packages/system/foundationdb-operator/charts/fdb-operator/crds/apps.foundationdb.org_foundationdbrestores.yaml (4)

66-70: Tighten destinationClusterName validation to DNS-1123 label.

This field references a Kubernetes object name; add basic constraints.

               destinationClusterName:
-                type: string
+                type: string
+                minLength: 1
+                maxLength: 63
+                pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'

---

39-59: Clarify required fields for blobStoreConfiguration; add CEL guard.

As written, only accountName is required. Usually a location (e.g., bucket or backupName) must also be provided. Align with upstream contract and enforce via CEL.

               blobStoreConfiguration:
                 properties:
                   accountName:
                     maxLength: 100
                     type: string
                   backupName:
                     maxLength: 1024
                     type: string
                   bucket:
                     maxLength: 63
                     minLength: 3
                     type: string
                   urlParameters:
                     items:
                       maxLength: 1024
                       type: string
                     maxItems: 100
                     type: array
                 required:
                   - accountName
                 type: object
+                x-kubernetes-validations:
+                  - rule: "has(self.bucket) || has(self.backupName)"
+                    message: "Provide at least one of bucket or backupName."

If upstream requires different fields, mirror that instead.

---

20-27: Expose destination in printer columns for quick UX.

Adds a useful column without changing behavior.

   - additionalPrinterColumns:
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
     - jsonPath: .status.state
       name: State
       type: string
+    - jsonPath: .spec.destinationClusterName
+      name: Destination
+      type: string
     name: v1beta2

---

1-3: CRD upgrade caveat with Helm: document/plan CRD lifecycle.

CRDs under charts/*/crds aren't upgraded by helm upgrade. Plan for manual CRD updates or separate chart, and note it in release notes/migration docs.

packages/system/foundationdb-operator/.helmignore (1)

1-1: Keep Makefile out of the chart — LGTM; consider anchoring and wildcard.

Works as-is. Minor nit: anchor to chart root and ignore possible variants.

-Makefile
+/Makefile
+/Makefile.*

packages/apps/foundationdb/.helmignore (1)

1-1: LGTM; same nit about anchoring/wildcard.

Keeps build helper out of package. Optional improvement below.

-Makefile
+/Makefile
+/Makefile.*

packages/system/foundationdb-operator/values.yaml (2)

1-4: Cluster-scoped RBAC enabled — confirm intent and PoLP.

fdb-operator.globalMode.enabled: true creates ClusterRole/ClusterRoleBinding; nodeReadClusterRole: true adds node read permissions. Confirm this is required for your multi-namespace deployment; otherwise prefer namespace-scoped Roles (set globalMode.enabled: false) to reduce blast radius. Also verify the subchart is named fdb-operator so these values are correctly scoped.

---

4-4: Add trailing newline.

Fix YAML linter warning.

-  nodeReadClusterRole: true
+  nodeReadClusterRole: true
+

packages/system/foundationdb-operator/Chart.yaml (1)

3-3: Add trailing newline.

Fix YAML lint error.

-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+

packages/apps/foundationdb/values.yaml (1)

73-73: Add trailing newline.

Fix YAML lint error.

-  automaticReplacements: true
+  automaticReplacements: true
+

packages/apps/foundationdb/values.schema.json (2)

112-161: Conditionally require backup fields when enabled.

Guardrails to prevent half‑configured backups.

Example:

 }
-  }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "backup": { "properties": { "enabled": { "const": true } } } } },
+      "then": {
+        "properties": {
+          "backup": {
+            "properties": {
+              "s3": {
+                "required": ["bucket", "region"]
+              }
+            }
+          }
+        }
+      }
+    }
+  ]

---

66-81: Optionally restrict storage.size format.

Add a pattern to catch typos (e.g., “16Gii”).

         "size": {
           "type": "string",
           "default": "16Gi",
           "title": "Storage size",
-          "description": "Size of persistent volumes for each instance"
+          "description": "Size of persistent volumes for each instance",
+          "pattern": "^[0-9]+(Ki|Mi|Gi|Ti)$"
         },

packages/system/foundationdb-operator/Makefile (2)

6-19: Parametrize upstream, add safety flags, and .PHONY.

