fix(fastmcp-server): align template standards

charts/fastmcp-server/templates/NOTES.txt

@@ -1,5 +1,7 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-FastMCP Server deployed!
+1. Installation summary
+
+FastMCP Server deployed.
 
   Server:   {{ .Values.server.name }}
   Namespace: {{ include "fastmcp-server.namespace" . }}
@@ -14,12 +16,16 @@ FastMCP Server deployed!
   Metrics:  http://{{ include "fastmcp-server.fullname" . }}.{{ include "fastmcp-server.namespace" . }}.svc:{{ .Values.service.port }}/metrics
 {{- end }}
 
+2. Access
+
 To access the MCP endpoint:
 
   kubectl port-forward svc/{{ include "fastmcp-server.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }} -n {{ include "fastmcp-server.namespace" . }}
   curl http://localhost:{{ .Values.service.port }}{{ .Values.server.path }}
 
 {{- if .Values.ingress.enabled }}
+
+3. Ingress routes
 {{- range .Values.ingress.hosts }}
 
   Ingress: http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}{{ (first .paths).path }}
@@ -28,21 +34,23 @@ To access the MCP endpoint:
 
 {{- if .Values.gatewayAPI.enabled }}
 
-  HTTPRoute:
+4. Gateway API routes
 {{- range .Values.gatewayAPI.hostnames }}
-    http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.server.path }}
+    http://{{ . }}{{ $.Values.server.path }}
 {{- end }}
 {{- end }}
 
 {{- if ne .Values.auth.type "none" }}
 
-Authentication: {{ .Values.auth.type }}
+5. Authentication
+
+  Type: {{ .Values.auth.type }}
 {{- if eq .Values.auth.type "bearer" }}
   Requests must include: Authorization: Bearer <token>
 {{- end }}
 {{- end }}
 
-Sources:
+6. Sources
 {{- if (include "fastmcp-server.hasAnyInline" .) }}
   - Inline (ConfigMap): enabled
 {{- end }}
@@ -53,6 +61,8 @@ Sources:
   - Git: {{ .Values.sources.git.repository }} ({{ .Values.sources.git.branch }})
 {{- end }}
 
-Documentation: https://helmforge.dev/docs/charts/fastmcp-server
+7. Documentation
+
+  https://helmforge.dev/docs/charts/fastmcp-server
 
 Happy Helmforging :)

charts/fastmcp-server/templates/_helpers.tpl

@@ -97,3 +97,54 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- define "fastmcp-server.hasAnyInline" -}}
 {{- if or (include "fastmcp-server.hasInlineTools" .) (include "fastmcp-server.hasInlineResources" .) (include "fastmcp-server.hasInlinePrompts" .) (include "fastmcp-server.hasInlineKnowledge" .) -}}true{{- end -}}
 {{- end -}}
+
+{{- define "fastmcp-server.validate" -}}
+{{- if and .Values.ingress.enabled (empty .Values.ingress.hosts) -}}
+{{- fail "ingress.hosts must contain at least one host when ingress.enabled=true" -}}
+{{- end -}}
+{{- if and .Values.gatewayAPI.enabled (empty .Values.gatewayAPI.parentRefs) -}}
+{{- fail "gatewayAPI.parentRefs must contain at least one parentRef when gatewayAPI.enabled=true" -}}
+{{- end -}}
+{{- if .Values.gatewayAPI.enabled -}}
+{{- range .Values.gatewayAPI.parentRefs }}
+{{- if empty .name -}}
+{{- fail "Each gatewayAPI.parentRefs entry must define a name" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if and (eq .Values.auth.type "bearer") (not .Values.auth.bearer.token) (not .Values.auth.bearer.existingSecret) -}}
+{{- fail "auth.type=bearer requires auth.bearer.token or auth.bearer.existingSecret" -}}
+{{- end -}}
+{{- if eq .Values.auth.type "jwt" -}}
+{{- if or (empty .Values.auth.jwt.issuer) (empty .Values.auth.jwt.audience) (empty .Values.auth.jwt.jwksUri) -}}
+{{- fail "auth.type=jwt requires auth.jwt.issuer, auth.jwt.audience, and auth.jwt.jwksUri" -}}
+{{- end -}}
+{{- end -}}
+{{- if .Values.sources.s3.enabled -}}
+{{- if empty .Values.sources.s3.bucket -}}
+{{- fail "sources.s3.enabled requires sources.s3.bucket" -}}
+{{- end -}}
+{{- if and (empty .Values.sources.s3.existingSecret) (or (empty .Values.sources.s3.accessKey) (empty .Values.sources.s3.secretKey)) -}}
+{{- fail "sources.s3.enabled requires sources.s3.existingSecret or both sources.s3.accessKey and sources.s3.secretKey" -}}
+{{- end -}}
+{{- end -}}
+{{- if and .Values.sources.git.enabled (empty .Values.sources.git.repository) -}}
+{{- fail "sources.git.enabled requires sources.git.repository" -}}
+{{- end -}}
+{{- if .Values.autoscaling.enabled -}}
+{{- if lt (int .Values.autoscaling.maxReplicas) (int .Values.autoscaling.minReplicas) -}}
+{{- fail "autoscaling.maxReplicas must be greater than or equal to autoscaling.minReplicas" -}}
+{{- end -}}
+{{- if and (empty .Values.autoscaling.targetCPUUtilizationPercentage) (empty .Values.autoscaling.targetMemoryUtilizationPercentage) -}}
+{{- fail "autoscaling.enabled requires at least one target metric" -}}
+{{- end -}}
+{{- end -}}
+{{- if .Values.podLabels -}}
+{{- if hasKey .Values.podLabels "app.kubernetes.io/name" -}}
+{{- fail "podLabels must not override the selector label app.kubernetes.io/name" -}}
+{{- end -}}
+{{- if hasKey .Values.podLabels "app.kubernetes.io/instance" -}}
+{{- fail "podLabels must not override the selector label app.kubernetes.io/instance" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/fastmcp-server/templates/httproute.yaml

