minecraft-server: null-safe hardening, probes and resources

The last open gap of #99. minecraft-server was the one chart of 21 where an
erased security context removed the hardening in silence: it never got the
defaultedDict helper, the StatefulSet rendered .Values.securityContext.pod
straight through toYaml, and the schema typed securityContext.pod as a strict
"object" without required. Measured against ci/minecraft-server/test-values.yaml
on 3.0.1:

  --set securityContext.pod=null --set securityContext.container=null
  -> helm exit 0, no schema error, "securityContext: null" for BOTH the pod and
     the container - no runAsNonRoot, no readOnlyRootFilesystem, no dropped
     capabilities, in a chart with a PVC.

Bitter place for it: the README lists this chart as the pilot for #68. It got
its schema early and was therefore never caught by the later null-safety wave.

Both halves are added, because they cover different cases. For a key WITH a
chart default Helm's coalescing deletes the null before validation ever sees
it, and only the defaultedDict fallback catches that; for a key WITHOUT one
(server.resources.limits) the null survives into validation, where the strict
"object" aborted the render. Now widened to ["object","null"].

The fallback table reproduces THIS chart's defaults, deviations included:
uid/gid pinned to 1000 (the image's minecraft user - starting as it directly
takes the entrypoint's non-root branch, which skips the recursive chown of
/data and the write to /etc/nsswitch.conf that a read-only root filesystem
would reject), fsGroupChangePolicy OnRootMismatch (a recursive chown of a 32Gi
world on every start costs minutes), the explicit empty capabilities.add list,
and all three probes as exec probes running the image's mc-health script - this
image has no HTTP endpoint, so a probe default rebuilt as httpGet would leave
the workload with no working probe at all. The startup budget stays 15s x 80.

server.resources goes through the same helper while keeping its memory request
deliberately unset, so it is still derived from the JVM heap.

Also, the same class one level down: init.sh chowned the migrated serverpack to
a hardcoded 1000:1000 while the uid it has to match was overridable. Both reads
now go through the same helper, so they cannot disagree. With the chart defaults
the rendered script is unchanged, so checksum/config does not move and no
existing pod rolls.

minecraft.resources.storage and .memory stay deliberately not null-safe: an
erased value yields an invalid PVC or an unparseable quantity, which is the loud
class #99 excludes.

Evidence, all against ci/minecraft-server/test-values.yaml unless noted:

  - the reported call now renders the defaults, byte-identical to the
    unmodified rendering. Fallback, not rejection.
  - rendering with securityContext, all three probes and server.resources set
    to null is byte-identical to rendering the chart defaults - which is what
    keeps the table and values.yaml in sync instead of leaving it to discipline.
  - no regression: rendering before and after the change is byte-identical, on
    the CI values, on the chart defaults, and with curseforgeServerpack enabled
    (the init-container path the CI values do not exercise). Confirmed
    structurally too, not only by raw diff.
  - partial nulling, 14 keys swept one at a time. On 3.0.1 twelve of them
    changed the rendering silently, including capabilities (the container kept
    every default capability instead of dropping ALL) and requests (cpu and
    ephemeral-storage disappeared entirely). On 4.0.0 all fourteen render
    identical to the defaults.
  - explicit false and 0 still win over the defaults; a scalar in a mapping slot
    is still rejected, now naming the values path.

Major bump: erasing one of these blocks used to change the rendered workload
and now does not, which is a runtime behaviour change. appVersion is untouched.

Refs #99

minecraft-server/Chart.yaml

@@ -13,7 +13,7 @@ type: application
 # continuously, so a pod restart could pull a different image than the last one
 # without anything being recorded anywhere. The dated tags are immutable, so the
 # image is now pinned by the chart version like every other chart in this repo.
-version: 3.0.1+up2026.8.2.java21
+version: 4.0.0+up2026.8.2.java21
 appVersion: "2026.8.2-java21"
 
 maintainers:

minecraft-server/templates/_helpers.tpl

@@ -95,10 +95,19 @@ the heap instead, which keeps the two from drifting apart; an explicitly set
 request always wins. The limit follows from the request via the limitFactor
 rule in "minecraft-server.resources".
 
