Calibre-Web-Automated chart: naming scheme, security hardening (conventions batch 3)

All audit findings for the calibre-web-automated chart (#32) in one major
bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6:

- Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the
  inverted <chart>-<release>-cwa-<kind> scheme to
  <release>-<chart>-<kind>; spec.serviceName and all references follow.
  Both PVCs deliberately keep their historical names (documented naming
  exception; renaming would orphan the data).
- TLS secret renamed to the standard tls-<release>-<chart>-ingress.
- Ingress on the repo standard: ingress.className (default nginx),
  ingress.annotations merged with the chart-managed annotations,
  ingress.clusterIssuer now required (was silently defaulted to
  "letsencrypt-issuer").
- Security hardening, values-configurable via securityContext.pod /
  securityContext.container: allowPrivilegeEscalation false, all
  capabilities dropped except the minimal set the s6-overlay init needs
  (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented
  deviations: the image must start as root (s6 drops to PUID 1000) and
  readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID
  remapping upstream and breaks the ImageMagick policy setup).
- Additive env value rendered through tpl (value / secretKeyRef /
  configMapKeyRef forms).
- CI fixtures: secret renamed to the new scheme, clusterIssuer added to
  test-values.

Part of #32.

calibre-web-automated/templates/calibre-web-automated-consume.pvc.yaml

@@ -1,6 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
+  # Deliberate naming exception (see README): this PVC keeps its historical
+  # <chart>-<release>-cwa-consume-pvc name — renaming a PVC would provision
+  # a new, empty volume and orphan the existing data.
   name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-consume-pvc
 spec:
   accessModes:
@@ -8,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: {{ .Values.cwa.storageClass }}
+  storageClassName: {{ .Values.cwa.storageClass }}

calibre-web-automated/templates/calibre-web-automated.ingress.yaml

@@ -1,20 +1,23 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-ingress
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
     nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.cwa.maxUploadFileSize }}
     nginx.org/client-max-body-size: {{ .Values.cwa.maxUploadFileSize }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:
         paths:
           - backend:
               service:
-                name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-service
+                name: {{ .Release.Name }}-{{ .Chart.Name }}-service
                 port:
                   name: http
             path: /
@@ -22,4 +25,4 @@ spec:
   tls:
     - hosts:
         - {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
-      secretName: tls-{{ .Chart.Name }}-{{ .Release.Name }}-ingress
+      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress

calibre-web-automated/templates/calibre-web-automated.pvc.yaml

@@ -1,6 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
+  # Deliberate naming exception (see README): this PVC keeps its historical
+  # <chart>-<release>-cwa-pvc name — renaming a PVC would provision a new,
+  # empty volume and orphan the existing data.
   name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-pvc
 spec:
   accessModes:

calibre-web-automated/templates/calibre-web-automated.secret.yaml

@@ -1,6 +1,6 @@
 apiVersion: onepassword.com/v1
 kind: OnePasswordItem
 metadata:
-  name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-secret
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
 spec:
   itemPath: {{ .Values.secrets.cwaSecretRef }}

calibre-web-automated/templates/calibre-web-automated.service.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-service
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
 spec:
   selector:
-    app: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-sfs
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
   ports:
     - protocol: TCP
       port: 80

calibre-web-automated/templates/calibre-web-automated.sfs.yaml

@@ -1,23 +1,26 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-sfs
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
   labels:
-    app: {{ .Chart.Name }}-{{ .Release.Name }}
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
 spec:
-  serviceName: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-service
+  serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
   replicas: {{ include "calibre-web-automated.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.cwa.replicas) }}
   selector:
     matchLabels:
-      app: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-sfs
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
   template:
     metadata:
-      name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-sfs
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
       labels:
-        app: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-sfs
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
     spec:
+      automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.cwa.securityContext.pod | nindent 8 }}
       containers:
-        - name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-container
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-container
           image: "ghcr.io/crocodilestick/calibre-web-automated:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           ports:
@@ -34,12 +37,32 @@ spec:
             - name: HARDCOVER_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-secret
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                   key: hardcover-api-token
             - name: CALIBRE_CONFIG_DIR
               value: "/config/.config/calibre"
             - name: NETWORK_SHARE_MODE
               value: "false"
+            {{- range $value := .Values.cwa.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           volumeMounts:
             - mountPath: "/config"
               name: cwa
@@ -63,12 +86,13 @@ spec:
             {{- toYaml .Values.cwa.startupProbe | nindent 12 }}
           resources:
             {{- include "calibre-web-automated.resources" .Values.cwa.resources | nindent 12 }}
-      automountServiceAccountToken: false
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: Always
+          securityContext:
+            {{- toYaml .Values.cwa.securityContext.container | nindent 12 }}
       restartPolicy: Always
       volumes:
+        # Deliberate naming exception (see README): both PVCs keep their
+        # historical <chart>-<release>-cwa-* names — renaming a PVC would
+        # provision a new, empty volume and orphan the existing data.
         - name: cwa
           persistentVolumeClaim:
             claimName: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-pvc
@@ -77,8 +101,8 @@ spec:
             claimName: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-consume-pvc
         - name: cwa-plugins-config
           secret:
-            secretName: {{ .Chart.Name }}-{{ .Release.Name }}-cwa-secret
+            secretName: {{ .Release.Name }}-{{ .Chart.Name }}-secret
             items:
               - key: calibre-plugins
                 path: customize.py.json
-                mode: 0644
+                mode: 0644