helm-charts/sure/values.schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "title": "sure values",
  "description": "Strict values schema (issue #68): additionalProperties is false on every chart-owned object level, so a key the chart does not read is rejected at render time instead of being silently ignored. The objects that go verbatim into the Kubernetes pod spec (probes, security contexts, global, free-form annotations) stay open, because the chart does not interpret their contents. The hardening, probe and resources blocks additionally accept null - the chart's null-safe helpers then fall back to ITS defaults (issue #99). The schema adds to required(), it does not replace it.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "global": {
      "description": "Helm's conventional cross-chart values. Unused by this chart, kept open so an umbrella install cannot break on it.",
      "type": "object"
    },
    "scaleDown": {
      "type": "boolean"
    },
    "secrets": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "appSecretRef": {
          "description": "op:// item path of the app secret. Field: secret-key-base (SECRET_KEY_BASE).",
          "type": ["string", "null"]
        },
        "dbSecretRef": {
          "description": "op:// item path of the PostgreSQL credentials. Fields: host, port, database, username, password.",
          "type": ["string", "null"]
        },
        "redisSecretRef": {
          "description": "op:// item path of the Redis connection. Field: connection-url (REDIS_URL).",
          "type": ["string", "null"]
        }
      }
    },
    "sure": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "replicas": {
          "description": "Replicas of the StatefulSet; both containers scale with it, because they share one ReadWriteOnce PVC.",
          "type": "integer",
          "minimum": 0
        },
        "securityContext": {
          "description": "Pod-level hardening, shared by both containers. May be null / empty: the chart then falls back to ITS defaults (uid/gid 1000, matching the image's USER 1000:1000) instead of rendering an unhardened pod.",
          "type": ["object", "null"],
          "additionalProperties": false,
          "properties": {
            "pod": {
              "description": "Merged onto the chart's pod hardening defaults and rendered as the pod's securityContext; kept open because the chart does not interpret the individual fields.",
              "type": ["object", "null"]
            }
          }
        },
        "web": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "securityContext": {
              "$ref": "#/definitions/containerSecurityContext"
            },
            "resources": {
              "$ref": "#/definitions/resources"
            },
            "livenessProbe": {
              "$ref": "#/definitions/probe"
            },
            "readinessProbe": {
              "$ref": "#/definitions/probe"
            },
            "startupProbe": {
              "$ref": "#/definitions/probe"
            },
            "env": {
              "$ref": "#/definitions/env"
            }
          }
        },
        "worker": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "securityContext": {
              "$ref": "#/definitions/containerSecurityContext"
            },
            "resources": {
              "$ref": "#/definitions/resources"
            },
            "livenessProbe": {
              "$ref": "#/definitions/probe"
            },
            "readinessProbe": {
              "$ref": "#/definitions/probe"
            },
            "startupProbe": {
              "$ref": "#/definitions/probe"
            },
            "env": {
              "$ref": "#/definitions/env"
            }
          }
        }
      }
    },
    "storage": {
      "description": "The Active Storage PVC, mounted at /rails/storage in both containers. Deliberately NOT null-safe: an erased block yields an invalid PVC, which fails loudly.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "amount": {
          "type": ["string", "null"]
        },
        "storageClass": {
          "type": ["string", "null"]
        }
      }
    },
    "ingress": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "enabled": {
          "description": "Gates the Ingress template (issue #93). Mutually exclusive with httpRoute.enabled - the render aborts when both are true. It does NOT free ingress.domain: that value is also read for APP_DOMAIN, WEBAUTHN_RP_ID and WEBAUTHN_ALLOWED_ORIGINS and keeps its own required() there (guideline 12.1). Since Gitea #114 it no longer decides the TLS flags on its own either: RAILS_ASSUME_SSL/RAILS_FORCE_SSL follow ingress.enabled OR httpRoute.enabled, because in Gateway mode TLS is terminated at the Gateway while this value is false by construction.",
          "type": "boolean"
        },
        "clusterIssuer": {
          "type": ["string", "null"]
        },
        "domain": {
          "type": ["string", "null"]
        },
        "className": {
          "type": ["string", "null"]
        },
        "annotations": {
          "description": "Extra Ingress annotations, merged with the cert-manager annotation the chart always sets. Free-form keys by nature, so this object stays open. No counterpart in Gateway mode: the Gateway API has no annotation channel, so these are gone when httpRoute.enabled is used instead.",