@@ -1,9 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 
 {{- if .Values.gatewayAPI.enabled }}
-{{- if not .Values.gatewayAPI.parentRefs }}
-{{- fail "gatewayAPI.parentRefs must contain at least one parentRef when gatewayAPI.enabled is true" }}
-{{- end }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:

charts/fastmcp-server/templates/networkpolicy.yaml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 {{- if .Values.networkPolicy.enabled }}
+{{- $extraEgress := .Values.networkPolicy.extraEgress }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -14,8 +15,15 @@ spec:
       {{- include "fastmcp-server.selectorLabels" . | nindent 6 }}
   policyTypes:
     - Ingress
+    {{- if $extraEgress }}
+    - Egress
+    {{- end }}
   ingress:
     - ports:
         - port: {{ .Values.server.port }}
           protocol: TCP
+  {{- with $extraEgress }}
+  egress:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 {{- end }}

charts/fastmcp-server/templates/validate.yaml

@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: Apache-2.0
+{{- include "fastmcp-server.validate" . -}}

charts/fastmcp-server/tests/httproute_test.yaml

@@ -64,12 +64,3 @@ tests:
       - equal:
           path: spec.rules[0].backendRefs[0].name
           value: RELEASE-NAME-fastmcp-server
-
-  - it: should fail when enabled without parentRefs
-    set:
-      gatewayAPI:
-        enabled: true
-        parentRefs: []
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.parentRefs must contain at least one parentRef when gatewayAPI.enabled is true

charts/fastmcp-server/tests/networkpolicy_test.yaml

@@ -30,6 +30,31 @@ tests:
           path: spec.ingress[0].ports[0].port
           value: 8000
 
+  - it: should render extra egress rules
+    set:
+      networkPolicy:
+        enabled: true
+        extraEgress:
+          - to:
+              - ipBlock:
+                  cidr: 10.0.0.0/8
+            ports:
+              - protocol: TCP
+                port: 443
+    asserts:
+      - contains:
+          path: spec.policyTypes
+          content: Egress
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - ipBlock:
+                  cidr: 10.0.0.0/8
+            ports:
+              - protocol: TCP
+                port: 443
+
   - it: should have correct pod selector
     set:
       networkPolicy:

charts/fastmcp-server/tests/notes_test.yaml

@@ -10,3 +10,21 @@ tests:
     asserts:
       - matchRegexRaw:
           pattern: "kubectl port-forward svc/RELEASE-NAME-fastmcp-server 8000:8000 -n fastmcp-runtime"
+
+  - it: should not derive Gateway API route scheme from ingress TLS
+    set:
+      ingress.tls:
+        - hosts:
+            - mcp.example.com
+          secretName: mcp-tls
+      gatewayAPI:
+        enabled: true
+        parentRefs:
+          - name: public-gateway
+        hostnames:
+          - mcp.example.com
+    asserts:
+      - matchRegexRaw:
+          pattern: "http://mcp.example.com/mcp"
+      - notMatchRegexRaw:
+          pattern: "https://mcp.example.com/mcp"

