multiplyQuantity turned its input into a string with printf "%v". The
null-safe fallback helpers from #99 pass values through fromYaml, which
parses every number as float64, and Go's "%v" switches float64 to
exponential notation from about 1e6 upwards. A bare byte count like
1048576 therefore arrived as "1.048576e+06", the suffix check rejected
"e+06" and the render aborted.
The same printf sat on the second output path, for a non-integer product
(a fractional limitFactor - typed "number", not "integer", in this
chart's values.schema.json, so ordinary values reach it). That one never
passes the suffix check, so it produced an invalid quantity silently and
only the API server would have rejected the manifest on apply.
Both are now routed through a formatNumber helper that forces decimal
notation and trims the padding zeros. Strings ("512Mi") pass through
untouched, so the default render is unchanged - including the
checksum/config annotation over the settings.yml ConfigMap, which stays
at 619e1ac4 for the CI values and 25bd1479 for the chart defaults, so no
pod is rolled without reason.
Part of #157. The helper is a verbatim copy of the fix already merged for
template-chart, zipline, cyberchef and bentopdf - multiplyQuantity is the
same duplicated code in every chart.
The null-safe fallback helpers from #99 pass values through fromYaml, which
parses every number as float64. Go's "%v" switches float64 to exponential
notation from about 1e6 upwards, so a bare byte count like 1048576 reached
multiplyQuantity as "1.048576e+06" and the render aborted with
unsupported resource quantity suffix "e+06" in "1.048576e+06"
The same "%v" sits a second time on the output of a non-integral product,
where it never passes the suffix check — a fractional limitFactor together
with a bare number rendered a silently invalid quantity ("1.4999985e+06")
that only the API server rejects on apply.
Both call sites now go through a new patchmon.formatNumber helper, which
forces decimal notation for float64 and passes strings ("512Mi") through
untouched. This is the canonical fix agreed in #157, taken over verbatim
from template-chart with this chart's define prefix, so multiplyQuantity
stays the same copy in every chart.
Teil von #157.
The null-safe fallback helpers from #99 route values through fromYaml, which
parses every number as float64. Go's "%v" switches float64 to exponential
notation from about 1e6 upwards, so a bare byte count like 1048576 reached the
suffix check inside multiplyQuantity as "1.048576e+06" and the render aborted
with `unsupported resource quantity suffix "e+06"`.
Both printf "%v" sites in multiplyQuantity now go through a new formatNumber
helper that forces plain decimal notation and trims the padded zeros. The
second site is the quiet half of the bug: a fractional limitFactor together
with a bare number produced no error at all, just an invalid quantity such as
"1.4999985e+06" that only the API server rejects on apply. limitFactor is
typed "number" in this chart's values.schema.json, so a fractional factor is
an ordinary, schema-valid input.
All ten resource paths of the stack are affected and were verified one by one
(gluetun, qbittorrent and its configInit init container, prowlarr,
flaresolverr, radarr, recyclarr, sonarr, seerr, bazarr). The VPN, firewall and
container structure is untouched: rendering the chart with its default values
is byte-identical to main.
Teil von #157
The null-safe fallback helpers from #99 pass values through fromYaml, which
parses every number as float64. Go's "%v" switches float64 to exponential
notation from about 1e6 upwards, so a bare byte count like 1048576 turned into
"1.048576e+06" - not a valid Kubernetes quantity. multiplyQuantity then aborted
the render on its own suffix check. The second "%v", the one printing a
non-integer product, never reaches that check and rendered an invalid quantity
silently; only the API server rejects it on apply.
Both call sites now go through a new formatNumber helper that forces plain
decimal notation and passes strings ("512Mi") through untouched. The
fromYaml/toYaml round-trip is not touched: it was just unified across all
charts and it is not the cause.
gotenberg reaches multiplyQuantity from two places - the Deployment's
resources block and NOTES.txt, which reports the effective limits. With the
chart's default values both non-CPU resources carry an explicit limit, so no
limit is computed and neither site was affected in the default configuration.
