Helm chart is not production-shaped

[ren-jentic]

Follow-up from the #1142 review (register IDs: F-03, F-04, F-07, G-09–G-13, G-30, G-31, D-06, L-01, L-06, L-11, X-02, X-08, N-03). Evidence in the review laps: 1, 2, 3, 5, 7.

The documented production Helm install has structural gaps the docs partially hedge:

• No JENTIC_ENV=production on the OSS path, so the placeholder-secret guard silently generates per-process ephemeral secrets instead of failing (F-03).
• "Set the shared-state backend to Redis before scaling out" is not executable on the published image — the redis extra is not installed (F-04).
• Bundled-DB migrate hook is post-install,post-upgrade, so new pods serve on the old schema until the Job finishes; should be pre-upgrade + post-install (G-09).
• LOG_FORMAT/LOG_LEVEL env vars documented in the chart README are read by nothing (G-10).
• Values-file DB passwords are corrupted by YAML number coercion (password: 0123456789 renders 1.23456789e+08); a kindIs "string" + fail guard is a two-line fix (G-12).
• No securityContext on any application subchart (no runAsNonRoot, readOnlyRootFilesystem, capabilities.drop), no Ingress/PDB/HPA/NetworkPolicy — while docs/security/README.md prescribes exactly that checklist (G-13, X-02).
• Omitting global.image.tag silently deploys :latest; the _image.tpl comment claims a warning that is never printed (G-30).
• extraEnv renders before the chart's own env helpers, so on duplicate keys the chart always beats the operator (G-31).
• Default helm install scaling advice exceeds the bundled Postgres max_connections (100) at 2 processes (D-06).
• Air-gapped installs need docker.io/postgres, otel, and gateway pulls that the transfer section never lists (G-11).
• Bundled Postgres PVC is 8Gi, immutable via volumeClaimTemplates, documented nowhere (L-06).
• trusted_proxies defaults empty and is documented only on the path without an ingress — behind the ingress helm.md mandates, the whole fleet shares one rate-limit bucket (X-08).
• jti single-use is process-local; multi-replica auth replays inside the 300 s window; the Redis-before-scale-out list omits it (M-12-adjacent, filed here for the chart shape).

Partially addressed on the branch already: memory requests/limits for app/admin raised to 256Mi/1Gi (L-01/N-01), --timeout 30m documented, external-DB secret shapes corrected (F-01/F-02).

[jentic-harness]

[Orchestrator] Session started — ai-intake

[jentic-harness]

[IssueIntakeAgent]

Thanks for opening this issue. Here's the automated triage:

Type	bug
Area	area:deploy
Product fit	fit:high
Feasibility	feasibility:med
Severity	severity:major

Why this triage?

Author (ren-jentic) reports a set of concrete, mostly-broken behaviours in the production Helm chart, filed as a follow-up to a prior PR review: DB passwords corrupted by YAML numeric coercion, omitting the image tag silently deploying :latest against a template comment that promises a never-printed warning, extraEnv precedence overriding chart env helpers, a migrate hook that serves the old schema until the Job finishes, documented LOG_FORMAT/LOG_LEVEL env vars read by nothing, and a placeholder-secret guard that silently mints per-process ephemeral secrets without JENTIC_ENV=production. These are defects present on main, so type=bug over enhancement, despite the bundle also including hardening gaps (no securityContext/Ingress/PDB/HPA/NetworkPolicy). Area is deploy — this is entirely about the Helm/k8s chart, which product-scope lists as in-scope. Fit is high: it improves security, correctness, and operability of the deploy surface for the self-hosting operator, and several items touch credential/auth safety (ephemeral signing secrets, process-local jti allowing multi-replica token replay, a fleet-wide shared rate-limit bucket behind the ingress) — principles 1 and 3. Severity=major: significant security/operability impact with workarounds available (set env manually, use an external DB), not a no-workaround blocker. Feasibility is med rather than high: individual fixes are small (e.g. a kindIs "string" + fail guard, hook annotation changes), but the aggregate spans many items plus packaging the redis extra and giving jti shared state, which is meaningful combined effort. No candidate issue matches — all candidates concern the /authorize/auth flow, not deploy — so no duplicate. The report is highly detailed (register IDs, evidence links, per-item fixes), so no author info is missing. No forward-looking product call or injection signal, so no needs-human.

---

_{🤖 Auto-triaged by the intake harness — labels reflect an automated assessment a maintainer may adjust. Replying re-runs intake.}