[kharkevich]

Summary

Adds what the floe chart (kharkevich-engineering-lab/floe, deploy/helm/floe) needs so it can stay a thin chart of one-line common.* calls, instead of re-implementing pieces locally. Bumps common to 2.5.0. Every new key is off unless set: an existing chart renders byte-for-byte the same.

Gap in 2.4.0 (evidence)	Added in 2.5.0
No PodDisruptionBudget template (no PodDisruptionBudget anywhere in templates/)	common.pdb (pdb.enabled, maxUnavailable / minAvailable, unhealthyPodEvictionPolicy), selector = common.labels.selector
_deployment.yaml pod spec has no topologySpreadConstraints; values can't express the selector because it depends on the fullname	topologySpread.topologyKeys → one constraint per key, labelSelector from common.labels.selector, matchLabelKeys: [pod-template-hash] (same style as antiAffinityLabels)
Pod spec: no terminationGracePeriodSeconds, nodeSelector, priorityClassName, enableServiceLinks, automountServiceAccountToken; pod metadata only gets the checksum/prometheus annotations and the standard labels	terminationGracePeriodSeconds, nodeSelector, priorityClassName, enableServiceLinks, automountServiceAccountToken (both only when the key is set), podLabels, podAnnotations
_healthcheck.yaml: httpGet has no scheme, so an app terminating TLS itself can't be probed; _container.yaml picks tcp/http for all three probes at once (healthCheck.kind)	healthCheck.scheme / <probe>.scheme; <probe>.kind overrides healthCheck.kind per probe (floe in ACME mode: tcp liveness/startup while it waits for a certificate, HTTPS readiness on /readyz)
common.persistentvolumeclaim creates a claim but nothing mounts it; common.volume.pvc is only usable from a template at a fixed indent, values can't name the claim (it's the fullname)	persistence.mountPath (+ persistence.volumeName, default data) adds the volume and the volumeMount
The ConfigMap is named common.fullname, so a values-only volumes entry can't mount it as a file; configmap.enabled only controls envFrom	configmap.mountPath (+ configmap.volumeName, default config) adds the configMap volume and a read-only mount
Monitors: the endpoint has only interval/port/path; an override can't add a field to it (the merge replaces the whole endpoints list); no way to add the release label a Prometheus selects by	monitoring.endpoint (merged into the endpoint: scheme, tlsConfig, authorization, …) and monitoring.labels on ServiceMonitor, PodMonitor and VMServiceScrape

Also a fix: common.service in the override form ((list . "app.service")) printed {} when service.enabled: false (an invalid manifest helm lint --strict rejects); it now renders nothing, like the single-context form.

The README now documents the templates and the new keys.

Compatibility

• charts/github-app-jwt2token-controller and charts/application-ingress, pointed at a local file:// copy of common 2.4.0 and then 2.5.0: helm template output is identical (diff empty).
• A scratch chart calling every common.* template with two values files using only 2.4.0 keys (one minimal, one setting nearly every key: tcp probes, NodePort, HPA, PVC, ingress, HTTPRoute, monitors, secrets, initContainers, …): identical output on 2.4.0 and 2.5.0.
• With the new keys set, the rendered manifests pass kubeconform -strict -kubernetes-version 1.33.0 (plus the datree CRD schemas for the monitors and HTTPRoute).

Not addressed here (noted for later)

• Several Deployments from one chart (floe's role split: a maintain instance next to the serving fleet). Every template reads .Values of the one context, so this needs a design (an instances map, or a documented context-per-instance pattern); the floe chart documents installing itself twice instead.
• Small existing quirks left alone so this stays non-breaking: probe/strategy values use default, so 0 means "use the default" (initialDelaySeconds: 0 becomes 180/40); resources.limits.cpu is always rendered (defaults to 1000m); the ServiceMonitor's targetPort is quoted, so a numeric port becomes a port name (use a port name); gateway.enabled defaults to true when the key is absent; common.volume.pvc only renders correctly at one indent.

Merging this lets the release workflow publish common 2.5.0 to oci://ghcr.io/technicaldomain/helm, which the floe chart PR waits for.

🤖 Generated with Claude Code