2026-10-13 13:19:39 +02:00
1 changed files with 20 additions and 1 deletions
@@ -80,6 +80,24 @@ when this chart is publishing over an Ingress AND the list is non-empty. The
 mutual exclusion of the two modes is enforced once, in stalwart.httproute.yaml,
 and it is unconditional on mtaSts: a fail anywhere aborts the whole render.
 AND "not httpRoute.enabled" IS PART OF THAT GATE RATHER THAN REDUNDANT WITH
 IT. Without it this block's per-entry required() can fire while BOTH modes are
 on, and then the render reports "mtaSts.hosts[0] has no tlsSecretName, and in
 Ingress mode every entry needs one" - true, and the wrong diagnosis: the
 values file's defect is that both modes are on, and "in Ingress mode" is a
 claim about a configuration that is not coherent at all. Whoever met it would
 add a tlsSecretName, re-run, and reach the real message one round later, or
 conclude this feature was the problem. MEASURED on this chart before the gate
 was added, not reasoned about.
 Ordering is not the fix and could not be: Helm renders templates in an order a
 chart cannot pin, so this template may not assume the httproute template's
 structural abort runs first. SCOPE is the fix - with both modes on this block
 validates nothing, so the only fail left is the one that names the real
 problem. The generalisation (a specific validation must not be reachable in a
 state a structural validation already rejects) is the Lessons-Learned entry
 that the parallel keycloak round of Gitea #122 bought on its own realm list.
 WHAT THIS DELIBERATELY DOES NOT CARRY: ingress.annotations. Those belong to the
 WebUI/JMAP host - on the live installation they are its CORS configuration for
 the bulwark webmail - and a policy file served to sending MTAs has no use for
@@ -91,7 +109,8 @@ does not create a DOMAIN. Whether Stalwart answers for mta-sts.<domain> depends
 on <domain> existing in its data store, which is not in any chart value (see
 values.yaml, line 1 onwards, and the mtaSts block).
 */ -}}
-{{- if .Values.ingress.enabled }}
+{{- $httpRoute := .Values.httpRoute | default dict }}
 {{- if and .Values.ingress.enabled (not $httpRoute.enabled) }}
 {{- $mtaSts := fromYaml (include "stalwart.mtaSts.ingressGroups" .) }}
 {{- if $mtaSts.order }}
 {{- $group := include "stalwart.ingressNodeGroup" . }}