From e0bb34d474b83eb3494d3aed2bc31bba658236d9 Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Sat, 4 Jul 2026 01:41:48 -0300 Subject: [PATCH 1/2] fix(memcached): align template standards --- charts/memcached/README.md | 2 ++ charts/memcached/templates/NOTES.txt | 30 ++++++++++++------- charts/memcached/templates/networkpolicy.yaml | 5 +++- .../memcached/tests/networkpolicy_test.yaml | 24 +++++++++++++++ charts/memcached/values.schema.json | 4 +++ charts/memcached/values.yaml | 1 + 6 files changed, 55 insertions(+), 11 deletions(-) diff --git a/charts/memcached/README.md b/charts/memcached/README.md index 7a3b55019..ba2f65a53 100644 --- a/charts/memcached/README.md +++ b/charts/memcached/README.md @@ -306,6 +306,7 @@ networkPolicy: enabled: true allowSameNamespace: true allowDNS: true + extraEgress: [] ``` ## Important values @@ -331,6 +332,7 @@ networkPolicy: | `metrics.memcachedTLS.serverName` | computed Service DNS | TLS verification name used by the metrics exporter. | | `networkPolicy.enabled` | `false` | Enables NetworkPolicy resources. | | `networkPolicy.egress.allowSameNamespace` | `true` | Allows cache and metrics responses to same-namespace clients. | +| `networkPolicy.extraEgress` | `[]` | Additional full NetworkPolicy egress rules appended to generated egress. | | `pdb.maxUnavailable` | `""` | Optional PDB disruption limit. Explicit `0` is honored. | | `service.ipFamilyPolicy` | `""` | Optional Kubernetes Service dual-stack policy. | | `service.ipFamilies` | `[]` | Optional ordered Service IP families. | diff --git a/charts/memcached/templates/NOTES.txt b/charts/memcached/templates/NOTES.txt index 7ffcb0e52..25946dded 100644 --- a/charts/memcached/templates/NOTES.txt +++ b/charts/memcached/templates/NOTES.txt @@ -1,9 +1,9 @@ {{/* SPDX-License-Identifier: Apache-2.0 */}} -# Getting started +1. Getting Started Memcached has been deployed as {{ .Values.architecture }}. -## Access +2. Access Client service: {{ include "memcached.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.port }} @@ -11,7 +11,7 @@ Client service: Headless service for pod-aware client hashing: {{ include "memcached.headlessServiceName" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} -## Configuration +3. Configuration Architecture: {{ .Values.architecture }} Replicas: {{ .Values.replicaCount }} @@ -37,7 +37,7 @@ Metrics: disabled Service IP family policy: {{ . }}{{ with $.Values.service.ipFamilies }} (families: {{ join ", " . }}){{ end }} {{- end }} -## Validation +4. Validation Validate connectivity: kubectl run memcached-client --rm -it --restart=Never \ @@ -45,8 +45,9 @@ Validate connectivity: --image=docker.io/library/busybox:1.37.0 -- \ sh -ec "printf 'version\r\n' | nc {{ include "memcached.fullname" . }} {{ .Values.service.port }}" -{{- if .Values.auth.enabled }} +5. Authentication +{{- if .Values.auth.enabled }} Authentication is enabled with mode {{ .Values.auth.mode }}. {{- if eq .Values.auth.mode "ascii" }} ASCII auth uses a fake set command before regular commands: @@ -55,20 +56,28 @@ ASCII auth uses a fake set command before regular commands: SASL mode requires binary protocol clients and the mounted SASL database from Secret {{ include "memcached.authSecretName" . }}. The chart sets SASL_CONF_PATH={{ .Values.auth.sasl.mountPath }}. {{- end }} +{{- else }} +Authentication is disabled. {{- end }} -{{- if .Values.tls.enabled }} +6. TLS +{{- if .Values.tls.enabled }} TLS is enabled. Use a Memcached client that supports TLS and trusts the mounted certificate chain. +{{- else }} +TLS is disabled. {{- end }} -{{- if .Values.metrics.enabled }} +7. Observability +{{- if .Values.metrics.enabled }} Metrics endpoint: {{ include "memcached.metricsServiceName" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.metrics.port }}/metrics +{{- else }} +Metrics are disabled. {{- end }} -## Troubleshooting +8. Troubleshooting Inspect pods: kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} @@ -79,7 +88,7 @@ Inspect logs: Inspect events: kubectl get events -n {{ .Release.Namespace }} --sort-by=.lastTimestamp -## Resources +9. Resources Chart documentation: https://helmforge.dev/docs/charts/memcached @@ -87,7 +96,8 @@ Chart documentation: Upstream Memcached: https://memcached.org -Production reminders: +10. Production Reminders + - Memcached is a volatile cache, not a database. - Use distributed mode only with client-side hashing or application-aware node lists. - Enable NetworkPolicy with explicit client namespaces before exposing shared cache services. diff --git a/charts/memcached/templates/networkpolicy.yaml b/charts/memcached/templates/networkpolicy.yaml index 111005fef..cadfca36d 100644 --- a/charts/memcached/templates/networkpolicy.yaml +++ b/charts/memcached/templates/networkpolicy.yaml @@ -55,7 +55,7 @@ spec: [] {{- end }} {{- if .Values.networkPolicy.egress.enabled }} - {{- $allowEgress := or .Values.networkPolicy.egress.allowSameNamespace .Values.networkPolicy.egress.allowDNS .Values.networkPolicy.egress.allowHTTPS .Values.networkPolicy.egress.extraTo }} + {{- $allowEgress := or .Values.networkPolicy.egress.allowSameNamespace .Values.networkPolicy.egress.allowDNS .Values.networkPolicy.egress.allowHTTPS .Values.networkPolicy.egress.extraTo .Values.networkPolicy.extraEgress }} egress: {{- if $allowEgress }} {{- if .Values.networkPolicy.egress.allowSameNamespace }} @@ -88,6 +88,9 @@ spec: - to: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.networkPolicy.extraEgress }} + {{- toYaml . | nindent 4 }} + {{- end }} {{- else }} [] {{- end }} diff --git a/charts/memcached/tests/networkpolicy_test.yaml b/charts/memcached/tests/networkpolicy_test.yaml index 34ba5cc99..aff056b74 100644 --- a/charts/memcached/tests/networkpolicy_test.yaml +++ b/charts/memcached/tests/networkpolicy_test.yaml @@ -63,3 +63,27 @@ tests: - equal: path: spec.egress[0].to[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"] value: "false" + + - it: appends extra NetworkPolicy egress rules + set: + networkPolicy.enabled: true + networkPolicy.egress.enabled: true + networkPolicy.egress.allowSameNamespace: false + networkPolicy.egress.allowDNS: false + networkPolicy.extraEgress: + - to: + - ipBlock: + cidr: 10.80.0.0/16 + ports: + - protocol: TCP + port: 443 + asserts: + - contains: + path: spec.egress + content: + to: + - ipBlock: + cidr: 10.80.0.0/16 + ports: + - protocol: TCP + port: 443 diff --git a/charts/memcached/values.schema.json b/charts/memcached/values.schema.json index 52089094c..1a62a3efe 100644 --- a/charts/memcached/values.schema.json +++ b/charts/memcached/values.schema.json @@ -264,6 +264,10 @@ "additionalProperties": true, "properties": { "enabled": { "type": "boolean" }, + "extraEgress": { + "type": "array", + "items": { "type": "object" } + }, "egress": { "type": "object", "additionalProperties": true, diff --git a/charts/memcached/values.yaml b/charts/memcached/values.yaml index fc4ba9207..632497a59 100644 --- a/charts/memcached/values.yaml +++ b/charts/memcached/values.yaml @@ -145,6 +145,7 @@ networkPolicy: allowDNS: true allowHTTPS: false extraTo: [] + extraEgress: [] autoscaling: enabled: false From 1c300acc21e6b2c773a24c83acd8b45bd634320d Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Sun, 5 Jul 2026 10:33:18 -0300 Subject: [PATCH 2/2] fix(memcached): nest extra egress policy values --- charts/memcached/README.md | 4 ++-- charts/memcached/templates/networkpolicy.yaml | 4 ++-- charts/memcached/tests/networkpolicy_test.yaml | 2 +- charts/memcached/values.schema.json | 10 +++++----- charts/memcached/values.yaml | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/charts/memcached/README.md