From 87e7b9a8adab05f728d130d630ee75b2f57dcb3e Mon Sep 17 00:00:00 2001
From: MergeCheck <mergecheck@example.invalid>
Date: Fri, 3 Jul 2026 13:07:50 -0300
Subject: [PATCH 1/2] fix(drupal): centralize template validation

---
 charts/drupal/templates/_helpers.tpl     | 23 +++++++++++++++++++++++
 charts/drupal/templates/validate.yaml    |  2 ++
 charts/drupal/tests/validation_test.yaml | 24 +++++++++++++++++++++++-
 3 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 charts/drupal/templates/validate.yaml

diff --git a/charts/drupal/templates/_helpers.tpl b/charts/drupal/templates/_helpers.tpl
index 1bd75fa99..493fea7a7 100644
--- a/charts/drupal/templates/_helpers.tpl
+++ b/charts/drupal/templates/_helpers.tpl
@@ -371,3 +371,26 @@ Backup database username.
 {{- include "drupal.databaseUsername" . -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Central fail-fast validation entrypoint.
+*/}}
+{{- define "drupal.validate" -}}
+{{- $_ := include "drupal.databaseMode" . -}}
+{{- $_ := include "drupal.replicaCount" . -}}
+{{- $_ := include "drupal.backupEnabled" . -}}
+{{- $_ := include "drupal.autoscalingEnabled" . -}}
+{{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}}
+{{- fail "ingress.hosts must contain at least one rule when ingress.enabled=true" -}}
+{{- end -}}
+{{- $podLabels := .Values.podLabels | default dict -}}
+{{- if hasKey $podLabels "app.kubernetes.io/name" -}}
+{{- fail "podLabels must not override selector label app.kubernetes.io/name" -}}
+{{- end -}}
+{{- if hasKey $podLabels "app.kubernetes.io/instance" -}}
+{{- fail "podLabels must not override selector label app.kubernetes.io/instance" -}}
+{{- end -}}
+{{- if hasKey $podLabels "app.kubernetes.io/component" -}}
+{{- fail "podLabels must not override selector label app.kubernetes.io/component" -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/drupal/templates/validate.yaml b/charts/drupal/templates/validate.yaml
new file mode 100644
index 000000000..7edf83b22
--- /dev/null
+++ b/charts/drupal/templates/validate.yaml
@@ -0,0 +1,2 @@
+{{/* SPDX-License-Identifier: Apache-2.0 */}}
+{{- include "drupal.validate" . -}}
diff --git a/charts/drupal/tests/validation_test.yaml b/charts/drupal/tests/validation_test.yaml
index 4874eb7da..e9969e569 100644
--- a/charts/drupal/tests/validation_test.yaml
+++ b/charts/drupal/tests/validation_test.yaml
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 suite: Validations
 templates:
-  - templates/deployment.yaml
+  - templates/validate.yaml
 release:
   name: test
   namespace: default
@@ -35,3 +35,25 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "database.mode=sqlite requires drupal.sqlitePath to stay under sites/ so persistence and backup cover the database file"
+
+  - it: should fail ingress without rules
+    set:
+      ingress.enabled: true
+      ingress.hosts: []
+    asserts:
+      - failedTemplate:
+          errorMessage: "ingress.hosts must contain at least one rule when ingress.enabled=true"
+
+  - it: should fail reserved pod label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/component: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/component"
+
+  - it: should allow null pod labels
+    set:
+      podLabels: null
+    asserts:
+      - notFailedTemplate: {}

From ada98143a5f898997f3526672e536f4e43e27836 Mon Sep 17 00:00:00 2001
From: MergeCheck <mergecheck@example.invalid>
Date: Sun, 5 Jul 2026 17:42:56 -0300
Subject: [PATCH 2/2] test(drupal): cover reserved pod label validation

---
 charts/drupal/templates/_helpers.tpl     | 10 +++-------
 charts/drupal/tests/validation_test.yaml | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/charts/drupal/templates/_helpers.tpl b/charts/drupal/templates/_helpers.tpl
index 493fea7a7..2f0605ff5 100644
--- a/charts/drupal/templates/_helpers.tpl
+++ b/charts/drupal/templates/_helpers.tpl
@@ -384,13 +384,9 @@ Central fail-fast validation entrypoint.
 {{- fail "ingress.hosts must contain at least one rule when ingress.enabled=true" -}}
 {{- end -}}
 {{- $podLabels := .Values.podLabels | default dict -}}
-{{- if hasKey $podLabels "app.kubernetes.io/name" -}}
-{{- fail "podLabels must not override selector label app.kubernetes.io/name" -}}
+{{- range list "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" -}}
+{{- if hasKey $podLabels . -}}
+{{- fail (printf "podLabels must not override selector label %s" .) -}}
 {{- end -}}
-{{- if hasKey $podLabels "app.kubernetes.io/instance" -}}
-{{- fail "podLabels must not override selector label app.kubernetes.io/instance" -}}
-{{- end -}}
-{{- if hasKey $podLabels "app.kubernetes.io/component" -}}
-{{- fail "podLabels must not override selector label app.kubernetes.io/component" -}}
 {{- end -}}
 {{- end -}}
diff --git a/charts/drupal/tests/validation_test.yaml b/charts/drupal/tests/validation_test.yaml
index e9969e569..8fdf82eb8 100644
--- a/charts/drupal/tests/validation_test.yaml
+++ b/charts/drupal/tests/validation_test.yaml
@@ -52,6 +52,22 @@ tests:
       - failedTemplate:
           errorMessage: "podLabels must not override selector label app.kubernetes.io/component"
 
+  - it: should fail reserved app name label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/name: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/name"
+
+  - it: should fail reserved app instance label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/instance: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/instance"
+
   - it: should allow null pod labels
     set:
       podLabels: null