From e6e3ad961e255b5c7981e0127467340fcff18337 Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sun, 23 Aug 2026 20:19:41 +0200
Subject: [PATCH] Add NOTES.txt to the cyberchef chart

Prints what an operator would otherwise have to look up after installing:
the rendered Ingress URL, the cert-manager Certificate to watch while the
browser still warns, and the fact that the chart needs no secrets and no
volumes.

Adds three warnings that the values alone do not tell: CyberChef ships no
authentication, so everything that reaches the URL can use it; the app is
static and holds no server-side state, so upgrades and rollbacks need no
migration; and cyberchef.env reaches nginx but never the served bundle.

Scaled-down installations are called out conditionally, naming whichever of
scaleDown / cyberchef.replicas caused it, via the chart's own replicas
helper so the notice cannot drift from the rendered Deployment.

The URL is only ever rendered from .Values.ingress.domain, so no domain is
stored in the chart. Refs #43.
---
 cyberchef/Chart.yaml          |  2 +-
 cyberchef/templates/NOTES.txt | 37 +++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 cyberchef/templates/NOTES.txt

diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml
index 75d2abe..9dc2155 100644
--- a/cyberchef/Chart.yaml
+++ b/cyberchef/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 7.0.0+up11.4.0
+version: 7.1.0+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:
diff --git a/cyberchef/templates/NOTES.txt b/cyberchef/templates/NOTES.txt
new file mode 100644
index 0000000..32682be
--- /dev/null
+++ b/cyberchef/templates/NOTES.txt
@@ -0,0 +1,37 @@
+{{- $replicas := include "cyberchef.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.cyberchef.replicas) -}}
+CyberChef {{ .Chart.AppVersion }} — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}.
+
+ACCESS
+  https://{{ .Values.ingress.domain }}
+
+  The certificate is requested by cert-manager through the "{{ .Values.ingress.clusterIssuer }}"
+  cluster issuer. Until it has been issued the browser shows a warning; follow it with
+
+    kubectl -n {{ .Release.Namespace }} get certificate tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
+
+  This chart has no secrets and no volumes — the two ingress values above are
+  everything an installation needs.
+{{ if eq $replicas "0" }}
+SCALED TO ZERO
+  {{ if .Values.scaleDown }}scaleDown: true{{ else }}cyberchef.replicas: 0{{ end }} — the deployment runs with replicas: 0, so the URL
+  above answers 503 until you set it back and upgrade again. Service and
+  Ingress stay in place, so the certificate is not re-issued.
+{{ end }}
+ANYONE WHO REACHES THE URL CAN USE IT
+  CyberChef has no login, and this chart adds none. If it must not be open to
+  everyone, put authentication in front of it via ingress.annotations — the
+  chart merges them into the Ingress, e.g. ingress-nginx external auth or
+  basic auth annotations.
+
+NOTHING TO BACK UP, NOTHING TO MIGRATE
+  CyberChef is a static web app: recipes and inputs are processed in the
+  visitor's browser and never reach the server. The pod only serves files and
+  holds no state, so app-version upgrades and rollbacks carry no data risk and
+  need no migration step.
+{{- if .Values.cyberchef.env }}
+
+cyberchef.env HAS NO EFFECT ON THE APP
+  cyberchef.env is set. The entries reach the nginx process that serves the
+  files, but the served CyberChef bundle is static and reads none of them —
+  configuration has to happen in the browser.
+{{- end }}