fix(helm): address chart review feedback

Author: bitflicker64

.github/workflows/helm-chart-ci.yml

@@ -32,6 +32,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: azure/setup-helm@v4
         with:
@@ -55,6 +57,12 @@ jobs:
           ! helm template ci helm/hugegraph --set pd.replicas=100 2>/dev/null
           ! helm template ci helm/hugegraph --set pd.pdb.minAvailable=3 2>/dev/null
           ! helm template ci helm/hugegraph --set server.hpa.enabled=true 2>/dev/null
+          ! helm template ci helm/hugegraph \
+            --set server.hpa.enabled=true \
+            --set server.hpa.minReplicas=2 \
+            --set server.resources.requests.cpu=100m \
+            --set server.pdb.enabled=true \
+            --set server.pdb.minAvailable=2 2>/dev/null
           ! helm template ci helm/hugegraph --set server.auth.enabled=true 2>/dev/null
 
       - name: kubeconform

helm/hugegraph/README.md

@@ -220,7 +220,7 @@ default values.
 | `server.podSecurityContext` | Pod-level securityContext, rendered only when set | `{}` |
 | `server.securityContext` | Container-level securityContext. Hardened by default; `runAsNonRoot` is not set because the published images run as root | `allowPrivilegeEscalation: false`, `capabilities.drop: [ALL]`, `seccompProfile: RuntimeDefault` |
 | `server.pdb.enabled` | Create a PodDisruptionBudget for Server. Off by default: Server holds no quorum | `false` |
-| `server.pdb.minAvailable` | Must be strictly less than `server.replicas` | `2` |
+| `server.pdb.minAvailable` | Must be less than `server.hpa.minReplicas` when HPA is enabled, otherwise less than `server.replicas` | `2` |
 | `server.antiAffinity` | One of `required`, `preferred`, `disabled`. Defaults to `preferred` rather than `required` because HPA may scale Server past the node count; set `required` when replicas always stay below it | `preferred` |
 | `server.nodeSelector` | Node selector for server Pods | `{}` |
 | `server.tolerations` | Tolerations for server Pods | `[]` |
@@ -236,6 +236,7 @@ default values.
 | `server.serviceAccount.annotations` | Annotations on the created ServiceAccount | `{}` |
 | `server.serviceAccount.automountServiceAccountToken` | Mount an API token. The chart makes no API calls | `false` |
 | `server.waitImage` | Image for the Helm test hook | `curlimages/curl:8.5.0` |
+| `server.testResources` | Resources for the Helm test hook container | `{}` |
 | `server.restServer.minFreeMemory` | Empty preserves the image default | `""` |
 | `server.restServer.batchMaxWriteThreads` | Empty preserves the image default | `""` |
 | `server.initStoreEnabled` | Must remain `false` for distributed HStore | `false` |
@@ -371,7 +372,7 @@ kubectl describe pod <pod> | grep -A5 "Last State"
 Helm itself rejects release names longer than 53 characters, before this chart
 renders anything:
 
