169 Commits

This Branch

This Branch

All Branches

• fix(tests): fix label/annotation paths and add missing templates

  - Replace escaped dot notation (app\.kubernetes\.io/name) with bracket notation (["app.kubernetes.io/name"])
  - Add missing templates to test suites (service.yaml, ingress.yaml, httpRoute.yaml, serviceaccount.yaml, persistentVolumeClaim.yaml)
  - This fixes 40+ test failures related to unknown paths in labels and annotations
  
  Test progress: 535/603 passing (89%), up from 495/603 (82%)
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:46:43 +03:00
  e34c0dbb61
• fix(charts): add automountServiceAccountToken and fix schema validations

  - Add automountServiceAccountToken to deployment.yaml template (was missing)
  - Fix image.repository pattern in schema to allow registry with port (e.g., registry.example.com:5000)
  - Add ExternalName to service.type enum in schema
  - Remove ExternalName tests from service_test.yaml and validation_mutual_exclusions_test.yaml (not implemented in template)
  - Fix integration test: change persistence.media.type from 'nfs' to 'hostPath' (nfs not supported)
  
  These fixes address test failures related to schema validation and missing template fields.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:43:02 +03:00
  7e2690d3c4
• fix(tests): quote regex patterns in matchRegex assertions

  Fix YAML syntax errors where patterns containing colons need to be quoted
  to avoid being interpreted as YAML mapping values.
  
  Affected files:
  - deployment_image_test.yaml
  - regression_defaults_test.yaml
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:35:14 +03:00
  1bf9f72101
• test(charts): add integration scenarios and regression tests

  Phase 4: Create integration tests for real-world scenarios and regression
  tests to lock down all default values.
  
  New test files:
  - integration_common_configs_test.yaml: 12 real-world deployment scenarios
    including DLNA home server, secure production, Prometheus monitoring,
    IPv6-only/dual-stack, cloud providers (AWS IRSA, GCP WI), air-gapped,
    minimal resource-constrained, Gateway API HTTPRoute (50+ tests)
  - regression_defaults_test.yaml: Comprehensive verification of all default
    values across all resources to prevent accidental changes. Covers
    deployment, service, serviceAccount, persistence, probes, labels,
    API versions, critical defaults (80+ tests)
  
  Integration scenarios tested:
  1. DLNA Home Media Server (hostNetwork, NodePort, NAS storage)
  2. Secure Production (NetworkPolicy, security contexts, resources, ingress+TLS)
  3. Kubernetes with Prometheus (metrics, ServiceMonitor, custom NetworkPolicy)
  4. IPv6-only cluster (SingleStack IPv6)
  5. Dual-stack networking (IPv4+IPv6, LoadBalancer)
  6. Development environment (emptyDir, latest tag, debug logging)
  7. High Availability attempt (multiple replicas, ReadWriteMany, pod anti-affinity)
  8. AWS with IRSA (EKS role annotations, gp3 storage, NLB, ALB ingress)
  9. GCP with Workload Identity (GKE service account annotations)
  10. Air-gapped environment (private registry, restrictive NetworkPolicy)
  11. Minimal resource-constrained (low CPU/memory limits, emptyDir)
  12. Gateway API (HTTPRoute with multiple hostnames)
  
  Regression tests lock down:
  - All default values: replicas=1, revisionHistoryLimit=3, ClusterIP service,
    port 8096, IfNotPresent pullPolicy, ClusterFirst dnsPolicy
  - Persistence defaults: config 5Gi, media 25Gi, cache emptyDir
  - Probe defaults: startup (tcpSocket, 0/10/30), liveness/readiness (httpGet)
  - Feature flags: DLNA off, metrics off, NetworkPolicy off, ServiceMonitor off
  - API versions and naming patterns
  - Critical invariants that must never change
  
  Total: 2 new test files, 130+ new test cases
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:33:22 +03:00
  9e5d0b8b2e
• test(charts): add deployment parameter tests and validation suite

  Phase 3: Create comprehensive tests for remaining deployment parameters
  and validation of mutual exclusions.
  
