feat: commonAnnotations, Fusillade strategy and grace period, and API-only extra env and volumes

FE
13d ago
+355-10

Adds values that let internal render the control layer with native Argo CD Helm sources, instead of patching the chart's output with helmfile transformers. All of them default to empty, so default renders are unchanged. Nothing restarts until internal sets the new values.

New values

  • commonAnnotations: annotations added to every rendered object, hooks included. Where an object sets the same key itself (the migration hooks' sync waves, serviceAccount.annotations, the keystore StorageClass), the object's own value wins. Pod checksums are computed without them (control-layer.checksum), so setting or changing them rolls no pods.
  • fusillade.strategy, fusillade.terminationGracePeriodSeconds: the Fusillade Deployments' rollout strategy and pod termination grace period, overridable per daemon under fusillade.split.<daemon>. When unset, nothing is rendered and Kubernetes' defaults apply.
  • extraEnv, extraVolumes, extraVolumeMounts: env vars (as EnvVar entries), volumes and mounts for the API pods only; Fusillade doesn't inherit them. They render before the chart's own entries, so on a duplicate env name the chart's own value wins.

Verified

  • helm template on main and on this branch is byte-identical for 8 value sets: defaults, ServiceMonitor, external database, split and single Fusillade, keystore with managed StorageClass and ServiceAccount annotations, the migration Job, and heap profiling with bootstrap, email templates and model provisioning.
  • I rendered internal's Curie production control-layer release (chart 1.10.0 values) against this chart, setting the new values instead of internal's transformers. Against today's patched render, all 19 objects match except the migration Job's two checksum annotations, which change because the hook config's wave is set explicitly. The Job is a PreSync hook recreated on every sync, so this rolls nothing. Internal's internal-git-sha provenance annotation, which nothing reads, was excluded from the comparison.
  • helm unittest .: 158 passed, including new cases in tests/common_annotations_test.yaml, tests/fusillade_deployment_test.yaml and tests/control_layer_deployment_test.yaml. helm lint and just test pass.

https://claude.ai/code/session_016Z9n119xkLAjqeNAWncB8R