fix(countly): align template validation standards

charts/countly/ci/dual-stack.yaml

@@ -1,14 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # CI scenario: dual-stack for HTTP service (GR-058)
-mongodb:
-  enabled: false
-
-externalMongodb:
-  enabled: true
-  uri: mongodb://external-mongo:27017/countly
-
+# Keep this scenario portable across IPv4-only and dual-stack k3d clusters.
+# Explicit ipFamilies rendering is covered by unit tests because Kubernetes
+# rejects IPv6 entries on clusters that do not advertise IPv6.
 service:
   ipFamilyPolicy: PreferDualStack
-  ipFamilies:
-    - IPv4
-    - IPv6

charts/countly/ci/external-mongodb-values.yaml

@@ -1,8 +1,25 @@
 # SPDX-License-Identifier: Apache-2.0
-# CI: external MongoDB
+# CI: external MongoDB, backed by the bundled MongoDB service for k3d.
 mongodb:
-  enabled: false
+  enabled: true
+  auth:
+    rootPassword: test-password
 
 externalMongodb:
   enabled: true
-  uri: "mongodb://user:password@external-mongodb:27017/countly?authSource=admin"
+  uri: "mongodb://root:test-password@countly-external-mongodb:27017/countly?authSource=admin"
+
+extraManifests:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: countly-external-mongodb
+    spec:
+      type: ClusterIP
+      ports:
+        - name: mongodb
+          port: 27017
+          targetPort: mongodb
+      selector:
+        app.kubernetes.io/name: mongodb
+        app.kubernetes.io/component: mongodb

charts/countly/ci/external-secrets.yaml

@@ -1,7 +1,9 @@
 # SPDX-License-Identifier: Apache-2.0
 # CI scenario: ExternalSecrets with drift guard (GR-061)
 mongodb:
-  enabled: false
+  enabled: true
+  auth:
+    rootPassword: test-password
 
 externalMongodb:
   enabled: true
@@ -11,10 +13,33 @@ externalMongodb:
 externalSecrets:
   enabled: true
   secretStoreRef:
-    name: my-store
+    name: helmforge-fake-store
     kind: ClusterSecretStore
+  target:
+    creationPolicy: None
   data:
     - secretKey: mongodb-uri
       remoteRef:
-        key: countly/db
-        property: uri
+        key: test/password
+
+extraManifests:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: countly-mongo-credentials
+    type: Opaque
+    stringData:
+      mongodb-uri: mongodb://root:test-password@countly-external-mongodb:27017/countly?authSource=admin
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: countly-external-mongodb
+    spec:
+      type: ClusterIP
+      ports:
+        - name: mongodb
+          port: 27017
+          targetPort: mongodb
+      selector:
+        app.kubernetes.io/name: mongodb
+        app.kubernetes.io/component: mongodb

charts/countly/ci/gateway-api.yaml

@@ -1,12 +1,5 @@
 # SPDX-License-Identifier: Apache-2.0
 # CI scenario: Gateway API (GR-060)
-mongodb:
-  enabled: false
-
-externalMongodb:
-  enabled: true
-  uri: mongodb://external-mongo:27017/countly
-
 gateway:
   enabled: true
   hostnames:

charts/countly/templates/_helpers.tpl

@@ -43,14 +43,61 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
 {{- end -}}
 