Teil von #157
multiplyQuantity turned its input into a string with printf "%v". The
null-safe fallback helpers from #99 pass values through fromYaml, which
parses every number as float64, and Go's "%v" switches float64 to
exponential notation from about 1e6 upwards. A bare byte count like
1048576 therefore arrived as "1.048576e+06", the suffix check rejected
"e+06" and the render aborted.
The same printf sat on the second output path, for a non-integer product
(a fractional limitFactor - typed "number", not "integer", in this
chart's values.schema.json, so ordinary values reach it). That one never
passes the suffix check, so it produced an invalid quantity silently and
only the API server would have rejected the manifest on apply.
Both are now routed through a formatNumber helper that forces decimal
notation and trims the padding zeros. Strings ("512Mi") pass through
untouched, so the default render is unchanged.
Part of #157. The helper is a verbatim copy of the fix already merged
for template-chart, zipline, voucher-vault and outline - multiplyQuantity
is the same duplicated code in every chart.
multiplyQuantity turned its input into a string with printf "%v". The null-safe fallback helpers from #99 route values through fromYaml, which parses every number as float64, and Go switches float64 to exponential notation from about 1e6 upwards. A bare byte count like 1048576 became "1.048576e+06" and the suffix check aborted the render.
The non-integer product used the same printf "%v" on output. That path never reaches the suffix check, so it rendered an invalid quantity silently, which only the API server rejects on apply. cyberchef types limitFactor as "number", so a fractional factor is allowed by the schema and that path is reachable with ordinary values.
Both call sites now go through a new formatNumber helper that forces decimal notation and trims the padding zeros; strings such as "512Mi" pass through untouched. Round-trip and resources helper are unchanged. The wording matches the canonical fix already merged for template-chart and the other charts, so the shared copy stays free of drift.
Teil von #157 und Teil von #43.
#157: multiplyQuantity turned its input into a string with printf "%v". The
null-safe fallback helpers from #99 route values through fromYaml, which
parses every number as float64, and Go switches float64 to exponential
notation from about 1e6 upwards. A request of 1048576 therefore reached the
suffix check as "1.048576e+06" and aborted the render. The second printf
"%v", the one that prints a non-integer product, never reaches that check at
all: with a fractional limitFactor it wrote an invalid quantity into the
manifest without a word. Both sites now go through the canonical
teamspeak-server.formatNumber helper, identical to the other charts.
Note for this chart: values.schema.json types resources.limitFactor as
"number", not "integer", so the silent path is reachable with ordinary
values rather than only with --set-json.
#43: adds templates/NOTES.txt. teamspeak-server is a NodePort service with
no Ingress and no secrets at all, so the notes cover what is actually worth
looking up. Measured against the pinned image 6.0.0-beta12.1 rather than
taken from upstream docs: the first start prints a ServerAdmin privilege key
and ServerQuery credentials exactly once, and only the privilege key is
recoverable afterwards from the log files on the data volume; TSSERVER_
DEFAULT_PORT is read only when the virtual server is created, so changing
server.voicePort on an existing release moves the Service, the nodePort and
the containerPort while the server keeps answering on the old port, with all
three probes staying green because they only ever TCP-connect to the file
transfer port; TSSERVER_FILE_TRANSFER_PORT, by contrast, applies on every
start; the bundled license runs 2026-07-01 to 2026-10-01 with one virtual
server and 32 slots; and no query port listens at all, which leaves the
declared web-query container port 10080 bound by nothing.
Minor bump: additive, appVersion unchanged.
The null-safe fallback helpers from #99 pass values through fromYaml, which
goes over JSON and therefore parses every number as float64. Go's "%v"
switches float64 to exponential notation from about 1e6 upwards, so a bare
byte count like 1048576 reached multiplyQuantity as "1.048576e+06" and the
suffix check aborted the render:
unsupported resource quantity suffix "e+06" in "1.048576e+06"
The second "%v" — the output of a non-integer product — never reaches that
check, so it produced an invalid quantity without any abort. In this chart
that value is caught one step later by NOTES.txt, which feeds the computed
memory limit back into multiplyQuantity: the Deployment still carried
memory: "1.4999985e+06" and the error pointed at NOTES.txt:54 instead of the
real cause.
