3 Commits

Include renames

Author	SHA1	Message	Date
jklein	8074ed14a5	Guard the four unguarded OnePasswordItem references with required() ... calibre-web-automated 7.0.0, minecraft-server 6.0.0 and urlaubsverwaltung 10.0.0 each majors: an installation that renders today with an empty itemPath stops rendering. searxng 1.0.6 is documentation only - its valkey reference is correctly optional and stays gated by {{- if }}. Every message names the values path. values.yaml now says per key why it is required, reusing the wording the charts' NOTES.txt already carry. The hand-rolled "cwaSecretRef IS UNSET" block in calibre-web-automated's NOTES.txt is gone: after the guard the render aborts first and that block is unreachable. minecraft-server's note stays true and now points at the guard. No "required" array in the schemas, and README guideline 12 now says why. The plan called for one; measuring it showed it could never fire: the key ships as null, so it is present at validation time, and JSON Schema's required tests presence, not null-ness. Making it fire means either dropping the null default or narrowing the type to "string", and both turn helm lint --strict red on the chart's own defaults. The schema therefore describes the key as required and required() enforces it. The README bullet on how null reaches the schema was also wrong in the case it was being applied to - a null chart default is not coalesced away - and now distinguishes the three cases. searxng: the claim "charts in this repo have no dependencies (README, guideline 13)" in the valkey template, in values.yaml and twice in _helpers.tpl has been false since #214 and cited the wrong guideline; dependencies are admissible and are guideline 14. The same sentence survives in other charts' helpers and needs its own round.	2026-09-26 21:15:30 +00:00
jklein	f6de7ffa80	Calibre-Web-Automated chart: naming scheme, security hardening (conventions batch 3) ... All audit findings for the calibre-web-automated chart (#32) in one major bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6: - Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the inverted <chart>-<release>-cwa-<kind> scheme to <release>-<chart>-<kind>; spec.serviceName and all references follow. Both PVCs deliberately keep their historical names (documented naming exception; renaming would orphan the data). - TLS secret renamed to the standard tls-<release>-<chart>-ingress. - Ingress on the repo standard: ingress.className (default nginx), ingress.annotations merged with the chart-managed annotations, ingress.clusterIssuer now required (was silently defaulted to "letsencrypt-issuer"). - Security hardening, values-configurable via securityContext.pod / securityContext.container: allowPrivilegeEscalation false, all capabilities dropped except the minimal set the s6-overlay init needs (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented deviations: the image must start as root (s6 drops to PUID 1000) and readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID remapping upstream and breaks the ImageMagick policy setup). - Additive env value rendered through tpl (value / secretKeyRef / configMapKeyRef forms). - CI fixtures: secret renamed to the new scheme, clusterIssuer added to test-values. Part of #32.	2026-08-22 18:46:07 +02:00
jklein	14e4adc4c8	feat(charts): added calibre-web-automated	2026-02-19 14:42:39 +01:00