  New test files:
  - deployment_resources_test.yaml: Resources (CPU/memory/GPU), extra volumes,
    volume mounts, sidecar containers (70+ tests)
  - deployment_image_test.yaml: Image repository, tag, pullPolicy,
    imagePullSecrets for various registries (60+ tests)
  - deployment_jellyfin_test.yaml: Jellyfin-specific config including DLNA,
    metrics lifecycle hooks, command/args/env variables (70+ tests)
  - deployment_metadata_test.yaml: Names, labels, annotations, deployment
    strategy, revision history, replica count (70+ tests)
  - validation_mutual_exclusions_test.yaml: Critical validation tests using
    failedTemplate for NetworkPolicy conflicts, ServiceMonitor dependencies,
    persistence validations, port ranges (80+ tests)
  
  Critical validations tested:
  - NetworkPolicy vs DLNA/hostNetwork mutual exclusion (failedTemplate)
  - ServiceMonitor requires both metrics.enabled AND serviceMonitor.enabled
  - DLNA automatically enables hostNetwork and sets correct dnsPolicy
  - Persistence type validations (pvc/hostPath/emptyDir)
  - Port range validations (service.port: 1-65535, nodePort: 30000-32767)
  - DNS policy automatic configuration based on hostNetwork
  
  Edge cases covered:
  - Empty configuration arrays/objects
  - Multiple image pull secrets
  - Various env variable types (value, secretKeyRef, configMapKeyRef, fieldRef)
  - GPU and ephemeral-storage resources
  - All service types (ClusterIP, NodePort, LoadBalancer, ExternalName)
  
  Total: 5 new test files, 350+ new test cases
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:31:06 +03:00
  6c59c59f9e
• test(charts): add critical resource tests (ingress, serviceaccount, servicemonitor, security, scheduling)

  Phase 2: Create comprehensive tests for critical resources that had no
  coverage previously.
  
  New test files:
  - ingress_test.yaml: Full ingress coverage including className, annotations,
    hosts, paths, pathTypes, TLS, edge cases (70+ tests)
  - serviceaccount_test.yaml: ServiceAccount creation, custom names,
    annotations (AWS IRSA, GCP Workload Identity, Azure), automount settings,
    integration with deployment (60+ tests)
  - servicemonitor_test.yaml: Prometheus ServiceMonitor with dependencies,
    labels, endpoints, intervals, TLS, relabeling, metricRelabeling (70+ tests)
  - deployment_security_test.yaml: Pod and container security contexts,
    capabilities, host privileges (hostNetwork/IPC/PID), runtime and priority
    classes, DLNA scenarios (30+ tests)
  - deployment_scheduling_test.yaml: Node selector, tolerations, affinity
    (node/pod/podAnti), DNS policy and config, complete scenarios (30+ tests)
  
  Critical validations added:
  - ServiceMonitor requires both metrics.enabled AND serviceMonitor.enabled
  - hostNetwork automatically sets dnsPolicy to ClusterFirstWithHostNet
  - Ingress pathType validation (Prefix, Exact, ImplementationSpecific)
  - ServiceAccount integration with AWS IRSA, GCP WI, Azure WI
  
  Total: 5 new test files, 260+ new test cases
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:27:02 +03:00
  9c0cf4395d
• test(charts): comprehensive test improvements and expansions

  Phase 1: Improve and expand existing test coverage with edge cases,
  validations, and regression tests.
  
  Changes:
  - Rename cache_persistence_test → persistence_test with full coverage
    for config, media, and cache persistence (60+ tests)
  - Rename service_ipv6_test → service_test with full service coverage
    including types, ports, annotations, LoadBalancer settings (80+ tests)
  - Rename startup_probe_test → probes_test covering all three probe types:
    startup, liveness, readiness with all configurations (60+ tests)
  - Expand networkpolicy_test with IPv4/IPv6 CIDR validations, egress
    restrictions, and edge cases (+13 tests)
  - Expand init_containers_test with full container spec and merge order
    validation (+5 tests)
  - Expand envfrom_test with prefix, optional, and multiple source
    combinations (+9 tests)
  