+Since chart 4.0.0 the values block first goes through "defaultedDict" (issue
+#99), so an erased "server.resources:" falls back to the chart's requests and
+computed limits instead of rendering a container without any resource
+accounting. The fallback deliberately leaves the memory request unset, exactly
+as values.yaml does, so the derivation from the JVM heap below still applies.
+
 Input: the root context.
 */}}
 {{- define "minecraft-server.serverResources" -}}
-{{- $resources := deepCopy (.Values.server.resources | default dict) -}}
+{{- $defaults := dict
+      "limitFactor" 3
+      "requests" (dict "cpu" "2" "ephemeral-storage" "100Mi") -}}
+{{- $resources := fromYaml (include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" .Values.server.resources "path" "server.resources")) -}}
 {{- $requests := deepCopy ($resources.requests | default dict) -}}
 {{- if kindIs "invalid" $requests.memory -}}
 {{- $_ := set $requests "memory" (printf "%vGi" .Values.minecraft.resources.memory) -}}
@@ -156,3 +165,168 @@ last one silently won. Fail loudly instead.
 {{- fail "minecraft-server: curseforgeServerpack.enabled is true but curseforgeServerpack.downloadUrl is not set - the init container would download an empty URL" -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Merge a user-supplied values sub-tree onto a dict of chart defaults so that a
+null / empty override falls back to the defaults instead of erasing them.
+
+Input: dict "defaults" <dict> "given" <dict|nil> "path" <string, optional
+values path used in error messages>. Output: YAML of the merged dict (consume
+it with fromYaml).
+
+Why this exists (issue #99): Helm merges values maps recursively, but an
+override key written without children — e.g. a leftover
+
+  securityContext:
+
+after deleting its last remaining sub-key — is YAML null. Where the chart
+defines a default, Helm treats that null as a deletion of the default; the
+template then renders "securityContext: null": no readOnlyRootFilesystem, no
+dropped capabilities, no allowPrivilegeEscalation: false. The workload starts
+and reports healthy while being unhardened, so nothing points at the mistake.
+The same shape erases a probe (it disappears) or the resources block (no
+requests, no computed limits). This helper defines the opposite semantics: an
+empty block means "chart defaults apply".
+
+Rules:
+  - a nil "given" is treated as an empty dict (all defaults apply).
+  - a key whose override value is null keeps the default (nulls never delete).
+  - a key present in both as a map is merged recursively, so a partially
+    filled block only overrides the keys it actually sets.
+  - a scalar override for a key the defaults define as a map is rejected with
+    a message naming the values path, instead of failing later with a template
+    field error.
+  - any other set value wins as given, including an explicit false or 0 —
+    Helm's "default" and sprig's "mergeOverwrite" would both swallow those
+    zero values, hence the explicit kindIs "invalid" nil check.
+  - keys only present in the override are passed through unchanged.
+
+NOTE: like the helpers above, this is duplicated into every chart's
+templates/_helpers.tpl with the chart's name as define prefix, because charts
+in this repo deliberately have no dependencies. The reference implementation
+lives in template-chart.
+*/}}
+{{- define "minecraft-server.defaultedDict" -}}
+{{- $defaults := .defaults | default dict -}}
+{{- $given := .given -}}
+{{- $path := .path | default "value" -}}
+{{- if kindIs "invalid" $given -}}
+{{- $given = dict -}}
+{{- end -}}
+{{- if not (kindIs "map" $given) -}}
+{{- fail (printf "%s must be a mapping or null, got %s (%v)" $path (kindOf $given) $given) -}}
+{{- end -}}
+{{- $out := deepCopy $defaults -}}
+{{- range $key, $value := $given -}}
+{{- if not (kindIs "invalid" $value) -}}
+{{- $default := index $defaults $key -}}
+{{- if and (kindIs "map" $value) (kindIs "map" $default) -}}
+{{- $_ := set $out $key (fromYaml (include "minecraft-server.defaultedDict" (dict "defaults" $default "given" $value "path" (printf "%s.%s" $path $key)))) -}}
+{{- else if kindIs "map" $default -}}
+{{- fail (printf "%s.%s must be a mapping or null, got %s (%v)" $path $key (kindOf $value) $value) -}}
+{{- else -}}
+{{- $_ := set $out $key $value -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end -}}
+
+{{/*
+Pick one sub-block out of a values block that may itself be null.
+