          "type": "object"
        }
      }
    },
    "httpRoute": {
      "description": "Gateway-API alternative to the Ingress (Gitea #114). Mutually exclusive with ingress.enabled - the render aborts when both are true. The chart renders only an HTTPRoute with parentRefs; class and certificate sit on the Gateway and belong to the platform. The Gateway-API CRDs must be present in the cluster, because the chart cannot detect them. This value also feeds RAILS_ASSUME_SSL/RAILS_FORCE_SSL - see ingress.enabled.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "parentRefs": {
          "description": "The Gateway(s) the route attaches to. Required while httpRoute.enabled is true, enforced by required()-equivalent in the template (an empty list aborts the render) - a JSON Schema \"required\" cannot do it, because the key ships as an empty list and is therefore present. Entries are the Gateway API's ParentReference and are passed through unchanged.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/parentRef"
          }
        },
        "hostnames": {
          "description": "Empty means [ingress.domain], so the hostname has a single source of truth. A hostname set here does not move WEBAUTHN_RP_ID, APP_DOMAIN or WEBAUTHN_ALLOWED_ORIGINS, which keep following ingress.domain - and changing the relying party id invalidates every registered passkey.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    }
  },
  "definitions": {
    "parentRef": {
      "description": "A Gateway API ParentReference, passed verbatim into HTTPRoute.spec.parentRefs. Deliberately left OPEN (no additionalProperties: false), for the same reason probes and security contexts are: Kubernetes owns this schema, the Gateway API adds fields to it across releases, and a closed list here would reject a field only upstream knows about. What the chart can assert is that \"name\" is there - it is required by the API and a reference without it attaches to nothing, which is the silent failure this chart aborts the render over.",
      "type": "object",
      "required": ["name"]
    },
    "resources": {
      "description": "May be null / empty: the chart then falls back to its default requests and computed limits (issue #99) instead of rendering a container without resource accounting.",
      "type": ["object", "null"],
      "additionalProperties": false,
      "properties": {
        "limitFactor": {
          "type": "number",
          "exclusiveMinimum": 0
        },
        "requests": {
          "$ref": "#/definitions/resourceList"
        },
        "limits": {
          "$ref": "#/definitions/resourceList"
        }
      }
    },
    "resourceList": {
      "description": "Both spellings of the ephemeral-storage key are accepted because the resources helper normalizes camelCase to the Kubernetes key.",
      "type": ["object", "null"],
      "additionalProperties": false,
      "properties": {
        "cpu": {
          "type": ["string", "number", "null"]
        },
        "memory": {
          "type": ["string", "number", "null"]
        },
        "ephemeral-storage": {
          "type": ["string", "number", "null"]
        },
        "ephemeralStorage": {
          "type": ["string", "number", "null"]
        }
      }
    },
    "env": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["name"],
        "properties": {
          "name": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "valueFrom": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "secretKeyRef": {
                "$ref": "#/definitions/keyRef"
              },
              "configMapKeyRef": {
                "$ref": "#/definitions/keyRef"
              }
            }
          }
        }
      }
    },
    "keyRef": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "key"],
      "properties": {
        "name": {
          "type": "string"
        },
        "key": {
          "type": "string"
        }
      }
    },
    "containerSecurityContext": {
      "description": "May be null / empty: the chart then falls back to its container hardening defaults (issue #99) instead of rendering an unhardened container. The pod-level context lives one level up, under sure.securityContext.pod, because it is shared by both containers.",
      "type": ["object", "null"],
      "additionalProperties": false,
      "properties": {
        "container": {
          "description": "Merged onto the chart's container hardening defaults and rendered as the container's securityContext; kept open because the chart does not interpret the individual fields.",
          "type": ["object", "null"]
        }
      }
    },
    "probe": {
      "description": "Merged onto the chart's probe defaults and rendered as a container probe; kept open because the chart does not interpret the individual fields. May be null / empty, which means the defaults apply (issue #99) rather than the probe disappearing. The chart's defaults carry the probe's context - the path for the web container, the exec command for the worker - not just its timings (guideline 12.5).",
      "type": ["object", "null"]
    }
  }
}