All audit findings from #32 for the satisfactory chart in one major PR:
- StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service
to ...-service (standard scheme); template file satisfactory-server.sfs.yaml
renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name
(documented naming exception; renaming would orphan the data).
- Hardened, values-configurable security contexts (securityContext.pod /
securityContext.container): runAsNonRoot with the image's steam user
(uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs
mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make
the read-only root filesystem work; all other writes go to the PVC.
- Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults
exactly the previously hardcoded values.
- Additive env value rendered through tpl with value/secretKeyRef/
configMapKeyRef forms (template-chart pattern).
Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames +
hardening); appVersion unchanged.
Every Deployment/StatefulSet now takes its replica count from a replicas
value (default 1, explicit 0 allowed) via a new per-chart <chart>.replicas
helper; the helper uses a kindIs "invalid" nil check so an explicit 0 is
not swallowed by Helm's default function. A chart-global scaleDown flag
(default false) takes precedence: it renders every workload with
replicas: 0 and suspends the paperless-ngx consume CronJob, stopping the
app without uninstalling it (PVCs, Secrets, Services and Ingress remain).
Defaults leave the rendered manifests byte-identical to main, so all
published charts get a minor version bump; the template-chart carries the
reference helper implementation and stays unversioned.
Fixes#25
Every chart now renders its container resources through a duplicated
_helpers.tpl helper (reference implementation in template-chart): requests
ship as chart defaults, missing memory and ephemeral-storage limits are
computed as resources.limitFactor x the request (default 3, satisfactory
keeps 2 to preserve its previously published 8Gi limit), an explicitly set
limit always wins, and a CPU limit is only rendered when set explicitly.
Fixed limit defaults are removed from all values.yaml files; teamspeak-server
gains a values-driven resources block instead of hardcoded template values.
Major version bump for all published charts.
jklein