b/charts/memcached/README.md index ba2f65a53..10bfa0335 100644 --- a/charts/memcached/README.md +++ b/charts/memcached/README.md @@ -306,7 +306,7 @@ networkPolicy: enabled: true allowSameNamespace: true allowDNS: true - extraEgress: [] + extraEgress: [] ``` ## Important values @@ -332,7 +332,7 @@ networkPolicy: | `metrics.memcachedTLS.serverName` | computed Service DNS | TLS verification name used by the metrics exporter. | | `networkPolicy.enabled` | `false` | Enables NetworkPolicy resources. | | `networkPolicy.egress.allowSameNamespace` | `true` | Allows cache and metrics responses to same-namespace clients. | -| `networkPolicy.extraEgress` | `[]` | Additional full NetworkPolicy egress rules appended to generated egress. | +| `networkPolicy.egress.extraEgress` | `[]` | Additional full NetworkPolicy egress rules appended to generated egress. | | `pdb.maxUnavailable` | `""` | Optional PDB disruption limit. Explicit `0` is honored. | | `service.ipFamilyPolicy` | `""` | Optional Kubernetes Service dual-stack policy. | | `service.ipFamilies` | `[]` | Optional ordered Service IP families. | diff --git a/charts/memcached/templates/networkpolicy.yaml b/charts/memcached/templates/networkpolicy.yaml index cadfca36d..983ca74b6 100644 --- a/charts/memcached/templates/networkpolicy.yaml +++ b/charts/memcached/templates/networkpolicy.yaml @@ -55,7 +55,7 @@ spec: [] {{- end }} {{- if .Values.networkPolicy.egress.enabled }} - {{- $allowEgress := or .Values.networkPolicy.egress.allowSameNamespace .Values.networkPolicy.egress.allowDNS .Values.networkPolicy.egress.allowHTTPS .Values.networkPolicy.egress.extraTo .Values.networkPolicy.extraEgress }} + {{- $allowEgress := or .Values.networkPolicy.egress.allowSameNamespace .Values.networkPolicy.egress.allowDNS .Values.networkPolicy.egress.allowHTTPS .Values.networkPolicy.egress.extraTo .Values.networkPolicy.egress.extraEgress }} egress: {{- if $allowEgress }} {{- if .Values.networkPolicy.egress.allowSameNamespace }} @@ -88,7 +88,7 @@ spec: - to: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.networkPolicy.extraEgress }} + {{- with .Values.networkPolicy.egress.extraEgress }} {{- toYaml . | nindent 4 }} {{- end }} {{- else }} diff --git a/charts/memcached/tests/networkpolicy_test.yaml b/charts/memcached/tests/networkpolicy_test.yaml index aff056b74..40bef2684 100644 --- a/charts/memcached/tests/networkpolicy_test.yaml +++ b/charts/memcached/tests/networkpolicy_test.yaml @@ -70,7 +70,7 @@ tests: networkPolicy.egress.enabled: true networkPolicy.egress.allowSameNamespace: false networkPolicy.egress.allowDNS: false - networkPolicy.extraEgress: + networkPolicy.egress.extraEgress: - to: - ipBlock: cidr: 10.80.0.0/16 diff --git a/charts/memcached/values.schema.json b/charts/memcached/values.schema.json index 1a62a3efe..74862ca57 100644 --- a/charts/memcached/values.schema.json +++ b/charts/memcached/values.schema.json @@ -264,10 +264,6 @@ "additionalProperties": true, "properties": { "enabled": { "type": "boolean" }, - "extraEgress": { - "type": "array", - "items": { "type": "object" } - }, "egress": { "type": "object", "additionalProperties": true, @@ -275,7 +271,11 @@ "enabled": { "type": "boolean" }, "allowSameNamespace": { "type": "boolean" }, "allowDNS": { "type": "boolean" }, - "allowHTTPS": { "type": "boolean" } + "allowHTTPS": { "type": "boolean" }, + "extraEgress": { + "type": "array", + "items": { "type": "object" } + } } } } diff --git a/charts/memcached/values.yaml b/charts/memcached/values.yaml index 632497a59..ef4b6f13f 100644 --- a/charts/memcached/values.yaml +++ b/charts/memcached/values.yaml @@ -144,8 +144,8 @@ networkPolicy: allowSameNamespace: true allowDNS: true allowHTTPS: false + extraEgress: [] extraTo: [] - extraEgress: [] autoscaling: enabled: false