Conventions batch 2: flexible ingress standard, configurable probes

Establish the flexible ingress standard from #32 in template-chart and
document it in README/CLAUDE.md: ingress.domain and ingress.clusterIssuer
stay required, new ingress.className value (default nginx) replaces the
hardcoded ingressClassName, new optional ingress.annotations are merged
with the cert-manager cluster-issuer annotation, TLS secret name
unchanged (tls-<release>-<chart>-ingress).

Apply the standard to cyberchef and patchmon (the two charts without an
own batch-3 major PR) and make the patchmon probes values-configurable
(server + guacd, rendered through tpl so the default Host header keeps
following ingress.domain). Defaults render semantically identical to the
previous hardcoded output.

cyberchef 5.0.1 -> 5.1.0, patchmon 5.0.1 -> 5.1.0 (minor, additive).

CLAUDE.md

@@ -58,7 +58,7 @@ App-version updates go through PRs (so the validate and install-test pipelines r
 - All resources are named `{{ .Release.Name }}-{{ .Chart.Name }}-<kind>` (e.g. `...-deployment`, `...-service`, `...-secret`).
 - Image tags come from `{{ .Chart.AppVersion }}`.
 - Secrets are 1Password `OnePasswordItem` CRs: values expose `secrets.<name>SecretRef` holding an `op://` item path; the operator materializes the Kubernetes Secret.
-- Ingress assumes `ingressClassName: nginx` and cert-manager: `ingress.clusterIssuer` and `ingress.domain` are `required` values, TLS secret named `tls-<release>-<chart>-ingress`.
+- Ingress standard: `ingress.domain` and `ingress.clusterIssuer` (cert-manager) are `required` values; `ingress.className` defaults to `nginx`; optional `ingress.annotations` are merged with the cert-manager annotation; TLS secret named `tls-<release>-<chart>-ingress`.
 - `env` entries in values support Helm templating — the deployment renders them through `tpl`, and supports `value`, `secretKeyRef`, and `configMapKeyRef` forms.
 - Hardened defaults: `automountServiceAccountToken: false`, non-root user, `readOnlyRootFilesystem: true`, all capabilities dropped; probes and resource requests/limits always set. Security contexts are values-configurable (`securityContext.pod` / `securityContext.container`); image-forced deviations are documented with a comment in the chart's `values.yaml`.
 - Stateful apps use a StatefulSet in a `<app>.sfs.yaml` template instead of a deployment.

README.md

@@ -76,7 +76,7 @@ For runtime verification (do the workloads actually start, do probes/security se
 - Image tags come from `{{ .Chart.AppVersion }}`.
 - Auxiliary/sidecar images (images other than the app image, currently only the delegation nginx in matrix-synapse) are pinned via values (`<workload>.image.repository` / `<workload>.image.tag`) instead of being hardcoded in templates, and their pinned versions are reviewed alongside every app-version update round.
 - Secrets are **1Password `OnePasswordItem` CRs**: values expose `secrets.<name>SecretRef` holding an `op://` item path; the 1Password operator materializes the Kubernetes Secret in-cluster.
-- Ingress assumes ingress-nginx (`ingressClassName: nginx`) and cert-manager: `ingress.clusterIssuer` and `ingress.domain` are required values; the TLS secret is named `tls-<release>-<chart>-ingress`.
+- Ingress standard: `ingress.domain` and `ingress.clusterIssuer` (cert-manager) are the only required values. `ingress.className` selects the ingress class and defaults to `nginx`; `ingress.annotations` takes optional extra annotations that are merged with the cert-manager `cluster-issuer` annotation the chart always sets. The TLS secret is named `tls-<release>-<chart>-ingress`. (homeassistant deliberately keeps its upstream-style flexible ingress values instead.)
 - `env` entries in `values.yaml` are rendered through `tpl`, so values may contain Helm templating; `value`, `secretKeyRef` and `configMapKeyRef` forms are supported.
 - Hardened defaults: `automountServiceAccountToken: false`, non-root user, `readOnlyRootFilesystem: true`, all capabilities dropped, probes and resource requests always set. Pod and container contexts are configurable via `securityContext.pod` / `securityContext.container` in each chart's values; writable paths (e.g. `/tmp`, nginx cache dirs, s6-overlay's `/run`) are emptyDirs. Where an image cannot satisfy the full standard (e.g. Home Assistant must start as root for s6-overlay, paperless needs a root init container to hand over `/run`), the deviation is minimal and justified with a comment in that chart's `values.yaml`.
 - Resource requests ship as chart defaults and are user-overridable; limits are computed by a per-chart `_helpers.tpl` helper (reference implementation in `template-chart/templates/_helpers.tpl`): an explicitly set limit always wins, missing memory and ephemeral-storage limits default to `resources.limitFactor` × the request (factor default `3`), and a CPU limit is only rendered when set explicitly — otherwise CPU stays unlimited (it is compressible, throttling instead of OOM-killing). The helper is duplicated into every chart because charts have no dependencies.