charts/fastmcp-server/tests/validation_test.yaml

@@ -0,0 +1,116 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: validation
+templates:
+  - templates/validate.yaml
+tests:
+  - it: passes with default values
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: fails when ingress is enabled without hosts
+    set:
+      ingress.enabled: true
+      ingress.hosts: []
+    asserts:
+      - failedTemplate:
+          errorMessage: ingress.hosts must contain at least one host when ingress.enabled=true
+
+  - it: fails when gateway API is enabled without parentRefs
+    set:
+      gatewayAPI.enabled: true
+      gatewayAPI.parentRefs: []
+    asserts:
+      - failedTemplate:
+          errorMessage: gatewayAPI.parentRefs must contain at least one parentRef when gatewayAPI.enabled=true
+
+  - it: fails when a gateway API parentRef has no name
+    set:
+      gatewayAPI.enabled: true
+      gatewayAPI.parentRefs:
+        - namespace: gateway-system
+    asserts:
+      - failedTemplate:
+          errorMessage: Each gatewayAPI.parentRefs entry must define a name
+
+  - it: ignores gateway API parentRefs when gateway API is disabled
+    set:
+      gatewayAPI.enabled: false
+      gatewayAPI.parentRefs:
+        - namespace: gateway-system
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: fails when bearer auth has no token or existing secret
+    set:
+      auth.type: bearer
+      auth.bearer.token: ""
+      auth.bearer.existingSecret: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: auth.type=bearer requires auth.bearer.token or auth.bearer.existingSecret
+
+  - it: fails when JWT auth is incomplete
+    set:
+      auth.type: jwt
+      auth.jwt.issuer: https://issuer.example.com
+      auth.jwt.audience: ""
+      auth.jwt.jwksUri: https://issuer.example.com/.well-known/jwks.json
+    asserts:
+      - failedTemplate:
+          errorMessage: auth.type=jwt requires auth.jwt.issuer, auth.jwt.audience, and auth.jwt.jwksUri
+
+  - it: fails when S3 source has no bucket
+    set:
+      sources.s3.enabled: true
+      sources.s3.bucket: ""
+      sources.s3.existingSecret: fastmcp-s3
+    asserts:
+      - failedTemplate:
+          errorMessage: sources.s3.enabled requires sources.s3.bucket
+
+  - it: fails when S3 source has no credentials
+    set:
+      sources.s3.enabled: true
+      sources.s3.bucket: fastmcp
+      sources.s3.accessKey: ""
+      sources.s3.secretKey: ""
+      sources.s3.existingSecret: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: sources.s3.enabled requires sources.s3.existingSecret or both sources.s3.accessKey and sources.s3.secretKey
+
+  - it: fails when Git source has no repository
+    set:
+      sources.git.enabled: true
+      sources.git.repository: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: sources.git.enabled requires sources.git.repository
+
+  - it: fails when autoscaling max is lower than min
+    set:
+      autoscaling.enabled: true
+      autoscaling.minReplicas: 3
+      autoscaling.maxReplicas: 2
+    asserts:
+      - failedTemplate:
+          errorMessage: autoscaling.maxReplicas must be greater than or equal to autoscaling.minReplicas
+
+  - it: fails when autoscaling has no metrics
+    set:
+      autoscaling.enabled: true
+      autoscaling.targetCPUUtilizationPercentage: null
+      autoscaling.targetMemoryUtilizationPercentage: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: autoscaling.enabled requires at least one target metric
+
+  - it: fails when podLabels override selector labels
+    set:
+      podLabels:
+        app.kubernetes.io/name: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: podLabels must not override the selector label app.kubernetes.io/name

charts/fastmcp-server/values.schema.json

@@ -256,7 +256,14 @@
     "networkPolicy": {
       "type": "object",
       "properties": {
-        "enabled": { "type": "boolean" }
+        "enabled": { "type": "boolean" },
+        "extraEgress": {
+          "type": "array",
+          "description": "Additional NetworkPolicy egress rules",
+          "items": {
+            "type": "object"
+          }
+        }
       }
     },
     "pdb": {

charts/fastmcp-server/values.yaml

@@ -345,6 +345,8 @@ serviceAccount:
 networkPolicy:
   # -- Enable NetworkPolicy
   enabled: false
+  # -- Additional egress rules for external services required by tools or sources
+  extraEgress: []
 
 # =============================================================================
 # Resources and Security