3 Commits

Include renames

Author	SHA1	Message	Date
jklein	ee9ae8a724	feat!: NetworkPolicy in six more charts, on by default ... bentopdf, apache-tika, gotenberg, rss-bridge, searxng, ytdlp-web-player. One major each, networkPolicy.enabled defaults to true. Three of them differ from the simple case in ways worth naming: GOTENBERG gets DNS-only egress as a deliberate, documented trade. It drives a headless Chromium, and 3000 is its probe port - so it is reachable from the whole cluster by default, and an egress rule for 80/443 would turn a service anyone can POST to into a way of fetching arbitrary URLs. The price is the remote-asset half of HTML conversion: inline content converts, images the page would have fetched silently do not. That degrades a PDF instead of failing a pod, so nothing alerts on it, which is why it is in the template header, in values.yaml and in NOTES.txt, with extraPorts: [80, 443] named as the knowing opt-in. RSS-BRIDGE, SEARXNG and YTDLP-WEB-PLAYER get the open internet on their web ports, because reaching other people's servers IS the application and this object cannot name a host. Said plainly in each, so none of them reads stricter than it is. What the cap still buys is real: no other outbound port, so a compromised pod reaches no database, no mail server and no SSH anywhere. APACHE-TIKA and GOTENBERG render no Ingress - their consumers are other pods, in other namespaces here - so neither gets an ingressController value and both say in NOTES.txt that narrowing probeSources means listing the consumers' namespaces in allowedNamespaces in the same change, or extraction and conversion stop. YTDLP-WEB-PLAYER names the gap this convention has: its oauth2-proxy subchart renders its own Deployment with its own labels and ships no policy, so with the proxy enabled the pod that actually faces the Ingress is unrestricted in both directions. Nothing in this chart can change that - an upstream chart is consumed as it comes - so it is written down instead. ci/outline/test-values.yaml gains egress.extraPorts: [5556]. The CI dex runs there rather than on 443, and Outline fetches the discovery document at boot - so this is the chart's documented escape hatch used for exactly the case it was written for, and the one place in the repo where the cap's upgrade risk is actually exercised. Part of #5	2026-10-14 14:20:39 +00:00
jklein	f74870b246	apache-tika: note why the notes use effectiveResources ... Records the reasoning inline, matching the comment the gotenberg chart carries, so the next edit does not quietly switch back to the raw helper and drop the paragraph whenever a resources: block has been erased.	2026-08-23 20:46:50 +02:00
jklein	6295f4b9c1	Add NOTES.txt to the apache-tika chart ... Tika has no Ingress, so the notes lead with the cluster-internal URL, the Service-port-80 to container-port-9998 mismatch a consumer has to get right, and /parsers as the direct answer to "why did this file come back empty". Two warnings come from measuring the running container rather than from reading the values file: - The image tag has to keep its "-full" suffix. That variant is where Tesseract 5.5.0 and the extra parsers live; the plain image carries no tesseract binary at all, so dropping the suffix does not fail loudly, it just stops OCR and returns empty text for scans. - The JVM never sees the container limit. It starts without -Xmx and derives its heap from the limit at MaxRAMPercentage=25, so the number worth sizing against is a quarter of it. The heap figure is computed from the effective limit through the chart's own null-safe effectiveResources helper, so an erased resources: block still prints the defaults the container actually receives instead of dropping the paragraph. Refs #43.	2026-08-23 20:44:02 +02:00