Both places now go through a new formatNumber helper, which forces decimal
notation via "%.10f" and trims the padded zeros again; strings such as
"512Mi" pass through untouched. This is the canonical fix from #157, taken
over verbatim with this chart's prefix, because multiplyQuantity is the same
copy in every chart.
Chart defaults render unchanged. Patch bump: bug fix only, no behavior and no
values-schema change; appVersion stays.
Teil von #157 und Teil von #43.
#157: multiplyQuantity turned a bare byte count into exponential notation.
The null-safe fallback helpers pass values through fromYaml, which parses
every number as float64, and Go's "%v" switches float64 to exponential
notation from about 1e6 upwards. A request of 1048576 became
"1.048576e+06" and the render aborted on the suffix check.
Both printf "%v" sites are replaced by the canonical satisfactory.formatNumber
helper: the input of multiplyQuantity and the output of a non-integer product.
The second one never reached the suffix check, so it did not abort - it
rendered a silently invalid quantity that only the API server would reject.
#43: adds templates/NOTES.txt. The chart has no Ingress and no secrets, so
the notes cover what an operator would otherwise read out of the templates:
the NodePort a player actually dials and the pinned-port collision between
two releases, the 20-minute Steam download budget and that SKIPUPDATE is
false on every start, what a green pod does and does not prove (no probe
ever touches the UDP game port), that saves and game files share one PVC on
a hardcoded longhorn class which helm uninstall deletes, the emptyDirs
counting against the ephemeral-storage limit, the deliberate limitFactor 2
and fsGroupChangePolicy OnRootMismatch, and that game.seasonalEvents is
passed through to DISABLESEASONALEVENTS uninverted.
No rendered Kubernetes object changes, so the bump is minor; appVersion
stays v1.9.10.
Teil von #157 und Teil von #43.
#157: multiplyQuantity turned a bare byte count into exponential notation.
Values pass through fromYaml, which parses every number as float64, and Go's
"%v" switches float64 to exponential notation from about 1e6 upwards. Both
places that stringify a number now go through the new formatNumber helper -
the input of multiplyQuantity, which aborted the render with an unsupported
suffix "e+06", and the output of a non-integer product, which did not abort
at all but rendered an invalid quantity that only the API server rejects.
Measured on this chart against ci/urlaubsverwaltung/test-values.yaml:
requests.memory=1048576 before: abort, suffix "e+06"
after: request 1048576, limit "3145728"
requests.ephemeralStorage=2097152 before: abort, suffix "e+06"
after: limit "6291456"
memory=999999, limitFactor=1.5 before: limit "1.4999985e+06", no abort
after: limit "1499998.5"
requests.memory=65536 (regression) 196608 before and after
The correction is the canonical one, word for word as merged into
template-chart, voucher-vault and zipline; only the helper prefix differs.
urlaubsverwaltung has a single resources path and a single render site
(the Deployment), and both were verified.
#43: adds a NOTES.txt. Its content was verified against a running release in
a throwaway k3d cluster rather than taken from upstream documentation - the
identity provider being resolved at boot (a bad issuer-uri crashlooops the
pod instead of breaking the login), the buildpack sizing the JVM heap from
the computed memory limit, /actuator/health answering 503 for the lifetime of
the release because the chart points the mail sender at localhost:1025, the
probe groups not reacting to a database outage, and a name collision in
urlaubsverwaltung.env making the next helm upgrade fail on the patch order.
README.md is deliberately untouched: the line listing the charts that ship a
NOTES.txt collides with every parallel NOTES PR and is pulled up once at the
end of the programme.
Minor bump: a NOTES.txt renders no Kubernetes object and the quantity fix
changes no default. appVersion unchanged.
Teil von #157 and Teil von #43, in one change because both are additive and
neither moves a rendered object.