+Input: dict "block" <dict|nil> "key" <string> "path" <string>.
+Returns YAML of dict "value" <the sub-block, may be nil>, after rejecting a
+non-mapping block with a message that names the values path. Needed because
+".Values.securityContext" can itself be erased, and indexing into nil inside a
+template is not an error but silently yields nothing.
+*/}}
+{{- define "minecraft-server.subBlock" -}}
+{{- $block := .block -}}
+{{- if kindIs "invalid" $block -}}
+{{- $block = dict -}}
+{{- end -}}
+{{- if not (kindIs "map" $block) -}}
+{{- fail (printf "%s must be a mapping or null, got %s (%v)" .path (kindOf $block) $block) -}}
+{{- end -}}
+{{- toYaml (dict "value" (index $block .key)) -}}
+{{- end -}}
+
+{{/*
+The effective security contexts and probes (issue #99); the resources block is
+covered by "minecraft-server.serverResources" above.
+
+The defaults below MUST stay in sync with the corresponding blocks in
+values.yaml, which stays the documented, user-facing place for them; this copy
+is only the fallback for the case where an override has erased the block. The
+sync is not left to discipline: rendering with every one of these blocks set to
+null is byte-identical to rendering the defaults, so a drift shows up.
+
+This chart's deviations from the repo baseline, which a "cleaned up" standard
+fallback would silently undo:
+
+  - uid/gid are pinned to 1000, the image's "minecraft" user. The image's
+    entrypoint normally starts as root and drops to that user via gosu;
+    starting as the user directly takes the non-root branch, which skips the
+    recursive chown of /data and the write to /etc/nsswitch.conf that would
+    fail on a read-only root filesystem. It is also the uid that owns the
+    existing world data on the PVC.
+  - fsGroupChangePolicy is OnRootMismatch, not Always: a recursive chown of a
+    32Gi world on every pod start costs minutes.
+  - the capabilities block carries an explicit empty "add" list alongside
+    "drop: [ALL]", matching values.yaml.
+  - all three probes run the image's own mc-health script as an EXEC probe -
+    a real Minecraft server-list ping via mc-monitor against SERVER_PORT.
+    There is no HTTP endpoint to fall back to, so a probe default rebuilt as
+    an httpGet would leave this workload with no working probe at all.
+  - the startup budget is 15s x 80 = 20 minutes, because on a fresh volume the
+    image downloads the server jar and, for FTB/CurseForge modpacks, the whole
+    modpack before the world even starts loading.
+*/}}
+{{- define "minecraft-server.podSecurityContext" -}}
+{{- $given := (fromYaml (include "minecraft-server.subBlock" (dict "block" . "key" "pod" "path" "securityContext"))).value -}}
+{{- $defaults := dict
+      "runAsNonRoot" true
+      "runAsUser" 1000
+      "runAsGroup" 1000
+      "fsGroup" 1000
+      "fsGroupChangePolicy" "OnRootMismatch" -}}
+{{- include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" $given "path" "securityContext.pod") -}}
+{{- end -}}
+
+{{- define "minecraft-server.containerSecurityContext" -}}
+{{- $given := (fromYaml (include "minecraft-server.subBlock" (dict "block" . "key" "container" "path" "securityContext"))).value -}}
+{{- $defaults := dict
+      "allowPrivilegeEscalation" false
+      "readOnlyRootFilesystem" true
+      "runAsNonRoot" true
+      "capabilities" (dict "drop" (list "ALL") "add" (list)) -}}
+{{- include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" $given "path" "securityContext.container") -}}
+{{- end -}}
+
+{{- define "minecraft-server.livenessProbe" -}}
+{{- $defaults := dict
+      "exec" (dict "command" (list "mc-health"))
+      "periodSeconds" 30
+      "timeoutSeconds" 10
+      "failureThreshold" 3 -}}
+{{- include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" . "path" "livenessProbe") -}}
+{{- end -}}
+
+{{- define "minecraft-server.readinessProbe" -}}
+{{- $defaults := dict
+      "exec" (dict "command" (list "mc-health"))
+      "periodSeconds" 15
+      "timeoutSeconds" 10
+      "failureThreshold" 3 -}}
+{{- include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" . "path" "readinessProbe") -}}
+{{- end -}}
+
+{{- define "minecraft-server.startupProbe" -}}
+{{- $defaults := dict
+      "exec" (dict "command" (list "mc-health"))
+      "periodSeconds" 15
+      "timeoutSeconds" 10
+      "failureThreshold" 80 -}}
+{{- include "minecraft-server.defaultedDict" (dict "defaults" $defaults "given" . "path" "startupProbe") -}}
+{{- end -}}

