Three changes, all about values that do not do what they promise:
1. values.schema.json (#68): additionalProperties: false on every
chart-owned object level, so a key the chart does not read is rejected
at render time instead of being silently ignored.
2. Ingress gate (#93): the Ingress template is wrapped in
{{- if .Values.ingress.enabled }} and the key is added to values.yaml
with default true, so behaviour is unchanged.
ingress.domain is NOT a pure Ingress value here - it is also the app's
public base URL (NEXT_PUBLIC_BASE_URL). Gating alone would therefore
have introduced a new silent failure: with the Ingress switched off and
no domain, the deployment rendered value: "https://" and every
generated link would be broken. The deployment's read of the value is
now required(), so that case fails loudly. Only clusterIssuer actually
becomes unnecessary when the Ingress is off.
3. Null-safety for hardening, probes and resources (#99): an erased block
fell back to "securityContext: null" (unhardened), a vanished probe or
a container without resource accounting. Restoring the pod context
matters especially here, because its fsGroup is what makes the Next.js
cache emptyDir group-writable for the container.
rallly.cache is deliberately NOT null-safe: cache.path is required(), so
an erased block fails loudly and belongs to the loud class #99 excludes.
Apart from an added comment, the rendered manifest is unchanged.
- Rename the Deployment (and its labels/selector/pod template/container)
to {{ .Release.Name }}-{{ .Chart.Name }}-deployment per the naming
scheme; the Service selector follows.
- Move the hardcoded pod/container security contexts into values
(rallly.securityContext.pod / .container), defaults unchanged; the
bogus null entry under capabilities.add becomes an empty list.
- Ingress standard: ingress.className value (default nginx) and
ingress.annotations merged with the cert-manager annotation;
domain/clusterIssuer stay required, TLS secret name already conformed.
- Add the tpl-rendered rallly.env value (value/secretKeyRef/
configMapKeyRef forms), appended to the built-in env.
- Major bump 3.1.2+up4.12.3 -> 4.0.0+up4.12.3 (deployment rename
replaces the Deployment on upgrade: selector is immutable).
jklein