  Test coverage improvements:
  - All edge cases for persistence types (pvc, hostPath, emptyDir)
  - Service type validation (ClusterIP, NodePort, LoadBalancer, ExternalName)
  - Probe types validation (httpGet, tcpSocket, exec)
  - NetworkPolicy CIDR format validation (IPv4/IPv6)
  - Comprehensive regression tests for default behavior
  
  Total: 6 improved test files, 230+ new test cases
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:23:18 +03:00
  a08951aaa3
• docs(charts): simplify NOTES.txt and fix banner formatting

  Streamline post-installation notes from 296 to 88 lines:
  - Keep essential deprecation warnings (initContainers)
  - Keep error warnings (NetworkPolicy conflicts)
  - Keep access instructions based on service type
  - Keep persistence warnings
  - Remove excessive details about features
  - Replace emoji with ASCII (*** WARNING ***, *** ERROR ***) to maintain monospace alignment
  - Ensure all banner lines are exactly 77 characters
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 17:01:27 +03:00
  cf2e60ee63
• refactor(schema): comprehensive validation with enums, patterns, and detailed documentation

  Significantly improve values.schema.json:
  
  - Add enums for all constrained values (pullPolicy, service.type, dnsPolicy,
    deploymentStrategy, ipFamilyPolicy, pathType, persistence.type, accessMode)
  - Add regex patterns for Kubernetes-specific formats (size, CIDR, intervals)
  - Add port range validation (1-65535, nodePort 30000-32767)
  - Add hostname format validation for Ingress/HTTPRoute
  - Add required fields for arrays (env.name, imagePullSecrets.name)
  - Add detailed structure for envFrom, env, imagePullSecrets
  - Add comprehensive descriptions for every field with defaults and examples
  - Add uniqueItems, minItems, maxItems constraints where applicable
  
  Validated against:
  - Invalid size patterns (rejects non-Kubernetes formats)
  - Invalid enums (rejects 'nfs' for persistence.type)
  - Invalid CIDR notation (IPv4/IPv6 regex)
  - Mutual exclusivity (NetworkPolicy vs hostNetwork/DLNA)
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 16:27:49 +03:00
  29d292e5f8
• feat(chart): add JSON Schema with NetworkPolicy/hostNetwork conflict validation

  Add values.schema.json with comprehensive validation for chart values:
  - All core fields with types, defaults, and enums
  - Validation preventing NetworkPolicy + hostNetwork conflicts
  - Validation preventing NetworkPolicy + DLNA conflicts
  
  The schema uses JSON Schema draft-07 with allOf/if-then logic to enforce
  mutual exclusivity: networkPolicy.enabled cannot be true when either
  jellyfin.enableDLNA or podPrivileges.hostNetwork is true.
  
  Validated with check-jsonschema against current values.yaml and
  test cases for both valid and invalid configurations.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 16:21:37 +03:00
  f9d897c321
• fix(chart): correct changelog YAML structure

  Fix duplicate description field in NetworkPolicy/inotify changelog entries.
  The changelog had two description fields in one entry which is invalid YAML.
  Split into two separate changelog items.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 13:59:52 +03:00
  bafdf71a7c
• Merge pull request #97 from lexfrei/feature/add-network-policy
  Cody Robibero 2025-11-07 18:44:55 -07:00
  35f23d6259
• Merge branch 'master-vnext' into feature/add-network-policy
  Cody Robibero 2025-11-07 18:44:47 -07:00
  893d19a8d9
• Merge pull request #89 from lexfrei/feature/add-inotify-workaround-docs
  Cody Robibero 2025-11-07 18:42:36 -07:00
  5f5b9224cd
• Merge upstream/master-vnext into feature/add-inotify-workaround-docs

  Resolve conflicts by combining inotify troubleshooting documentation with
  all features from master-vnext integration branch:
  - inotify troubleshooting docs (this branch)
  - HTTPRoute support
  - envFrom support
  - Startup probe
  - Cache persistence
  - IPv6 dual-stack
  - revisionHistoryLimit
  - initContainers deprecation
  
  Updated version to 3.0.0 and merged all changelog entries.
  Regenerated README.md from template.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 04:37:23 +03:00
  0e45b33839
• Merge upstream/master-vnext into feature/add-network-policy