minecraft-server/templates/minecraft-server.configmap.yaml

@@ -1,3 +1,11 @@
+{{/*
+The chown at the end of init.sh used to be a hardcoded 1000:1000 while the uid
+it has to match was overridable through securityContext.pod - so an override
+made the two disagree in silence. Both now read the same null-safe helper, and
+with the chart defaults the rendered script is unchanged (1000:1000), so this
+does not move checksum/config and does not roll existing pods.
+*/}}
+{{- $podCtx := fromYaml (include "minecraft-server.podSecurityContext" .Values.securityContext) -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -40,7 +48,7 @@ data:
       # not be fatal: an unprivileged process cannot chown foreign files, and
       # with "set -e" a failure here would keep the whole pod from starting.
       echo "change owner of files"
-      chown -R 1000:1000 $SERVERPACK_DIR || echo "chown skipped (not permitted); continuing"
+      chown -R {{ $podCtx.runAsUser }}:{{ $podCtx.runAsGroup }} $SERVERPACK_DIR || echo "chown skipped (not permitted); continuing"
 
       echo "successfully migrated server"
 

minecraft-server/templates/minecraft-server.sfs.yaml

@@ -35,14 +35,14 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.securityContext.pod | nindent 8 }}
+        {{- include "minecraft-server.podSecurityContext" .Values.securityContext | nindent 8 }}
       {{- if .Values.curseforgeServerpack.enabled }}
       initContainers:
         - name: download-serverpack
           image: {{ .Values.server.initImage }}
           command: [ 'sh', '/init/init.sh' ]
           securityContext:
-            {{- toYaml .Values.securityContext.container | nindent 12 }}
+            {{- include "minecraft-server.containerSecurityContext" .Values.securityContext | nindent 12 }}
           volumeMounts:
             - name: "mc-volume"
               mountPath: /modpacks
@@ -61,7 +61,7 @@ spec:
           image: "itzg/minecraft-server:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           securityContext:
-            {{- toYaml .Values.securityContext.container | nindent 12 }}
+            {{- include "minecraft-server.containerSecurityContext" .Values.securityContext | nindent 12 }}
           ports:
             - name: mc-port
               containerPort: {{ .Values.server.port }}
@@ -205,11 +205,11 @@ spec:
             {{- end }}
             {{- end }}
           livenessProbe:
-            {{- toYaml .Values.livenessProbe | nindent 12 }}
+            {{- include "minecraft-server.livenessProbe" .Values.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.readinessProbe | nindent 12 }}
+            {{- include "minecraft-server.readinessProbe" .Values.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.startupProbe | nindent 12 }}
+            {{- include "minecraft-server.startupProbe" .Values.startupProbe | nindent 12 }}
           resources:
             {{- include "minecraft-server.serverResources" . | nindent 12 }}
           volumeMounts:

minecraft-server/values.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema#",
   "title": "minecraft-server values",
-  "description": "Strict values schema (issue #68 pilot). additionalProperties is false on every chart-owned object level, so a key that the chart does not read is rejected at render time instead of being silently ignored. The only objects that stay open are the ones passed verbatim into the Kubernetes pod spec (probes, security contexts, global) - the chart does not interpret their contents, so it cannot judge which keys are meaningful.",
+  "description": "Strict values schema (issue #68 pilot). additionalProperties is false on every chart-owned object level, so a key that the chart does not read is rejected at render time instead of being silently ignored. The only objects that stay open are the ones passed verbatim into the Kubernetes pod spec (probes, security contexts, global) - the chart does not interpret their contents, so it cannot judge which keys are meaningful. The hardening, probe and resources blocks additionally accept null, because an erased block falls back to the chart defaults (issue #99). Both halves are needed and cover different cases: for a key WITH a chart default Helm's coalescing deletes the null before validation ever sees it, and only the defaultedDict fallback in _helpers.tpl catches that; for a key WITHOUT one (e.g. server.resources.limits) the null survives into validation, where a strict \"object\" would abort the render. Everything else stays strictly typed.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -75,7 +75,8 @@
           "type": "string"
         },
         "resources": {
-          "type": "object",
+          "description": "May be null / empty: the chart then falls back to its default requests and computed limits (issue #99) instead of rendering the server container without resource accounting. The memory request stays deliberately unset in that fallback, as in values.yaml, so it keeps being derived from the JVM heap (minecraft.resources.memory).",
+          "type": ["object", "null"],
           "additionalProperties": false,
           "properties": {
             "limitFactor": {
@@ -130,16 +131,17 @@
       "$ref": "#/definitions/probe"
     },
     "securityContext": {
-      "type": "object",
+      "description": "May be null / empty at any level: the chart then falls back to its hardening defaults (issue #99) instead of rendering an unhardened workload. The pod context is consumed twice - as the pod's securityContext and by the serverpack init script, which chowns the migrated files to runAsUser:runAsGroup; both reads go through the same helper.",
+      "type": ["object", "null"],
       "additionalProperties": false,
       "properties": {
         "pod": {
-          "description": "Rendered verbatim as the pod's securityContext; kept open because the chart does not interpret it.",
+          "description": "Merged onto the chart's pod hardening defaults and rendered as the pod's securityContext; kept open because the chart does not interpret the individual fields.",
-          "type": "object"
+          "type": ["object", "null"]
         },
         "container": {
-          "description": "Rendered verbatim as the container's securityContext; kept open because the chart does not interpret it.",
+          "description": "Merged onto the chart's container hardening defaults and rendered as the securityContext of the server container and the serverpack init container; kept open because the chart does not interpret the individual fields.",
-          "type": "object"
+          "type": ["object", "null"]
         }
       }
     },
@@ -283,7 +285,7 @@
   },
   "definitions": {
     "resourceList": {
-      "type": "object",
+      "type": ["object", "null"],
       "additionalProperties": false,
       "properties": {
         "cpu": {
@@ -314,8 +316,8 @@
       }
     },
     "probe": {
-      "description": "Rendered verbatim as a container probe; kept open because the chart does not interpret it.",
+      "description": "Merged onto the chart's probe defaults and rendered as a container probe; kept open because the chart does not interpret the individual fields. May be null / empty, which means the defaults apply (issue #99) rather than the probe disappearing. The defaults carry the probe's context, not just its timings: all three run the image's mc-health script as an exec probe, which is the only health check this image offers.",
-      "type": "object"
+      "type": ["object", "null"]
     }
   }
 }