#157 - multiplyQuantity turned large numbers into exponential notation. The
null-safe fallback helpers pass values through fromYaml, which parses every
number as float64, and Go's "%v" switches float64 to exponential notation from
about 1e6 upwards. A bare byte count like 1048576 became "1.048576e+06".
The chart has two affected positions, and they fail differently:
- the entry of multiplyQuantity aborts the render loudly, because the
exponent is caught by the suffix check
(unsupported resource quantity suffix "e+06").
- the output of a non-integer product never reaches that check and renders
silently: a fractional limitFactor together with a bare number produced
"1.4999985e+06" in the manifest, rejected only later by the API server.
Note that this chart's schema types limitFactor as "number" with
exclusiveMinimum 0, not as an integer, so the silent path is reachable here
through ordinary values.
Both positions now go through a new minecraft-server.formatNumber helper, the
canonical correction already applied to template-chart, voucher-vault, zipline,
outline and minecraft-router.
#43 - NOTES.txt for this chart. It prints what an operator would otherwise have
to read out of the templates, conditional on the values actually set:
- access, which is not a URL: ClusterIP means the server is reachable only
once its Service name is entered in the minecraft-router release's static
mappings, since that router does no auto-discovery; NodePort prints the
node port and warns when it falls outside 30000-32767.
- the Java line, derived from appVersion rather than written into the file,
so it holds for all three published lines, together with the fact that
nothing checks minecraft.version against it.
- what a green rollout does not prove. The probes do run a real server-list
ping, so Ready means the server answers - but a ping is answered before any
login, so every login-side refusal is invisible to all three probes. The
whitelist is the practical case: enabled without players locks everyone out
while the rollout stays green.
- which fields the 1Password item must carry, listed only for the features
actually enabled, plus the documented gap that a changed item content does
not roll the pod.
- the world PVC that helm uninstall deletes, the two memory numbers and how
they decouple, RCON not being published by the Service, the declared but
unserved metrics port, and the enabled modpack source.
No real domain anywhere; the router example uses mc.example.com.
Verified: helm lint --strict clean on all three Java lines; rendering the CI
values and the chart defaults is byte-identical to origin/main, so no
Kubernetes object changes and the minor bump is the right one.
Teil von #157 und Teil von #43.
#157: multiplyQuantity turned its input into a string with printf "%v".
The null-safe fallback helpers from #99 route values through fromYaml, which
parses every number as float64, and Go switches float64 to exponential
notation from about 1e6 upwards. A request of 1048576 therefore reached the
suffix check as "1.048576e+06" and aborted the render. The second printf
"%v", the one that prints a non-integer product, never reaches that check at
all: with a fractional limitFactor it wrote an invalid quantity into the
manifest without a word. Both sites now go through the canonical
samba.formatNumber helper, identical to the other charts.
#43: adds templates/NOTES.txt. samba is a NodePort service, not a web app,
so the notes cover the SMB access path per client, the SMB3/encryption
requirements the chart pins in smb.conf, the users.conf field the 1Password
item must carry, that a restart drops every open SMB session, and that the
share PVCs are deleted by helm uninstall and re-created empty on a rename.
Minor bump: additive, appVersion unchanged.
Teil von #157: multiplyQuantity turned every number from the null-safe
fallback helpers into a float64 via fromYaml, and Go's "%v" switches
float64 to exponential notation from about 1e6 upwards. A bare byte count
like 1048576 became "1.048576e+06": the integer path aborted the render
on the suffix check, while the non-integer path (a fractional limitFactor)
rendered the invalid quantity silently and only failed at the API server.
Both string conversions now go through the canonical formatNumber helper,
identical to the fix already merged for template-chart, voucher-vault and
zipline.
Teil von #43: adds a NOTES.txt. minecraft-router has no Ingress and no
URL, so the notes name the actual way in - the NodePort Service and the
fact that the routing decision is made on the hostname from the Minecraft
handshake - print the effective routing table, and state the traps: the
nodePort outside the default range, mappings as the only source of routes
(no Kubernetes auto-discovery in this chart), the restart a routing change
costs, that a Ready router says nothing about any backend, and that API
writes do not survive a restart. Conditional blocks for the out-of-range
nodePort, scale-to-zero, more than one replica and server.env.