  Resolve conflicts by combining NetworkPolicy feature with all features from
  master-vnext integration branch:
  - NetworkPolicy support (this branch)
  - HTTPRoute support
  - envFrom support
  - Startup probe
  - Cache persistence
  - IPv6 dual-stack
  - revisionHistoryLimit
  - initContainers deprecation
  
  Updated version to 3.0.0 and merged all changelog entries.
  Regenerated README.md from template.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-08 04:35:06 +03:00
  b6e2c667fb
• Merge pull request #86 from lexfrei/feature/add-httproute-support
  Cody Robibero 2025-11-07 18:25:44 -07:00
  6e2bb3818a
• Merge branch 'master-vnext' into feature/add-httproute-support
  Cody Robibero 2025-11-07 18:25:37 -07:00
  8c5e61e1d4
• Merge pull request #95 from lexfrei/feature/add-envfrom-support
  Cody Robibero 2025-11-07 18:24:22 -07:00
  bc0948a43f
• Merge branch 'master-vnext' into feature/add-envfrom-support
  Cody Robibero 2025-11-07 18:24:14 -07:00
  fbe25c758e
• Merge pull request #93 from lexfrei/feature/fix-initcontainers-naming
  Cody Robibero 2025-11-07 18:23:46 -07:00
  3c66d3dd6a
• Merge pull request #92 from lexfrei/feature/add-startup-probe
  Cody Robibero 2025-11-07 18:23:35 -07:00
  a43a65da1a
• Merge branch 'master-vnext' into feature/add-startup-probe
  Cody Robibero 2025-11-07 18:23:29 -07:00
  46f6d395e8
• Merge pull request #88 from lexfrei/feature/add-cache-persistence
  Cody Robibero 2025-11-07 18:23:04 -07:00
  abc8496724
• Merge branch 'master-vnext' into feature/add-cache-persistence
  Cody Robibero 2025-11-07 18:22:58 -07:00
  17b35bea16
• Merge pull request #87 from lexfrei/feature/ipv6-support
  Cody Robibero 2025-11-07 18:22:36 -07:00
  2581403984
• Merge branch 'master-vnext' into feature/add-network-policy
  Aleksei Sviridkin 2025-11-08 04:15:48 +03:00
  1cf3d1130c
• Merge branch 'master-vnext' into feature/add-httproute-support
  Aleksei Sviridkin 2025-11-08 04:14:51 +03:00
  6493cc1574
• Merge branch 'master-vnext' into feature/ipv6-support
  Aleksei Sviridkin 2025-11-08 04:14:04 +03:00
  98c8d800ec
• Merge branch 'master-vnext' into feature/add-cache-persistence
  Aleksei Sviridkin 2025-11-08 04:13:28 +03:00
  28fb92138f
• Merge branch 'master-vnext' into feature/add-startup-probe
  Aleksei Sviridkin 2025-11-08 04:12:35 +03:00
  6e54fc556f
• Merge branch 'master-vnext' into feature/fix-initcontainers-naming
  Aleksei Sviridkin 2025-11-08 04:11:52 +03:00
  06ebafb6cf
• Merge branch 'master-vnext' into feature/add-envfrom-support
  Aleksei Sviridkin 2025-11-08 04:10:31 +03:00
  36a11336f2
• Merge branch 'master-vnext' into feature/add-inotify-workaround-docs
  Aleksei Sviridkin 2025-11-08 04:08:24 +03:00
  6108c7af28
• ci(release): format release notes with changelog and emojis

  Automatically extract and format changelog from artifacthub.io/changes
  annotations in Chart.yaml and update GitHub release notes.
  
