All audit findings for the calibre-web-automated chart (#32) in one major
bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6:
- Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the
inverted <chart>-<release>-cwa-<kind> scheme to
<release>-<chart>-<kind>; spec.serviceName and all references follow.
Both PVCs deliberately keep their historical names (documented naming
exception; renaming would orphan the data).
- TLS secret renamed to the standard tls-<release>-<chart>-ingress.
- Ingress on the repo standard: ingress.className (default nginx),
ingress.annotations merged with the chart-managed annotations,
ingress.clusterIssuer now required (was silently defaulted to
"letsencrypt-issuer").
- Security hardening, values-configurable via securityContext.pod /
securityContext.container: allowPrivilegeEscalation false, all
capabilities dropped except the minimal set the s6-overlay init needs
(CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented
deviations: the image must start as root (s6 drops to PUID 1000) and
readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID
remapping upstream and breaks the ImageMagick policy setup).
- Additive env value rendered through tpl (value / secretKeyRef /
configMapKeyRef forms).
- CI fixtures: secret renamed to the new scheme, clusterIssuer added to
test-values.
Part of #32.
New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.
Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.
Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).
All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.
jklein