2 Commits

Include renames

Author	SHA1	Message	Date
jklein	33d7cedbab	feat: Gateway-API as an alternative to the Ingress in eight charts ... Group 1 of the #114 sweep: the charts that render exactly one Ingress object and set no behaviour-bearing nginx annotation - bentopdf, garage, patchmon, rallly, searxng, sure, urlaubsverwaltung, voucher-vault. Each gets the form the pilot (cyberchef, PR #115) fixed and template-chart carries: an httpRoute block (enabled/parentRefs/hostnames, off by default), a template rendering ONLY an HTTPRoute with parentRefs - no Gateway, no gatewayClassName, no Certificate, no implementation-specific policy object - render aborts on both modes at once (naming both value paths), on an empty parentRefs and on a missing hostname, empty hostnames meaning [ingress.domain], a schema entry closed against unknown keys with an open parentRef definition, and a NOTES.txt that names the active mode and what the mode costs. Minor, additive, defaults unchanged: `helm template` with each chart's CI values is byte-identical to origin/main for seven of the eight, and for sure identical in every rendered value (the diff is two YAML comment lines). Three findings that were not in the plan, each argued in the file it changes: sure derived RAILS_ASSUME_SSL/RAILS_FORCE_SSL from ingress.enabled alone. Gateway mode sets that false by construction while TLS is still terminated at the Gateway, so both flags would have gone false: insecure cookies, no HSTS, http:// links, with a Ready pod and a working UI as the only symptom. They now read sure.publishedOverTls (ingress.enabled OR httpRoute.enabled), which is ingress.enabled while httpRoute.enabled is false - hence still Minor. garage claimed, in its Ingress template and its schema, that nothing outside that template reads ingress.domain. The HTTPRoute reads it, so the claim now holds only while both modes are off. Corrected rather than left standing. garage also depends on an upload limit it does not set: its annotations comment tells the operator to set proxy-body-size: "0" because ingress-nginx truncates S3 uploads at 1 MB. proxy-body-size has no Gateway-API counterpart, so its Gateway-mode NOTES prints that the limit is the Gateway's. README's list of affected charts named five and now names garage as a sixth. clusterIssuer needed no change in any of the eight: its only required() sits inside the Ingress template behind ingress.enabled, the same no-op the pilot found. Annotation guidance that stops applying in Gateway mode moved into the Gateway branch of NOTES.txt for bentopdf (X-Robots-Tag) and searxng (forward-auth). CI: one render overlay per chart under ci/httproute/, so the assertion is not vacuum-green - ci/run-httproute-match-test.sh goes from 4 held assertions over 2 charts to 20 over 10. The install-test fixtures stay in Ingress mode: the install runs one configuration per chart, cyberchef already pays that price against the real Gateway-API CRDs, and for garage the Ingress is the only place its Service port is referenced by NAME. Not proven, by construction: that traffic flows. No Gateway controller runs in CI. Not run locally either: k3d, Docker, Trivy. Part of #114	2026-10-12 16:06:18 +00:00
jklein	e0541a0352	voucher-vault: add a NOTES.txt worth reading twice (6.1.0+up1.30.1) ... The notes print what an operator would otherwise have to dig out of the templates or out of the image, not a restatement of the values. The centrepiece is the secret inventory: the three OnePasswordItem CRs carry item paths only, so the field names each item must contain are decided in this chart and appear nowhere in 1Password. A missing field does not fail the install - the operator writes a Secret without that key and the pod stays in CreateContainerConfigError. The warnings are the ones this chart earns, all read out of the running image rather than assumed: - The first start against an empty database creates the superuser "admin" with a random password and prints it to stdout exactly once. With OIDC on, the app drops its password-change pages and the login form redirects to the provider by itself, so /admin/ is the documented way back in. - The probes send Host: 127.0.0.1, which is always in ALLOWED_HOSTS. A wrong ingress.domain is therefore invisible: probes pass, the rollout goes green, and every real request gets 400. - The entrypoint waits for Postgres in an nc loop with no timeout before opening the HTTP port, so a wrong database host produces no error at all - just a log that stops, until the startup probe budget runs out. - Celery worker and beat are started detached from the same entrypoint; uwsgi answers whether or not they survived, so a wrong redis-url costs the expiry notifications silently. - Every start runs makemigrations and migrate, and helm rollback does not reverse them. - Expiry notifications need a per-user Apprise URL, and the beat schedule is created only while an empty database is initialized. Conditional blocks cover the ingress and no-ingress access paths, the scaled-down state, the storage class, and the case where voucherVault.env has replaced the chart's full env list instead of extending it. The startup budget and the replica state are read through the chart's own helpers. No real domain appears anywhere; the one place an example is needed uses example.com. Minor bump, purely additive: a NOTES.txt changes no rendered object. Part of #43	2026-08-29 00:03:06 +02:00