas) }}
+
+NOTE: like the resources helper above, this is duplicated into every chart's
+templates/_helpers.tpl with the chart's name as define prefix. This file in
+template-chart is the reference implementation.
+*/}}
+{{- define "minecraft-router.replicas" -}}
+{{- if .scaleDown -}}
+0
+{{- else if not (kindIs "invalid" .replicas) -}}
+{{- .replicas -}}
+{{- else -}}
+1
+{{- end -}}
+{{- end -}}
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Release.Name }}-config
-data:
-  custom-routing-config.json: |
-    {
-      "mappings": {
-    {{- $length := len .Values.mappings }}
-    {{- $indexLength := sub $length 1 }}
-    {{- range $index, $value := .Values.mappings }}
-        "{{ $value.domain }}": "{{ $value.internalUrl }}:25565"{{ if lt $index $indexLength }},{{ end }}
-    {{- end }}
-      }
-    }
@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-deployment
-  labels:
-    app: {{ .Release.Name }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-deployment
-  template:
-    metadata:
-      name: {{ .Release.Name }}-deployment
-      labels:
-        app: {{ .Release.Name }}-deployment
-    spec:
-      automountServiceAccountToken: false
-      containers:
-        - image: "itzg/mc-router:{{ .Chart.AppVersion }}"
-          name: mc-router
-          args: ["--api-binding", ":8080"]
-          ports:
-            - name: proxy-port
-              containerPort: 25565
-            - name: api-port
-              containerPort: 8080
-          env:
-            - name: ROUTES_CONFIG
-              value: /data/custom-routing-config.json
-          resources:
-            requests:
-              memory: 50Mi
-              cpu: "100m"
-              ephemeral-storage: "50Mi"
-            limits:
-              memory: 100Mi
-              cpu: "250m"
-              ephemeral-storage: "500Mi"
-          volumeMounts:
-            - name: config-mount
-              mountPath: /data/custom-routing-config.json
-              subPath: custom-routing-config.json
-
-      volumes:
-        - name: config-mount
-          configMap:
-            name: {{ .Release.Name }}-config
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-service
-spec:
-  selector:
-    app: {{ .Release.Name }}-deployment
-  ports:
-    - nodePort: {{ .Values.server.outwardPort }}
-      port: 25565
-      targetPort: 25565
-      name: proxy-port
-  type: NodePort
-  
@@ -0,0 +1,22 @@
+{{- $message := "minecraft-router: .Values.mappings is required and must not be empty - set at least one mapping with a domain and an internalUrl (see values.yaml)" -}}
+{{- $mappings := required $message .Values.mappings -}}
+{{- if and (not (kindIs "invalid" $mappings)) (or (not (kindIs "slice" $mappings)) (empty $mappings)) }}{{- fail $message -}}{{- end -}}
+{{- $routes := dict -}}
+{{/* "helm lint" reports a missing required value but keeps rendering, so the
+     loop has to tolerate the nil it hands back; "helm template" and "helm
+     install" abort on the required above. */}}
+{{- range $index, $mapping := ($mappings | default list) -}}
+{{- $domain := required (printf "minecraft-router: .Values.mappings[%d].domain is required" $index) $mapping.domain -}}
+{{- $internalUrl := required (printf "minecraft-router: .Values.mappings[%d].internalUrl is required" $index) $mapping.internalUrl -}}
+{{- $port := $mapping.port | default $.Values.server.backendPort -}}
+{{- $_ := set $routes $domain (printf "%v:%v" $internalUrl $port) -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-configmap
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-configmap
+data:
+  custom-routing-config.json: |
+{{ dict "mappings" $routes | toPrettyJson | indent 4 }}
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+spec:
+  replicas: {{ include "minecraft-router.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.server.replicas) }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+  template:
+    metadata:
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+      labels:
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.server.securityContext.pod | nindent 8 }}
+      containers:
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+          image: "itzg/mc-router:{{ .Chart.AppVersion }}"
+          imagePullPolicy: IfNotPresent
+          args:
+            - "--port"
+            - "{{ .Values.server.port }}"
+            - "--api-binding"
+            - ":{{ .Values.server.apiPort }}"
+          env:
+            - name: ROUTES_CONFIG
+              value: /data/custom-routing-config.json
+            {{- range $value := .Values.server.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name }}
+              value: {{ tpl $value.value $ }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+          ports:
+            - name: proxy-port
+              protocol: TCP
+              containerPort: {{ .Values.server.port }}
+            - name: api-port
+              protocol: TCP
+              containerPort: {{ .Values.server.apiPort }}
+          livenessProbe:
+            {{- toYaml .Values.server.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.server.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.server.startupProbe | nindent 12 }}
+          resources:
+            {{- include "minecraft-router.resources" .Values.server.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.server.securityContext.container | nindent 12 }}
+          volumeMounts:
+            - name: config-mount
+              mountPath: /data/custom-routing-config.json
+              subPath: custom-routing-config.json
+              readOnly: true
+      volumes:
+        - name: config-mount
+          configMap:
+            name: {{ .Release.Name }}-{{ .Chart.Name }}-configmap
+      restartPolicy: Always
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-service
+spec:
+  type: NodePort
+  selector:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+  ports:
+    - name: proxy-port
+      protocol: TCP
+      port: {{ .Values.server.port }}
+      targetPort: proxy-port
+      nodePort: {{ .Values.server.outwardPort }}