jklein be3e2cdd47 test(ci): exercise minecraft-server's NodePort branch, which nothing rendered ...

Found by reviewing my own diff rather than by a failure, which is the only
reason it is worth a commit of its own.

minecraft-server's game-port rule has two branches read from the same value the
Service reads: OPEN when server.service.type is NodePort, RESTRICTED to the
namespace otherwise. All four releases in this cluster use ClusterIP and so
does the install-test fixture - so the OPEN branch was rendered nowhere at all.
Not by the chart defaults, not by the fixture, not by lint. It is also the
branch where naming server.service.outwardPort instead of server.port would be
the classic NodePort mistake, and assertion 2 can only see a rule it has been
given.

The overlay switches the Service to NodePort and RCON on, so both unreachable
branches are now rendered on every pull request. RCON is in there for a reason
too: its rule is gated on server.rcon.enabled exactly as the containerPort is,
that pairing was wrong once while this chart was being written, and switching
the feature on keeps the PAIR under test rather than just the gate.

The overlay guard had to be made conditional for this to be possible, and the
refinement is sound rather than a workaround. It demanded that any chart with
an overlay render a source-restricted PROBE rule - but minecraft-server has no
probe rule at all, because all three of its probes are exec probes, and it
therefore offers no probeSources. The guard now applies only to charts that
offer that value, so it still catches an overlay that stopped reaching the
restricted probe branch (template-chart, the case it was written for) without
rejecting an overlay that exists for a different unreachable branch.

All twelve failure paths re-run against the change; the suite is 30 charts, 208
assertions, 0 failed.

Part of #5

2026-10-14 15:29:16 +00:00

..

minecraft-server.yaml

test(ci): exercise minecraft-server's NodePort branch, which nothing rendered

2026-10-14 15:29:16 +00:00

template-chart.yaml

feat(ci): assert every rendered NetworkPolicy against its own render

2026-10-14 13:56:06 +00:00