fix(notediscovery): align template standards

charts/notediscovery/README.md

@@ -83,6 +83,13 @@ resources:
 
 networkPolicy:
   enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 8443
 ```
 
 Create the existing Secret with a complete NoteDiscovery config file:
@@ -140,6 +147,13 @@ Multiple pods require storage semantics chosen by the operator, typically a
 shared ReadWriteMany claim; the default generated claim is a single-writer
 volume.
 
+## Network Policy
+
+`networkPolicy.enabled=true` restricts inbound HTTP traffic to the configured
+`networkPolicy.ingressFrom` peers, or to all namespaces when `ingressFrom` is
+empty. `networkPolicy.extraEgress` enables egress isolation and appends custom
+egress rules after built-in DNS and HTTPS allowances.
+
 ## Documentation
 
 - [Storage](docs/storage.md)

charts/notediscovery/templates/NOTES.txt

@@ -1,38 +1,87 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
+1. Summary
+
 NoteDiscovery release: {{ .Release.Name }}
 Namespace: {{ .Release.Namespace }}
+Application port: {{ .Values.service.port }}
+Data directory: {{ .Values.persistence.mountPath }}
+
+2. Workload
+
+Check the Deployment and rollout status:
 
-Workload:
   kubectl get deploy {{ include "notediscovery.fullname" . }} -n {{ .Release.Namespace }}
   kubectl rollout status deploy/{{ include "notediscovery.fullname" . }} -n {{ .Release.Namespace }}
 
-Service:
+3. Access
+
+Check the Service:
+
   kubectl get svc {{ include "notediscovery.fullname" . }} -n {{ .Release.Namespace }}
 
-Local access:
+Use a local port-forward when Ingress or Gateway API is not enabled:
+
   kubectl port-forward svc/{{ include "notediscovery.fullname" . }} 8000:{{ .Values.service.port }} -n {{ .Release.Namespace }}
-  Open http://127.0.0.1:8000
 
-Runtime configuration:
-  Data directory: {{ .Values.persistence.mountPath }}
-  Search enabled: {{ .Values.notediscovery.searchEnabled }}
-  Authentication enabled: {{ .Values.auth.enabled }}
+Then open:
+
+  http://127.0.0.1:8000
+
+4. Credentials
 
-Persistence:
+Authentication enabled: {{ .Values.auth.enabled }}
+
+{{- if .Values.auth.existingSecret }}
+The complete NoteDiscovery config is read from Secret {{ .Values.auth.existingSecret }} key {{ .Values.auth.existingSecretKey }}.
+{{- else if .Values.auth.enabled }}
+The chart renders the generated authenticated config into a Secret.
+{{- else }}
+Authentication is disabled. Enable auth or provide auth.existingSecret before exposing NoteDiscovery to shared users.
+{{- end }}
+
+5. Configuration
+
+Search enabled: {{ .Values.notediscovery.searchEnabled }}
 {{- if .Values.persistence.existingClaim }}
-  Existing PVC {{ .Values.persistence.existingClaim }} is mounted.
+Storage: existing PVC {{ .Values.persistence.existingClaim }} is mounted.
 {{- else if .Values.persistence.enabled }}
-  PVC is enabled. Back up the data volume before upgrades.
+Storage: chart-managed PVC is enabled. Back up the data volume before upgrades.
+{{- else }}
+Storage: persistence is disabled and NoteDiscovery data is stored in an emptyDir.
+{{- end }}
+{{- if .Values.networkPolicy.enabled }}
+NetworkPolicy: enabled.
 {{- else }}
-  Persistence is disabled and NoteDiscovery data is stored in an emptyDir.
+NetworkPolicy: disabled.
 {{- end }}
 
-Troubleshooting:
-  kubectl logs deploy/{{ include "notediscovery.fullname" . }} -n {{ .Release.Namespace }}
-  kubectl describe pod -l app.kubernetes.io/instance={{ .Release.Name }} -n {{ .Release.Namespace }}
+6. Validation
+
+Run Helm tests:
 
-Validation:
   helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
+
+Run the HelmForge chart gate from the ops repo:
+
   make validate-chart CHART=notediscovery
 
+7. Troubleshooting
+
+Inspect logs and pod events:
+
+  kubectl logs deploy/{{ include "notediscovery.fullname" . }} -n {{ .Release.Namespace }}
+  kubectl describe pod -l app.kubernetes.io/instance={{ .Release.Name }} -n {{ .Release.Namespace }}
+
+If the app is exposed, ensure notediscovery.allowedOrigins includes the public origin.
+
+8. Resources
+
+Chart documentation:
+
+  https://github.com/helmforgedev/charts/tree/main/charts/notediscovery
+
+Upstream project:
+
+  https://github.com/gamosoft/NoteDiscovery
+
 Happy Helmforging :)

charts/notediscovery/templates/_helpers.tpl

@@ -152,10 +152,19 @@ Validate chart values.
 {{- if and (gt (int .Values.replicaCount) 1) (not .Values.persistence.existingClaim) -}}
 {{- fail "replicaCount > 1 requires persistence.existingClaim because NoteDiscovery stores notes as local files on a single writable volume" -}}
 {{- end -}}
+{{- if and .Values.ingress.enabled (empty .Values.ingress.hosts) -}}
+{{- fail "ingress.hosts must contain at least one host when ingress.enabled=true" -}}
+{{- end -}}
 {{- if and .Values.auth.enabled (not .Values.auth.existingSecret) (or (empty .Values.auth.secretKey) (empty .Values.auth.password)) -}}
 {{- fail "auth.secretKey and auth.password are required when auth.enabled=true unless auth.existingSecret is set" -}}
 {{- end -}}
 {{- if and .Values.externalSecrets.enabled (empty .Values.externalSecrets.items) -}}
 {{- fail "externalSecrets.items must contain at least one item when externalSecrets.enabled=true" -}}
 {{- end -}}
+{{- $podLabels := .Values.podLabels | default dict -}}
+{{- range $key := (list "app.kubernetes.io/name" "app.kubernetes.io/instance") -}}