+{{- define "countly.validate" -}}
+{{- if and .Values.externalMongodb.enabled (not .Values.externalMongodb.uri) (not .Values.externalMongodb.existingSecret) -}}
+{{- fail "externalMongodb.uri or externalMongodb.existingSecret is required when externalMongodb.enabled=true" -}}
+{{- end -}}
+{{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}}
+{{- fail "ingress.hosts must contain at least one rule when ingress.enabled=true" -}}
+{{- end -}}
+{{- if and .Values.gateway.enabled (not .Values.gateway.parentRefs) -}}
+{{- fail "gateway.enabled requires gateway.parentRefs to be populated to create a valid HTTPRoute." -}}
+{{- end -}}
+{{- if .Values.externalSecrets.enabled -}}
+  {{- if not .Values.externalMongodb.enabled -}}
+    {{- fail "externalSecrets.enabled requires externalMongodb.enabled=true; the Deployment only mounts the MongoDB secret when external MongoDB is active." -}}
+  {{- end -}}
+  {{- if not .Values.externalMongodb.existingSecret -}}
+    {{- fail "externalSecrets.enabled requires externalMongodb.existingSecret to be set to prevent credential drift between the chart-managed Secret and the ExternalSecret." -}}
+  {{- end -}}
+  {{- if not .Values.externalSecrets.secretStoreRef.name -}}
+    {{- fail "externalSecrets.secretStoreRef.name is required when externalSecrets.enabled=true" -}}
+  {{- end -}}
+  {{- if not .Values.externalSecrets.data -}}
+    {{- fail "externalSecrets.data must not be empty when externalSecrets.enabled=true" -}}
+  {{- end -}}
+  {{- $uriKey := .Values.externalMongodb.existingSecretUriKey | default "mongodb-uri" -}}
+  {{- $hasUri := false -}}
+  {{- range .Values.externalSecrets.data -}}
+    {{- if eq .secretKey $uriKey }}{{ $hasUri = true }}{{ end -}}
+  {{- end -}}
+  {{- if not $hasUri -}}
+    {{- fail (printf "externalSecrets.data must include a mapping for key '%s' (MongoDB connection URI)" $uriKey) -}}
+  {{- end -}}
+{{- end -}}
+{{- if .Values.backup.enabled -}}
+  {{- $_ := include "countly.backupEnabled" . -}}
+  {{- $_ := include "countly.backupMongodbUri" . -}}
+{{- end -}}
+{{- $podLabels := .Values.podLabels | default dict -}}
+{{- $selectorLabels := include "countly.selectorLabels" . | fromYaml -}}
+{{- range $key, $_ := $selectorLabels -}}
+{{- if hasKey $podLabels $key -}}
+{{- fail (printf "podLabels must not override selector label %q" $key) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{/* MongoDB host */}}
 {{- define "countly.mongodbHost" -}}
-{{- if .Values.externalMongodb.enabled -}}
-{{- "" -}}
+{{- if .Values.mongodb.enabled -}}
+{{- if contains "mongodb" .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
 {{- else -}}
 {{- printf "%s-mongodb" .Release.Name -}}
 {{- end -}}
 {{- end -}}
+{{- end -}}
 
 {{/* MongoDB URI */}}
 {{- define "countly.mongodbUri" -}}
@@ -91,6 +138,9 @@ app.kubernetes.io/instance: {{ .Release.Name }}
   {{- if and (not .Values.backup.s3.existingSecret) (not .Values.backup.s3.accessKey) -}}
     {{- fail "backup.s3.accessKey or backup.s3.existingSecret is required when backup.enabled is true" -}}
   {{- end -}}
+  {{- if and (not .Values.backup.s3.existingSecret) (not .Values.backup.s3.secretKey) -}}
+    {{- fail "backup.s3.secretKey or backup.s3.existingSecret is required when backup.enabled is true" -}}
+  {{- end -}}
 true
 {{- end -}}
 {{- end -}}

charts/countly/templates/ingress.yaml

@@ -26,7 +26,9 @@ spec:
   {{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
+    - {{- with .host }}
+      host: {{ . | quote }}
+      {{- end }}
       http:
         paths:
           {{- range (.paths | default (list (dict "path" "/" "pathType" "Prefix"))) }}

charts/countly/templates/validate.yaml

@@ -0,0 +1,2 @@
+{{/* SPDX-License-Identifier: Apache-2.0 */}}
+{{- include "countly.validate" . -}}

charts/countly/tests/deployment_test.yaml

@@ -108,6 +108,15 @@ tests:
       - notExists:
           path: spec.template.spec.initContainers
 
+  - it: should not wait for bundled MongoDB when external MongoDB is enabled
+    set:
+      mongodb.enabled: true
+      externalMongodb.enabled: true
+      externalMongodb.uri: "mongodb://root:test-password@test-mongodb:27017/countly?authSource=admin"
+    asserts:
+      - notExists:
+          path: spec.template.spec.initContainers
+
   - it: should use TCP probes on dashboard port
     asserts:
       - equal:

charts/countly/tests/ingress_test.yaml

@@ -22,3 +22,16 @@ tests:
     asserts:
       - isKind:
           of: Ingress
+
+  - it: should support hostless catch-all rules
+    set:
+      ingress.enabled: true
+      ingress.hosts:
+        - paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - isKind:
+          of: Ingress
+      - notExists:
+          path: spec.rules[0].host

charts/countly/tests/service_test.yaml

@@ -30,3 +30,20 @@ tests:
             port: 3001
             targetPort: api
             protocol: TCP
+
+  - it: should render dual-stack service fields when configured
+    set:
+      service.ipFamilyPolicy: PreferDualStack
+      service.ipFamilies:
+        - IPv4
+        - IPv6
+    asserts:
+      - equal:
+          path: spec.ipFamilyPolicy
+          value: PreferDualStack
+      - equal:
+          path: spec.ipFamilies[0]
+          value: IPv4
+      - equal:
+          path: spec.ipFamilies[1]
+          value: IPv6