--set dev=null aborted the render at .Values.dev.debug and --set server=null
at .Values.server.replicas, while the third block, game, has fallen back to
the chart defaults since 7.0.0. Half-safe is the worse state of the two:
whoever sees game=null work assumes server=null does too.
Both blocks now run through satisfactory.defaultedDict like game, via two new
helpers next to it. server.resources is deliberately NOT re-defaulted there -
it already runs through satisfactory.effectiveResources, which carries those
defaults and is null-safe on its own, and a second copy of limitFactor: 2 /
4Gi / 1 / 5Gi would be a third place for them to drift.
server is read in four files, not one, and the fourth is NOTES.txt, which
helm template never renders - a fix confined to the manifests would have
looked green and still aborted on a real helm install. All four go through
the helpers.
The single erased key was the quieter half of the bug and is fixed with it:
a nulled server.gamePort rendered "port:" and "nodePort:" empty into the
Service and an empty containerPort into the StatefulSet, and a nulled
server.storage a PVC asking for no size - manifests rejected by nothing until
the API server saw them. server.storage was documented in values.schema.json
as deliberately not null-safe; that reasoning does not survive the block-level
case, because it made "server: null" render a sizeless PVC instead of falling
back like everything else. The schema note is replaced rather than left lying.
Rendered output for valid values is unchanged: helm template against the
chart defaults and against a full override set is byte-identical to 7.0.0,
and so is NOTES.txt. Hence a patch bump, appVersion untouched.
Fixes#16
All audit findings from #32 for the satisfactory chart in one major PR:
- StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service
to ...-service (standard scheme); template file satisfactory-server.sfs.yaml
renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name
(documented naming exception; renaming would orphan the data).
- Hardened, values-configurable security contexts (securityContext.pod /
securityContext.container): runAsNonRoot with the image's steam user
(uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs
mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make
the read-only root filesystem work; all other writes go to the PVC.
- Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults
exactly the previously hardcoded values.
- Additive env value rendered through tpl with value/secretKeyRef/
configMapKeyRef forms (template-chart pattern).
Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames +
hardening); appVersion unchanged.
jklein