No production domain anywhere; examples use example.com and
cluster-internal names. Minor bump, appVersion unchanged.
Two additive changes, neither of which alters a rendered object.
NOTES.txt (Teil von #43): prints what an operator would otherwise have to
read out of the templates - the rendered access URL or the port-forward
command, the field the 1Password item must carry (homeserver.yaml) plus the
four settings inside that file which this chart's mounts dictate, and the
chart's own traps: the split between matrix.delegation.serverUrl and
ingress.domain, the immutable server name, that a changed 1Password item does
not restart the StatefulSet while the delegation nginx does roll on a config
change, and that the PVC with signing key and media is deleted with the
release. Conditional on the values actually set: Ingress on/off, delegation
on/off, either workload scaled to zero, more than one Synapse replica, and a
matrix.env that is set. No real domain anywhere; the URLs render from the
values.
_helpers.tpl (Teil von #157): the canonical formatNumber helper, taken over
unchanged from template-chart. multiplyQuantity turned its input into a string
with printf "%v"; values that came back from fromYaml as float64 switched to
exponential notation from about 1e6 upwards, so a bare byte count like 1048576
became "1.048576e+06" and the render aborted. Both resource paths of this
chart were affected - matrix.resources in the StatefulSet and
matrix.delegation.resources in the delegation Deployment.
Minor bump, appVersion unchanged.
Two additive changes, no rendered Kubernetes object changes except the
resource limits that previously aborted the render.
#157 — a bare integer resource value from about 1e6 upwards aborted the
render. The null-safe fallbacks pass values through fromYaml, which parses
every number as float64, and Go's "%v" switches float64 to exponential
notation from that size on: 1048576 became "1.048576e+06", which is not a
valid Kubernetes quantity. The canonical correction from the issue is taken
over verbatim: multiplyQuantity formats its input and its non-integer product
through a new formatNumber helper instead of "%v". The toYaml/fromYaml round
trip is not touched — it was just unified across all charts and it is not the
cause.
This chart has two resource paths and both were affected: paperless.resources
(sfs) and smbConnection.cron.resources (consume CronJob). Measured on both
before and after, plus the 65536 fallback probe, which is unchanged.
#43 — NOTES.txt. Prints what an operator would otherwise read out of the
templates: the rendered URL and that ingress.domain also becomes PAPERLESS_URL,
the field names each 1Password item must carry (including that the database
field is "server" and that "username" is used as both admin login and admin
mail), and that secrets.oidcSecretRef is read by no template at all. The
conditional sections cover the SMB consume strecke, scaleDown, OIDC, Tika and
the barcode settings actually in effect. The traps it names are the ones this
chart really has: no checksum annotation anywhere, so rotating an item's
content restarts nothing; Redis failing silently while the UI stays green; the
600s startup budget against migrations and the 3.x index rebuild; the consume
PVC being hardcoded to 1Gi; the CronJob moving only top-level *.pdf and having
no probes (the documented exception); and a cron schedule starting with "*"
aborting the render.
README is deliberately left alone: the line listing the charts with a NOTES.txt
is pulled up once at the end of the programme, so that parallel NOTES PRs do
not collide on it.
Teil von #157
Teil von #43
Prints what an operator would otherwise dig out of the templates: the rendered
access URL or the concrete port-forward, the fields the 1Password item has to
carry, and the traps of this chart in particular - the public default login,
the ingest folder that deletes what it imports, the fixed 1Gi ingest claim,
the one shared library claim, and why a change inside the 1Password item rolls
nothing (subPath mounts included).
Conditional on the values that actually decide something: ingress on/off,
scaled to zero, an unset secret ref, and extra env entries.
Part of #43.
The null-safe fallback helpers from #99 pass values through fromYaml, which
parses every number as float64. Go's "%v" switches float64 to exponential
notation from about 1e6 upwards, so a bare byte count like 1048576 reached
multiplyQuantity as "1.048576e+06" and the render aborted on the suffix check.