cyberchef/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 5.0.1+up11.4.0
+version: 5.1.0+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:

cyberchef/templates/cyberchef.ingress.yaml

@@ -3,9 +3,12 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:

cyberchef/values.yaml

@@ -59,3 +59,7 @@ ingress:
   enabled: true
   clusterIssuer: letsencrypt
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}

patchmon/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a
 
 type: application
 
-version: 5.0.1+up2.1.3
+version: 5.1.0+up2.1.3
 appVersion: "2.1.3"
 
 maintainers:

patchmon/templates/patchmon.deployment.yaml

@@ -143,44 +143,14 @@ spec:
             - name: GUACD_ADDRESS
               value: "127.0.0.1:4822"
             {{- end }}
-          # The server exposes GET /health returning {"status": "ok"}. The
-          # 2.x server rejects requests whose Host header is neither loopback
-          # nor a CORS_ORIGIN host with 403 — kubelet probes target the pod
-          # IP, so they must send the public hostname as Host header.
+          # Probe values are rendered through tpl (see values.yaml for the
+          # defaults and why the probes send a Host header).
           livenessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.server.livenessProbe) . | nindent 12 }}
           readinessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          # The startup probe gates liveness/readiness. The server waits for
-          # the database and runs migrations on startup; upstream warns that
-          # the first 2.x boot rebuilds database indexes, which can take
-          # minutes on slow storage: budget 10s * 60 = 600s.
+            {{- tpl (toYaml .Values.patchmon.server.readinessProbe) . | nindent 12 }}
           startupProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 60
+            {{- tpl (toYaml .Values.patchmon.server.startupProbe) . | nindent 12 }}
           resources:
             {{- include "patchmon.resources" .Values.patchmon.server.resources | nindent 12 }}
           volumeMounts:
@@ -199,23 +169,11 @@ spec:
               protocol: TCP
               name: guacd
           livenessProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.guacd.livenessProbe) . | nindent 12 }}
           readinessProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.guacd.readinessProbe) . | nindent 12 }}
           startupProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 30
+            {{- tpl (toYaml .Values.patchmon.guacd.startupProbe) . | nindent 12 }}
           resources:
             {{- include "patchmon.resources" .Values.patchmon.guacd.resources | nindent 12 }}
           volumeMounts:

patchmon/templates/patchmon.ingress.yaml

@@ -3,9 +3,12 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:

patchmon/values.yaml

@@ -38,6 +38,45 @@ patchmon:
         cpu: 0.1
         memory: 256Mi
         ephemeral-storage: 10Mi
+    # Probes hit GET /health ({"status": "ok"}). The 2.x server rejects
+    # requests whose Host header is neither loopback nor a CORS_ORIGIN host
+    # with 403 — kubelet probes target the pod IP, so they must send the
+    # public hostname as Host header. Probe values are rendered through tpl,
+    # so the default Host header follows ingress.domain.
+    livenessProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    readinessProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    # The startup probe gates liveness/readiness. The server waits for the
+    # database and runs migrations on startup; upstream warns that the first
+    # 2.x boot rebuilds database indexes, which can take minutes on slow
+    # storage: budget 10s * 60 = 600s.
+    startupProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 60
   guacd:
     # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
     # run as a sidecar container in the server pod. Disabled by default; when
@@ -67,10 +106,34 @@ patchmon:
         cpu: 0.05
         memory: 64Mi
         ephemeral-storage: 10Mi
+    # Probe values are rendered through tpl.
+    livenessProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    readinessProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+    startupProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 5
+      timeoutSeconds: 5
+      failureThreshold: 30
 
 ingress:
   clusterIssuer: null
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}
 
 secrets:
   redisSecretRef: null

template-chart/templates/xxx.ingress.yaml

@@ -4,9 +4,12 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:

template-chart/values.yaml

@@ -84,3 +84,7 @@ ingress:
   enabled: true
   clusterIssuer: null
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}