fix(cloudflared): align template validation standards

[mberlofa]

Summary

• add centralized cloudflared values validation through templates/validate.yaml
• add helm-unittest coverage for tunnel, ESO, metrics, PDB, and selector-label guardrails
• align NOTES.txt with the HelmForge numbered operational sections

Validation

• make template-standards-check CHART=cloudflared
• helm unittest charts/cloudflared
• helm lint --strict charts/cloudflared
• make standards-check CHART=cloudflared
• make validate-chart CHART=cloudflared TIMEOUT=900: FULLY VALIDATED (16 layers)
• make site-sync-check CHART=cloudflared
• make release-check REPO=charts
• make attribution-check REPO=charts

Site PR: helmforgedev/site#333
Issue: #633

Summary by CodeRabbit

• New Features
  • Added Helm chart runtime validation to prevent deployments with invalid tunnel, external secrets, metrics/monitoring, replica/PDB, and selector label configurations.
  • Added a rendering-time validation manifest hook.
• Documentation
  • Reorganized Helm installation notes into numbered sections, including updated metrics behavior and new high-availability details.
• Bug Fixes
  • Improved failure detection and clearer error messages for common misconfigurations (tunnel credentials/URLs, external secrets, metrics vs monitoring, replica/PDB, selector label conflicts).
• Tests
  • Expanded validation test coverage for invalid configuration combinations and expected error messages.

[github-actions]

Standards Check (GR-079) — PASS

Every changed chart fully passes standards-check.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a4239887-9d09-4a9b-9627-0fd7cf41e7e9

📥 Commits

Reviewing files that changed from the base of the PR and between 8fd482c and a349931.

📒 Files selected for processing (2)

• charts/cloudflared/templates/_helpers.tpl
• charts/cloudflared/tests/validation_test.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• charts/cloudflared/templates/_helpers.tpl
• charts/cloudflared/tests/validation_test.yaml

---

📝 Walkthrough

Walkthrough

Adds render-time validation for cloudflared chart configuration, wires it into template rendering, adds validation tests, and reformats NOTES.txt into numbered sections with conditional and informational content.

Changes

Cloudflared chart validation and NOTES updates

Layer / File(s)	Summary
Validation helper, wiring, and tests charts/cloudflared/templates/_helpers.tpl, charts/cloudflared/templates/validate.yaml, charts/cloudflared/tests/validation_test.yaml	Adds cloudflared.validate render-time checks for tunnel, externalSecrets, metrics/serviceMonitor, PDB, and podLabels constraints; includes the helper during chart rendering; adds tests for the new validation cases.
Numbered NOTES sections and new content charts/cloudflared/templates/NOTES.txt	Renumbers the installation, tunnel status, metrics, troubleshooting, and routing sections; conditionally renders metrics information or a disabled message; adds high availability and resources sections.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User as Helm user
  participant Helm as Helm render
  participant validateyaml as validate.yaml
  participant Helper as cloudflared.validate
  participant Tests as validation_test.yaml

  User->>Helm: helm install/template
  Helm->>validateyaml: render chart
  validateyaml->>Helper: include "cloudflared.validate" .
  Helper->>Helper: validate chart values
  alt invalid configuration
    Helper-->>Helm: fail
    Helm-->>User: render error
  else valid configuration
    Helper-->>Helm: continue
    Helm->>Tests: execute validation cases
  end

Loading

Suggested labels: area:docs

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: adding and standardizing cloudflared template validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cloudflared-template-standards

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🟢 Security Scan: cloudflared

Framework	Score
MITRE + NSA + SOC2	87.878784%

✅ Security posture acceptable.

[coderabbitai]

🧹 Nitpick comments (1)

charts/cloudflared/templates/_helpers.tpl (1)

68-72: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Hardcoded selector-label keys duplicate the labels helper.

The loop hardcodes "app.kubernetes.io/name" and "app.kubernetes.io/instance" rather than deriving them from the chart's selector-labels helper. If that helper is ever extended with additional keys, this validation silently misses them.

Consider deriving the guarded keys from the same source used by cloudflared.selectorLabels, or at minimum add a comment noting they must be kept in sync.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/cloudflared/templates/_helpers.tpl` around lines 68 - 72, The
podLabels validation in cloudflared.selectorLabels-related helpers hardcodes
selector keys instead of using the same source as the selector labels
themselves. Update the guard in _helpers.tpl so it derives the forbidden keys
from the chart’s selector-labels helper or shared selector-label definition, and
ensure the fail check in the podLabels loop stays in sync with any future
selector-label additions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@charts/cloudflared/templates/_helpers.tpl`:
- Around line 68-72: The podLabels validation in
cloudflared.selectorLabels-related helpers hardcodes selector keys instead of
using the same source as the selector labels themselves. Update the guard in
_helpers.tpl so it derives the forbidden keys from the chart’s selector-labels
helper or shared selector-label definition, and ensure the fail check in the
podLabels loop stays in sync with any future selector-label additions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 48d99cf9-e3dd-4c2d-8ec6-0daff0d322bc

📥 Commits

Reviewing files that changed from the base of the PR and between 870b4c7 and 49df97c.

📒 Files selected for processing (4)

• charts/cloudflared/templates/NOTES.txt
• charts/cloudflared/templates/_helpers.tpl
• charts/cloudflared/templates/validate.yaml
• charts/cloudflared/tests/validation_test.yaml

[mberlofa]

Addressed the CodeRabbit review-summary nitpick for selector-label validation.

Changes:

• Updated cloudflared.validate to derive blocked podLabels keys from cloudflared.selectorLabels via fromYaml, instead of duplicating selector label key names.
• Added validation coverage for overriding app.kubernetes.io/instance, alongside the existing app.kubernetes.io/name case.

Validation:

• make validate-chart CHART=cloudflared passed
• Result: cloudflared: FULLY VALIDATED (16 layers), including all k3d GR-027 scenarios
• make release-check REPO=charts passed with only the expected post-merge release confirmation warning
• make attribution-check REPO=charts passed
• git diff --check passed

Note: this CodeRabbit item was posted in the review summary/body, not as an active review thread, so there is no thread ID to reply to or resolve for it.