Route both the helper's input and its non-integral product through a new
formatNumber helper, which forces decimal notation and trims the padding
zeros again. Strings such as "512Mi" pass through untouched.
Part of #157.
Two additive changes in one release.
multiplyQuantity turned a bare integer resource value of about 1e6 or more
into exponential notation and aborted the render with "unsupported resource
quantity suffix \"e+06\"". The null-safe helpers from #99 pass values through
fromYaml, which parses every number as float64, and Go's "%v" switches those
to exponential form. The new rallly.formatNumber helper forces plain decimal
notation on both the input and the non-integer product; it is the same wording
already merged into template-chart, zipline and voucher-vault.
The NOTES.txt prints what an operator would otherwise have to read out of the
templates: the rendered access URL or the port-forward command, the fields each
1Password item has to carry, the OIDC redirect URI, and the traps of this chart
- OIDC is the only way in because email login and registration are hard-coded
off, a rotated 1Password item does not restart the pods, the probes only prove
that the web process answers, and the Next.js cache emptyDir counts against the
container's ephemeral-storage limit.
Part of #157
Part of #43
Part of #157: multiplyQuantity turned a bare integer resource value into
exponential notation and aborted the render. The null-safe helpers pass
values through fromYaml, which makes every number a float64, and Go's "%v"
switches float64 to exponential form from about 1e6 upwards - so
"1048576" arrived as "1.048576e+06" and the suffix check failed. A new
outline.formatNumber helper renders such a value as a plain decimal
string; it is applied to the input and to the non-integer product. This is
the canonical fix agreed for the issue, taken over unchanged so the copies
of the helper in all charts stay identical.
Part of #43: the chart gets a NOTES.txt. It renders the access URL (or the
port-forward command when the Ingress is off), lists the fields each of the
three 1Password items has to carry plus the OIDC redirect URI, and states
the traps that are otherwise found the hard way: editing a value inside a
1Password item restarts nothing, Postgres and Redis are external and
unencrypted by default, migrations run inside the startup probe's budget,
uploads sit on a single RWO volume that helm uninstall takes with it, the
Ingress body-size limit is ten times smaller than the app's, and the chart
configures no mail at all.
Minor bump: the fix changes no rendered output for any value the schema
accepted before, and a NOTES.txt renders no object.
Part of #43 — templates/NOTES.txt.
The rule from the approved plan was that a NOTES.txt repeating the values is
worthless, so this one prints what an operator would otherwise look up in the
templates: the rendered URL (or the port-forward command when the Ingress is
off, plus the reason ingress.domain stays required — it is
CORE_DEFAULT_DOMAIN), the two op:// refs together with the exact field names
the 1Password items must carry ("connection-url" and "server-secret", because
the operator names the Secret keys after the item's fields), and the traps of
this chart: the setup page hands the super administrator to whoever reaches
the URL first, migrations run inside the startup probe's window (computed
from the effective probe values), a database outage leaves the pod running
and NotReady because liveness deliberately uses "/", the upload ceiling that
actually bites is the Ingress annotation and not the app's fixed 500mb, /tmp
is an emptyDir counted against the ephemeral-storage limit (computed) so an
oversized upload evicts the pod, and the uploads PVC is an ordinary release
resource that "helm uninstall" deletes. Conditional sections cover scaleDown
/ replicas: 0, more than one replica against the single ReadWriteOnce claim,
and a set zipline.env. No domain is baked into the chart; every host is
rendered from the values, examples use example.com.
Part of #157 — multiplyQuantity.
The null-safe fallbacks pass values through fromYaml, which parses every
number as float64, and Go's "%v" switches float64 to exponential notation
from about 1e6 upwards: a bare "1048576" arrived as "1.048576e+06" and the
render aborted on the suffix check. This is the canonical correction agreed
for all charts, taken over verbatim with this chart's prefix — the input and
the non-integer product now go through a formatNumber helper, and the
toYaml/fromYaml round trip is not touched, since it is not the cause.