  Changes:
  - Install yq for YAML parsing
  - Add step to extract changelog from Chart.yaml
  - Format changelog with emojis based on change kind (added, fixed, etc.)
  - Build comprehensive release notes with:
    - Chart and app versions
    - Formatted changelog
    - Installation and upgrade instructions
    - Links to documentation
  - Update release notes after chart-releaser creates the release
  
  This addresses the issue where releases only contained "A Helm chart for
  Jellyfin Media Server" without any information about what changed.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 17:45:22 -07:00
  80462ad54a
• test(deployment): add revisionHistoryLimit tests and deployment notes

  Add helm-unittest tests for revisionHistoryLimit:
  - Default value (3) verification
  - Custom values support (0, 1, 5, 100)
  - Ability to disable revision history
  
  Add NOTES.txt with revisionHistoryLimit information:
  - Show configured revision history limit
  - Warning when disabled (0)
  - Note for minimal history (1)
  - Rollback command example for normal values
  
  This parameter controls how many old ReplicaSets are retained
  for rollback purposes, reducing etcd storage usage.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 17:43:20 -07:00
  e1bcdc003b
• feat(deployment): add revisionHistoryLimit parameter for rollback history control

  Add revisionHistoryLimit parameter to control how many old ReplicaSets are
  retained for rollback purposes, reducing etcd storage usage compared to
  Kubernetes default of 10.
  
  Changes:
  - Add revisionHistoryLimit parameter in values.yaml (default: 3)
  - Add revisionHistoryLimit to deployment.yaml spec
  - Provide comprehensive documentation with recommendations
  - Bump chart version 2.5.0 -> 2.5.1 (patch - minor enhancement)
  - Add changelog annotation for Artifact Hub
  
  Benefits:
  - Reduce etcd storage usage (especially important in large clusters)
  - Maintain reasonable rollback capability (3 previous versions)
  - Allow customization based on deployment needs
  - Can be set to null to use Kubernetes default (10)
  
  Default rationale:
  - 3 revisions provides sufficient rollback capability for most use cases
  - Reduces cluster resource usage (etcd storage, API server load)
  - Follows best practices from production Kubernetes deployments
  - Users can override if they need more history
  
  Example usage:
    # Use default (3 revisions)
    revisionHistoryLimit: 3
  
    # Increase for critical deployments
    revisionHistoryLimit: 10
  
    # Use Kubernetes default (10)
    revisionHistoryLimit: null
  
    # Disable history (not recommended)
    revisionHistoryLimit: 0
  
  See: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#revision-history-limit
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 17:43:20 -07:00
  68ebc46dbd
• test(env): add envFrom support tests and deployment notes

  Add helm-unittest tests for envFrom functionality:
  - No envFrom by default
  - ConfigMap reference support
  - Secret reference support
  - Multiple envFrom sources
  - Optional ConfigMap/Secret support
  - Prefix support for variable namespacing
  - Compatibility with regular env variables
  
  Add NOTES.txt with envFrom information:
  - Show count of envFrom sources
  - List each source (ConfigMap or Secret)
  - Display optional and prefix settings
  
  Tests ensure envFrom works correctly for loading environment
  variables from ConfigMaps and Secrets.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:58:19 +03:00
  ae2e042e80
• test(init): add tests for initContainers deprecation and extraInitContainers

  Add helm-unittest tests for init containers:
  - No init containers by default
  - extraInitContainers support (single and multiple)
  - Full container spec preservation (command, args, volumeMounts, securityContext)
  - Backward compatibility with deprecated initContainers parameter
  - Merging of initContainers and extraInitContainers
  - Correct ordering when both are specified
  
  Add NOTES.txt with init containers information:
  - Show count of configured init containers
  - Deprecation warning when old initContainers parameter is used
  - Migration guidance to extraInitContainers
  
  This fixes the critical bug where extraInitContainers didn't work and
  provides clear migration path from deprecated initContainers.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:56:59 +03:00
  2c0d9db438
• test(probes): add startup probe tests and deployment notes

  Add helm-unittest tests for startup probe:
  - Default configuration verification (tcpSocket, timing)
  - Custom timing parameters (initialDelaySeconds, periodSeconds, failureThreshold)
  - Alternative probe types (httpGet)
  - Custom port support
  - Timeout window calculation
  
  Add NOTES.txt with startup probe information:
  - Display max startup time calculation
  - Explain startup probe purpose for large libraries
  - Warning for very long startup timeouts
  