+{{- if hasKey $podLabels $key -}}
+{{- fail (printf "podLabels must not override the selector label %s" $key) -}}
+{{- end -}}
+{{- end -}}
 {{- end -}}

charts/notediscovery/templates/deployment.yaml

@@ -15,7 +15,7 @@ spec:
   template:
     metadata:
       labels:
-        {{- include "notediscovery.labels" . | nindent 8 }}
+        {{- include "notediscovery.selectorLabels" . | nindent 8 }}
         {{- with .Values.podLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

charts/notediscovery/templates/ingress.yaml

@@ -11,7 +11,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  {{- with .Values.ingress.ingressClassName }}
+  ingressClassName: {{ . | quote }}
+  {{- end }}
   {{- with .Values.ingress.tls }}
   tls:
     {{- toYaml . | nindent 4 }}

charts/notediscovery/templates/networkpolicy.yaml

@@ -12,6 +12,9 @@ spec:
       {{- include "notediscovery.selectorLabels" . | nindent 6 }}
   policyTypes:
     - Ingress
+    {{- if .Values.networkPolicy.extraEgress }}
+    - Egress
+    {{- end }}
   ingress:
     - from:
         {{- if .Values.networkPolicy.ingressFrom }}
@@ -22,4 +25,23 @@ spec:
       ports:
         - protocol: TCP
           port: http
+  {{- with .Values.networkPolicy.extraEgress }}
+  egress:
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+        - ipBlock:
+            cidr: ::/0
+      ports:
+        - protocol: TCP
+          port: 443
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 {{- end }}

charts/notediscovery/tests/networkpolicy-extra-egress-values.yaml

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+networkPolicy:
+  enabled: true
+  ingressFrom:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-system
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 8443

charts/notediscovery/tests/networkpolicy_test.yaml

@@ -14,3 +14,22 @@ tests:
           content:
             protocol: TCP
             port: http
+      - notContains:
+          path: spec.policyTypes
+          content: Egress
+  - it: enables egress isolation when extraEgress is configured
+    values:
+      - networkpolicy-extra-egress-values.yaml
+    asserts:
+      - contains:
+          path: spec.policyTypes
+          content: Egress
+      - equal:
+          path: spec.egress[0].ports[0].port
+          value: 53
+      - equal:
+          path: spec.egress[1].ports[0].port
+          value: 443
+      - equal:
+          path: spec.egress[2].ports[0].port
+          value: 8443

charts/notediscovery/tests/podlabels-selector-instance-values.yaml

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: Apache-2.0
+podLabels:
+  app.kubernetes.io/instance: custom

charts/notediscovery/tests/podlabels-selector-name-values.yaml

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: Apache-2.0
+podLabels:
+  app.kubernetes.io/name: custom

charts/notediscovery/tests/test_connection_test.yaml

@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: Helm Test
+templates:
+  - templates/tests/test-connection.yaml
+release:
+  name: test
+  namespace: default
+tests:
+  - it: should render the Helm test hook pod
+    asserts:
+      - isKind:
+          of: Pod
+      - equal:
+          path: metadata.name
+          value: test-notediscovery-test-connection
+      - equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: test
+      - equal:
+          path: metadata.annotations["helm.sh/hook-delete-policy"]
+          value: before-hook-creation,hook-succeeded

charts/notediscovery/tests/validation_test.yaml

@@ -15,9 +15,27 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "auth.secretKey and auth.password are required when auth.enabled=true unless auth.existingSecret is set"
+  - it: fails when ingress is enabled without hosts
+    set:
+      ingress.enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "ingress.hosts must contain at least one host when ingress.enabled=true"
   - it: fails when ExternalSecrets is enabled without items
     set:
       externalSecrets.enabled: true
     asserts:
       - failedTemplate:
           errorMessage: "externalSecrets.items must contain at least one item when externalSecrets.enabled=true"
+  - it: fails when podLabels override selector name
+    values:
+      - podlabels-selector-name-values.yaml
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override the selector label app.kubernetes.io/name"
+  - it: fails when podLabels override selector instance
+    values:
+      - podlabels-selector-instance-values.yaml
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override the selector label app.kubernetes.io/instance"

charts/notediscovery/values.schema.json

@@ -171,7 +171,8 @@
       "type": "object",
       "properties": {
         "enabled": { "type": "boolean", "default": false },
-        "ingressFrom": { "type": "array", "items": { "type": "object" } }
+        "ingressFrom": { "type": "array", "items": { "type": "object" } },
+        "extraEgress": { "type": "array", "items": { "type": "object" } }
       }
     }
   }

charts/notediscovery/values.yaml

@@ -186,6 +186,8 @@ networkPolicy:
   enabled: false
   # -- Custom ingress peers. Empty allows ingress from any namespace.
   ingressFrom: []
+  # -- Additional egress rules. When set, the policy also isolates egress while preserving DNS and HTTPS access.
+  extraEgress: []
 
 # -- Node selector for scheduling the pod.
 nodeSelector: {}