Measured against ci/zipline/test-values.yaml on the chart's only resources
path, zipline.resources: before, both requests.memory=1048576 and
requests.ephemeralStorage=1048576 aborted with
unsupported resource quantity suffix "e+06" in "1.048576e+06"
after, they render with the limits "3145728", while the 65536 fallback probe
still yields 196608 unchanged. Rendered manifests are byte-identical to the
previous version for the default values.
The notes print what an operator would otherwise have to dig out of the
templates or out of the image, not a restatement of the values.
The centrepiece is the secret inventory: the three OnePasswordItem CRs
carry item paths only, so the field names each item must contain are
decided in this chart and appear nowhere in 1Password. A missing field
does not fail the install - the operator writes a Secret without that key
and the pod stays in CreateContainerConfigError.
The warnings are the ones this chart earns, all read out of the running
image rather than assumed:
- The first start against an empty database creates the superuser "admin"
with a random password and prints it to stdout exactly once. With OIDC
on, the app drops its password-change pages and the login form redirects
to the provider by itself, so /admin/ is the documented way back in.
- The probes send Host: 127.0.0.1, which is always in ALLOWED_HOSTS. A
wrong ingress.domain is therefore invisible: probes pass, the rollout
goes green, and every real request gets 400.
- The entrypoint waits for Postgres in an nc loop with no timeout before
opening the HTTP port, so a wrong database host produces no error at all
- just a log that stops, until the startup probe budget runs out.
- Celery worker and beat are started detached from the same entrypoint;
uwsgi answers whether or not they survived, so a wrong redis-url costs
the expiry notifications silently.
- Every start runs makemigrations and migrate, and helm rollback does not
reverse them.
- Expiry notifications need a per-user Apprise URL, and the beat schedule
is created only while an empty database is initialized.
Conditional blocks cover the ingress and no-ingress access paths, the
scaled-down state, the storage class, and the case where voucherVault.env
has replaced the chart's full env list instead of extending it. The
startup budget and the replica state are read through the chart's own
helpers. No real domain appears anywhere; the one place an example is
needed uses example.com.
Minor bump, purely additive: a NOTES.txt changes no rendered object.
Part of #43
The null-safe fallback helpers pass values through fromYaml, which parses
every number as float64. Go's "%v" switches float64 to exponential
notation from about 1e6 upwards, so a bare byte count like 1048576 reached
multiplyQuantity as "1.048576e+06" and the render aborted with
unsupported resource quantity suffix "e+06" in "1.048576e+06"
Both the input and the non-integer product now go through a formatNumber
helper that forces decimal notation and trims the padding zeros; strings
such as 512Mi pass through untouched. This is the canonical fix agreed for
all charts - multiplyQuantity is the same copy everywhere, so deviating
here would create drift instead of a solution.
Measured against ci/voucher-vault/test-values.yaml on both request keys
that get a computed limit (memory, ephemeral-storage): 1048576 renders a
limit of "3145728" instead of aborting, and the fallback case 65536 is
unchanged at 196608.
Part of #157
Two changes to the reference implementation, both of which every chart copied from it inherits.
Render fix (part of #157): multiplyQuantity turned its input into a string with printf "%v". The null-safe fallback helpers pass values through fromYaml, which parses every number as float64, and Go's "%v" switches float64 to exponential notation from about 1e6 upwards - so a bare byte count like 1048576 arrived as "1.048576e+06" and the suffix check aborted the render. A new xxx.formatNumber helper forces plain decimal notation on both the input and the non-integer product; strings like "512Mi" pass through untouched. This is the canonical fix agreed for the issue, taken over verbatim, because multiplyQuantity is the same copy in every chart and a private variant would create drift instead of a solution. The toYaml/fromYaml round-trip is deliberately not touched: it is not the cause.
NOTES.txt (part of #43): the scaffold now carries the reference NOTES.txt - a placeholder-carrying template, not finished prose. It renders the access URL from ingress.domain (no real domain anywhere), names which fields the 1Password item must carry, and prints the chart's traps: the placeholder image, the fact that both a Deployment and a StatefulSet render, and that no checksum/secret-ref means a secret change restarts nothing here. Output is conditional on the values actually set.
appVersion unchanged; minor bump because both changes are additive.