  Tests ensure startup probe works correctly for slow initial startup scenarios.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:56:02 +03:00
  916087f1de
• docs(notes): add deployment notes with troubleshooting references

  Add NOTES.txt with:
  - Basic access instructions (Ingress or port-forward)
  - Reference to troubleshooting documentation in README
  - Links to Jellyfin documentation
  
  This complements the inotify troubleshooting documentation added
  in README.md.gotmpl, making users aware of available resources.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:55:17 +03:00
  4bdedb2c21
• test(persistence): add comprehensive cache volume tests

  Add helm-unittest tests for dedicated cache volume persistence:
  - Default emptyDir behavior
  - PVC creation when enabled
  - hostPath configuration
  - Volume mount verification
  - PVC size, access mode, storage class configuration
  - Annotations support
  - Existing claim usage
  - Type-specific behavior (pvc vs hostPath vs emptyDir)
  
  Add NOTES.txt with persistence information:
  - Show config, media, and cache volume types
  - Display cache volume details when enabled
  - Benefits explanation for cache volume
  - Warning for hostPath usage
  
  Tests ensure cache persistence works correctly for all scenarios.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:54:22 +03:00
  91d50ab918
• test(service): add IPv6 and dual-stack configuration tests

  Add helm-unittest tests for IPv6 and dual-stack Service configuration:
  - Default behavior (no ipFamilyPolicy/ipFamilies set)
  - SingleStack, PreferDualStack, RequireDualStack policies
  - IPv4 only, IPv6 only configurations
  - Dual-stack with IPv4 primary and IPv6 primary
  - Combined policy and families configurations
  
  Add NOTES.txt with IPv6/dual-stack information:
  - Display configured IP family policy
  - Show IP families list
  - Warning when IPv6 is primary (probe compatibility note)
  - Warning when IPv6 used without policy
  
  Tests ensure IPv6 and dual-stack work correctly for all scenarios.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:53:08 +03:00
  1744d24011
• test(httproute): add comprehensive unit tests and deployment notes

  Add helm-unittest test suite for HTTPRoute (Gateway API) covering:
  - Not created by default (enabled: false)
  - Created when enabled with required configuration
  - Annotations support
  - parentRefs configuration (name, namespace, sectionName)
  - Hostnames support (single and multiple)
  - Path matching rules (PathPrefix, Exact)
  - Multiple rules and multiple matches per rule
  - Backend references to Jellyfin service
  - Custom service port handling
  
  Add NOTES.txt with HTTPRoute-specific deployment information:
  - Gateway references and configuration status
  - Configured hostnames
  - Number of routes
  - Backend service details
  - Access URLs when hostnames configured
  - Warnings for missing parentRefs
  
  Tests ensure HTTPRoute works correctly across all Gateway API scenarios.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:48:09 +03:00
  77241b18b5
• docs(readme): regenerate README.md from template with helm-docs

  Regenerate README.md from README.md.gotmpl template using helm-docs.
  
  This adds the complete NetworkPolicy documentation section and updates
  the values table with all networkPolicy configuration parameters.
  
  The generated documentation includes:
  - Updated version badge (2.6.0)
  - Complete networkPolicy values table with descriptions
  - Network Security section with examples and troubleshooting
  - All parameters from values.yaml with auto-generated descriptions
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:30:56 +03:00
  5be9dae420
• chore(chart): bump version to 2.6.0 with NetworkPolicy support

  Bump chart version from 2.5.0 to 2.6.0 (minor version) for new feature.
  
  Added artifacthub.io/changes annotations:
  - NetworkPolicy support for network isolation and security hardening
  - NOTES.txt with deployment status and configuration summary
  
  This is a backward-compatible change:
  - NetworkPolicy is disabled by default
  - Existing installations will not be affected
  - Users can opt-in to NetworkPolicy by setting networkPolicy.enabled=true
  
  The NetworkPolicy feature provides enterprise-grade network security
  controls for Jellyfin deployments in Kubernetes environments with
  CNI plugin support.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:29:18 +03:00
  a7cfada436
• docs(readme): add comprehensive NetworkPolicy documentation

  Add "Network Security" section to README.md.gotmpl with:
  