-```
+```text
 invalid release name ... the length must not be longer than 53
 ```
 

helm/hugegraph/templates/NOTES.txt

@@ -34,7 +34,12 @@ Verify the release:
 Reach the Server API:
 
   kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "hugegraph.server.name" . }} {{ .Values.server.port }}:{{ .Values.server.port }}
+{{- if .Values.server.auth.enabled }}
+  PASSWORD="$(kubectl get secret -n {{ .Release.Namespace }} {{ .Values.server.auth.existingSecret }} -o jsonpath='{.data.password}' | base64 --decode)"
+  curl --user "admin:${PASSWORD}" http://127.0.0.1:{{ .Values.server.port }}/versions
+{{- else }}
   curl http://127.0.0.1:{{ .Values.server.port }}/versions
+{{- end }}
 {{- if not .Values.server.auth.enabled }}
 
 Authentication is disabled. Do not expose this release to untrusted networks.

helm/hugegraph/templates/_helpers.tpl

@@ -208,6 +208,17 @@ default
 {{- end -}}
 {{- end }}
 
+{{/*
+The minimum Server replica count that a PDB must remain valid against.
+*/}}
+{{- define "hugegraph.server.replicaFloor" -}}
+{{- if .Values.server.hpa.enabled -}}
+{{- .Values.server.hpa.minReplicas -}}
+{{- else -}}
+{{- .Values.server.replicas -}}
+{{- end -}}
+{{- end }}
+
 {{/*
 Cross-field validation that JSON Schema draft-07 cannot express.
 */}}
@@ -246,8 +257,9 @@ and must not be failed for a value that has no effect.
 {{- fail "server.service.nodePort requires server.service.type to be NodePort or LoadBalancer" -}}
 {{- end -}}
 {{- $serverPdb := get .Values.server "pdb" | default dict -}}
-{{- if and (get $serverPdb "enabled" | default false) (gt (int .Values.server.replicas) 1) (ge (int (get $serverPdb "minAvailable" | default 1)) (int .Values.server.replicas)) -}}
-{{- fail "server.pdb.minAvailable must be less than server.replicas, otherwise the PDB permanently blocks voluntary disruptions such as node drains" -}}
+{{- $serverReplicaFloor := include "hugegraph.server.replicaFloor" . | int -}}
+{{- if and (get $serverPdb "enabled" | default false) (gt $serverReplicaFloor 1) (ge (int (get $serverPdb "minAvailable" | default 1)) $serverReplicaFloor) -}}
+{{- fail "server.pdb.minAvailable must be less than the active Server replica floor (server.hpa.minReplicas when HPA is enabled, otherwise server.replicas), otherwise the PDB permanently blocks voluntary disruptions such as node drains" -}}
 {{- end -}}
 {{- end }}
 

helm/hugegraph/templates/server-ingress.yaml

@@ -41,7 +41,7 @@ spec:
       http:
         paths:
           {{- range .paths }}
-          - path: {{ .path }}
+          - path: {{ .path | quote }}
             pathType: {{ .pathType }}
             backend:
               service:

helm/hugegraph/templates/server-pdb.yaml

@@ -16,7 +16,8 @@
 #
 
 {{- $pdb := get .Values.server "pdb" | default dict }}
-{{- if and (get $pdb "enabled" | default false) (gt (int .Values.server.replicas) 1) }}
+{{- $replicaFloor := include "hugegraph.server.replicaFloor" . | int }}
+{{- if and (get $pdb "enabled" | default false) (gt $replicaFloor 1) }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:

helm/hugegraph/templates/tests/test-connection.yaml

@@ -28,10 +28,26 @@ metadata:
     "helm.sh/hook": test
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 spec:
+  automountServiceAccountToken: false
   restartPolicy: Never
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
   containers:
     - name: curl
       image: {{ .Values.server.waitImage | quote }}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+        runAsGroup: 101
+        runAsNonRoot: true
+        runAsUser: 100
+      {{- with .Values.server.testResources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.server.auth.enabled }}
       env:
         - name: PASSWORD

helm/hugegraph/values.schema.json

@@ -31,14 +31,6 @@
     },
     "global": {
       "type": "object"
-    },
-    "networkPolicy": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      }
     }
   },
   "definitions": {
@@ -576,6 +568,7 @@
         },
         "ingress": {
           "type": "object",
+          "additionalProperties": false,
           "required": [
             "enabled",
             "className",
@@ -734,6 +727,9 @@
             }
           }
         },
+        "testResources": {
+          "type": "object"
+        },
         "service": {
           "type": "object",
           "additionalProperties": false,

helm/hugegraph/values.yaml

@@ -185,7 +185,7 @@ server:
   podLabels: {}
   # Extra environment variables appended to the server container.
   extraEnv: []
-  # Gives a JVM with an on-disk store time to shut down cleanly on drain.
+  # Allows in-flight requests to drain before the Server is stopped.
   terminationGracePeriodSeconds: 60
   serviceAccount:
     create: true
@@ -206,6 +206,8 @@ server:
     minAvailable: 2
   # Image used by the Helm test hook.
   waitImage: curlimages/curl:8.5.0
+  # Optional resources for the Helm test hook container.
+  testResources: {}
   restServer:
     # Empty preserves the image's restserver.min_free_memory default.
     minFreeMemory: ""