BentoPDF computes entirely in the visitor's browser; the container only serves
static files through nginx. The chart is therefore close to cyberchef - same
nginx-unprivileged base, uid 101, port 8080, probes on "/" - with four
differences that shaped the design.
Runtime config.json. The one setting reachable at runtime is the tool list.
It is a static file in the middle of the web root, so it is mounted by
subPath: a directory mount would hide the whole application. subPath mounts
are never refreshed by the kubelet, which makes the checksum/config annotation
(#82) load-bearing rather than decorative. bentopdf.config is passed through
verbatim, like searxng's settings, so a key upstream adds tomorrow is a values
change and not a chart change.
Three env switches that would kill the pod. PORT, DISABLE_IPV6 and
ROBOTS_NOINDEX are implemented as "sed -i" against files in the image, run
under "set -e" in /docker-entrypoint.d/, and the base image's entrypoint
aborts when one of them fails. With readOnlyRootFilesystem: true the pod
therefore never starts instead of ignoring the switch - measured in k3d as
CrashLoopBackOff, exit 1, "sed: can't create temp file
'/etc/nginx/nginx.confXXXXXX': Read-only file system". None of the three is
offered as a first-class value; values.yaml names the failure picture and the
escape hatch (env block plus readOnlyRootFilesystem: false).
Writable paths were measured, not copied from the upstream chart.
/etc/nginx/tmp holds the pid file and /var/cache/nginx is where nginx creates
its temp directories at startup - without it the master aborts with
'mkdir() "/var/cache/nginx/client_temp" failed'. /var/run is deliberately not
mounted: the running pod proves it is unnecessary.
Everything else about BentoPDF is a build-time argument and out of reach for
any chart; values.yaml says so explicitly rather than leaving it to be
discovered. Two accepted consequences are named there too: some tools fetch
WASM modules from a public CDN at runtime, and the served pages carry a
canonical link to the vendor's site.
Fixes#174
The comment on the probe block said a probe on "/" would "risk" a 429 once
the limiter is on. It was measured against a reachable Valkey in k3d and it
does not risk it, it collects one: "/" answered 429 while /healthz answered
200. Comment only, no rendered change.
SearXNG as a stateless Deployment plus a settings ConfigMap, with the four CI
steps a new chart needs: publish workflow, change-app-version choice list,
ci/searxng/ fixtures and a renovate.json5 block.
Three points where the chart is not a cyberchef with another name:
* The image entrypoint writes settings.yml into /etc/searxng only when the
file is missing. The chart always mounts one by subPath, so the copy and
the random-secret sed never run and the container needs no write access
there - which is what allows readOnlyRootFilesystem: true.
* The signing key is a required OnePasswordItem, not a ConfigMap key. It
signs the settings cookie and the image-proxy URLs, and the entrypoint's
self-generating fallback cannot fire here, so without it the instance would
run on the literal "ultrasecretkey" - which webapp.py refuses with exit 1.
* All three probes use /healthz, the only path the bot detection lets through
unconditionally. Measured: with the limiter active, "/" answers 429 while
/healthz still answers 200.
ingress.domain is read a second time outside the Ingress template, for
SEARXNG_BASE_URL, and carries its own required() there - so it stays
mandatory with the Ingress switched off.
The Renovate versioning regex deviates from the plan on the issue and matches
the commit hash WITHOUT capturing it. Renovate parses a "build" group with
Number.parseInt, so a hash becomes the digits leading it; measured on
renovate 41.173.1 and 44.48.0, the planned form reports an image pushed
earlier the same day as an update to a newer one. Reasoning in the block and
in README.
The failure path prints container logs, and an app may print a value it was
given - gluetun logs its Wireguard address on startup. diagnose() now runs
through a filter that replaces the values of the declared REQUIRED_ENV
variables with the variable name. GitHub masks them as well, but that is the
platform's promise rather than this harness's, and the script runs locally too,
where nothing masks anything.
jklein
JK-Helper [BOT]