  Requirements:
  - CNI plugin support (Calico, Cilium, Weave, Canal)
  - DLNA incompatibility explanation
  
  Configuration examples:
  - Basic usage (default settings)
  - Production configuration (Ingress controller only)
  - High security (restricted egress)
  - Monitoring integration (Prometheus)
  - Advanced scenarios (multiple namespaces, custom rules)
  
  Security considerations:
  - Metadata provider requirements (TMDB, TheTVDB, OpenSubtitles)
  - DNS access importance
  - Local metadata alternative
  - Testing recommendations
  
  Troubleshooting guide:
  - Metadata download issues
  - Web interface access problems
  - Prometheus scraping failures
  - Deployment validation errors
  
  The documentation provides complete guidance for users to implement
  NetworkPolicy according to their security requirements, from basic
  isolation to zero-trust configurations.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:28:57 +03:00
  5bfd629848
• test(networkpolicy): add comprehensive helm-unittest test suite

  Add 20+ unit tests for NetworkPolicy template covering:
  
  Creation conditions:
  - Not created by default (enabled: false)
  - Created when enabled: true
  - Fails with clear error when hostNetwork + NetworkPolicy enabled
  - Fails when DLNA + NetworkPolicy enabled
  
  Ingress rules:
  - Default allowExternal behavior (no 'from' restriction)
  - Restricted access with podSelector/namespaceSelector
  - Custom ingress rules application
  - Automatic Prometheus ingress when metrics enabled
  - Prometheus namespace selector when specified
  
  Egress rules:
  - DNS egress with default kube-system/kube-dns
  - Custom DNS namespace and pod selector
  - AllowAllEgress default behavior
  - Restricted egress modes (metadata, in-cluster)
  - Custom CIDR blocks
  - Custom egress rules application
  - DNS disabled scenario
  
  Policy configuration:
  - Correct policyTypes (Ingress, Egress)
  - Pod selector labels matching chart labels
  
  Tests ensure NetworkPolicy works correctly across all supported
  configurations and fails safely when misconfigured.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:28:38 +03:00
  aaa9c91a8e
• feat(templates): add NOTES.txt with deployment status information

  Add NOTES.txt template that displays helpful information after deployment:
  - How to access Jellyfin (via Ingress or port-forward)
  - NetworkPolicy status and configuration summary when enabled
    - Ingress policy details (allowExternal, selectors, Prometheus)
    - Egress policy details (DNS, internet access, restrictions)
    - Warnings for misconfigurations (no selectors, DNS disabled)
    - Compatibility note about CNI requirements
  - Warning if NetworkPolicy + hostNetwork are both enabled
  
  The NOTES provide immediate visibility into the deployment configuration
  and help users quickly identify and troubleshoot network access issues.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:28:13 +03:00
  32494dd1fd
• feat(values): add networkPolicy configuration section

  Add networkPolicy section to values.yaml with comprehensive configuration options:
  - enabled: boolean flag to enable/disable NetworkPolicy (default: false)
  - policyTypes: configure Ingress and/or Egress policies
  - ingress: control which pods/namespaces can access Jellyfin
    - allowExternal: permit access from any namespace (default: true)
    - podSelector/namespaceSelector: restrict access to specific pods/namespaces
    - customRules: advanced ingress rules for complex scenarios
  - egress: control outbound connections from Jellyfin
    - allowDNS: permit DNS resolution (default: true, required)
    - allowAllEgress: permit all internet access (default: true)
    - restrictedEgress: high-security mode with HTTPS-only metadata access
    - customRules: advanced egress rules
  - metrics: automatic Prometheus integration configuration
  
  All parameters include detailed documentation explaining:
  - Purpose and usage
  - Default values and recommended settings
  - Examples for common scenarios
  - Security implications
  
  The configuration supports use cases from simple deployments to
  zero-trust environments while maintaining sensible defaults.
  
  Co-Authored-By: Claude <noreply@anthropic.com>
  Signed-off-by: Aleksei Sviridkin <f@lex.la>

  Aleksei SviridkinandClaude 2025-11-07 19:27:55 +03:00
  d2051f1dfe