{{- $replicas := include "apache-tika.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.tika.replicas) -}}
{{- /* effectiveResources, not resources: an erased "resources:" block falls back
       to the chart defaults in the Deployment (#99), so the notes must report the
       limits the release actually gets — and the heap figure below is derived from
       that same effective limit, not from the raw value. */ -}}
{{- $limits := (include "apache-tika.effectiveResources" .Values.tika.resources | fromYaml).limits | default dict -}}
{{- $memLimit := index $limits "memory" -}}
{{- $svc := printf "%s-%s-service" .Release.Name .Chart.Name -}}
Apache Tika {{ .Chart.AppVersion }} — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}.

ACCESS
  This chart creates no Ingress. The server is cluster-internal:

    http://{{ $svc }}.{{ .Release.Namespace }}.svc.cluster.local

  Mind the port. The Service listens on 80 and forwards to the container's
  9998, so consumers are configured without a port — e.g. paperless-ngx:

    PAPERLESS_TIKA_ENDPOINT: http://{{ $svc }}.{{ .Release.Namespace }}.svc.cluster.local

  To reach it from your machine:

    kubectl -n {{ .Release.Namespace }} port-forward svc/{{ $svc }} 9998:80
    curl http://localhost:9998/version
    curl http://localhost:9998/parsers

  /parsers lists every parser the running server actually has — the honest
  answer to "why did this file come back empty". This chart has no secrets
  and no volumes.
{{ if eq $replicas "0" }}
SCALED TO ZERO
  {{ if .Values.scaleDown }}scaleDown: true{{ else }}tika.replicas: 0{{ end }} — the deployment runs with replicas: 0. The Service
  keeps its ClusterIP but has no endpoints, so callers fail with "connection
  refused" rather than a timeout. Set it back and upgrade to return.
{{ end }}
NO AUTHENTICATION — AND IT PARSES WHATEVER IT IS SENT
  Tika has no authentication, and this chart adds none. It is a parser for
  untrusted input by nature, and its parsers have a long history of being the
  soft spot. Anything that can reach the Service can make this pod open a
  file. Keep it cluster-internal; do not put an Ingress in front of it.

THE IMAGE TAG HAS TO KEEP ITS -full SUFFIX
  appVersion is pinned to {{ .Chart.AppVersion }}. The "-full" variant is the one that
  ships Tesseract OCR (5.5.0, with the languages deu, eng, fra, ita, jpn, osd
  and spa) plus the extra parsers; the plain apache/tika:<version> image has
  no tesseract binary at all. Overriding the tag without "-full" does not fail
  loudly — OCR simply stops happening and scanned documents come back with
  empty text.
{{- if $memLimit }}

THE JVM ONLY GETS A QUARTER OF THE MEMORY LIMIT
  The server starts without -Xmx, so the JVM derives its maximum heap from the
  container limit at MaxRAMPercentage=25. With this release's limit of
  {{ $memLimit }} that is roughly {{ include "apache-tika.multiplyQuantity" (dict "quantity" $memLimit "factor" 0.25) }} of usable heap — the number to reason about when
  sizing, not the limit itself. Raising tika.resources.requests.memory raises
  the limit (limitFactor x request) and the heap along with it.
  Text extraction streams rather than buffering, so ordinary documents stay
  cheap regardless; the heap is what matters for parsers that have to build a
  whole document in memory, and for OCR.
{{- end }}
{{- if .Values.networkPolicy.enabled }}

NETWORKPOLICY IS ACTIVE — WHAT IT CAPS, AND WHAT IT DOES NOT
  {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy selects this workload's pods.
  Inbound: TCP 9998 only. Outbound: DNS{{ with .Values.networkPolicy.egress }}{{ with .extraPorts }} plus TCP {{ join ", " . }}{{ end }}{{ end }} — Tika is handed documents and
  fetches nothing.

  THIS CHART HAS NO INGRESS AND ITS CONSUMERS ARE OTHER PODS. While
  networkPolicy.probeSources is empty the 9998 rule has no source selector, so
  any pod in the cluster — including a paperless-ngx release in another
  namespace — reaches it. Narrowing probeSources restricts that rule, and the
  consumers' namespaces must then be listed in networkPolicy.allowedNamespaces
  in the same change, or document extraction stops with a connection error on
  the paperless side and nothing at all on this one.

  Three limits belong in the same breath, because none of them is visible in
  the object itself:

  - EGRESS IS BY PORT, NEVER BY DESTINATION. A NetworkPolicy matches CIDRs and
    selectors and cannot express a hostname, so every egress rule permits its
    port to ANY address. That is a limit of the object, not a shortcut — this
    cluster's CNI (Canal: Flannel plus Calico) has no FQDN rule either. An
    outbound port the chart does not know about is BLOCKED: add it to
    networkPolicy.egress.extraPorts, and expect to find out through an
    application-level connection error rather than through this object.
{{- if .Values.networkPolicy.probeSources }}
  - THE PROBE PATH IS RESTRICTED in this release, because
    networkPolicy.probeSources is set to
      {{ join ", " .Values.networkPolicy.probeSources }}
    Probes come from the IP of the WORKER NODE running the pod. If none of those
    CIDRs covers the node this pod lands on, the kubelet's probes are dropped
    and THE POD NEVER BECOMES READY — the rollout then times out and the symptom
    looks like a broken application. Compare

      kubectl -n {{ .Release.Namespace }} describe pod -l app={{ .Release.Name }}-{{ .Chart.Name }}-deployment

    against `kubectl get node -o wide`.
{{- else }}
  - THE PROBED PORT IS OPEN INSIDE THE CLUSTER. networkPolicy.probeSources is
    empty, so that rule carries no source selector at all and any pod the CNI
    routes to can reach it. Not from the internet — but this is NOT pod-level
    isolation. Narrowing it means listing the worker node IPs in
    networkPolicy.probeSources, because the kubelet probes from the node's own
    address and the chart cannot know it; a wrong guess there leaves the pod
    permanently un-Ready.
{{- end }}
  - IT IS ONLY A BOUNDARY WHERE THE CNI ENFORCES POLICIES. Where it does not,
    this object is accepted and filters nothing, so everything reads as
    configured while nothing is filtered. `kubectl -n {{ .Release.Namespace }} get networkpolicy`
    shows the object exists; only a connection attempt from an unrelated
    namespace shows that it bites.

  Switch it off with networkPolicy.enabled: false.
{{- end }}