Improve maintainability and robustness; address checkmake hints.

+SHELL := /bin/bash
+FDB_OPERATOR_TAG ?= v2.13.0
+.PHONY: update clean all test
+
 update:
-	rm -rf charts
-	git clone --depth 1 --branch v2.13.0 https://github.com/FoundationDB/fdb-kubernetes-operator.git tmp-repo
+	set -euo pipefail
+	rm -rf charts tmp-repo
+	git clone --depth 1 --branch $(FDB_OPERATOR_TAG) https://github.com/FoundationDB/fdb-kubernetes-operator.git tmp-repo
 	mkdir -p charts
 	cp -r tmp-repo/charts/fdb-operator charts/
 	# Remove symlinked CRDs and replace with actual files
 	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbbackups.yaml
 	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbclusters.yaml
 	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbrestores.yaml
 	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbbackups.yaml charts/fdb-operator/crds/
 	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbclusters.yaml charts/fdb-operator/crds/
 	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbrestores.yaml charts/fdb-operator/crds/
-	rm -rf tmp-repo
+	rm -rf tmp-repo
 	rm -rf charts/fdb-operator/charts

Also keep Chart.yaml dependency version in sync with $(FDB_OPERATOR_TAG).

---

6-6: Target length warning.

Consider factoring CRD copy into a helper target if your lint enforces max body length.

packages/system/foundationdb-operator/charts/fdb-operator/templates/NOTES.txt (1)

3-6: Polish NOTES phrasing and kubectl example.

Minor grammar and use the common “deploy” shorthand.

-To see the logs of the operator you can use below command
-kubectl logs deployment/{{ include "fdb-operator.fullname" . }} -n {{ .Release.Namespace }} -f
+To see operator logs, run:
+kubectl logs deploy/{{ include "fdb-operator.fullname" . }} -n {{ .Release.Namespace }} -f

packages/apps/foundationdb/Makefile (1)

3-4: Declare .PHONY and add a no‑op test/clean to satisfy linters.

Keeps local tooling quiet and consistent with other packages.

 include ../../../scripts/package.mk
 
+.PHONY: generate test clean all
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+
+test:
+	@true
+clean:
+	@true
+all: generate

packages/apps/foundationdb/Chart.yaml (1)

25-25: Add trailing newline.

Fix YAML lint error.

-appVersion: "7.4.1"
+appVersion: "7.4.1"
+

packages/system/foundationdb-operator/charts/fdb-operator/Chart.yaml (1)

3-3: Nit: fix capitalization and tighten metadata

Use “FoundationDB” capitalization in the description; consider adding kubeVersion and icon for polish.

-description: A Helm chart for foundationDB operator
+description: A Helm chart for the FoundationDB Operator

packages/system/foundationdb-operator/charts/fdb-operator/templates/rbac/serviceaccount.yaml (1)

9-16: Ensure imagePullSecrets shape matches SA schema

Kubernetes expects imagePullSecrets as [{name: ...}]. If values can be strings, this will render invalid YAML. Enforce object shape in values.schema or normalize here.

-{{- with .Values.serviceAccount.imagePullSecrets }}
-imagePullSecrets:
-  {{- toYaml . | nindent 2 }}
-{{- end }}
+{{- with .Values.serviceAccount.imagePullSecrets }}
+imagePullSecrets:
+  {{- range . }}
+  - {{- if kindIs "string" . -}}
+    name: {{ . }}
+    {{- else -}}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}

packages/apps/foundationdb/README.md (1)

61-72: Don’t encourage inline cloud credentials

Recommend Secret/secretRef over embedding keys in values. Replace the example with secretRef to avoid copy-paste leaks.

-  s3:
-    bucket: "my-fdb-backups"
-    endpoint: "https://s3.amazonaws.com"
-    region: "us-east-1"
-    credentials:
-      accessKeyId: "AKIA..."
-      secretAccessKey: "..."
+  s3:
+    bucket: "my-fdb-backups"
+    endpoint: "https://s3.amazonaws.com"
+    region: "us-east-1"
+    secretRef:
+      name: "fdb-backup-s3"

packages/system/foundationdb-operator/charts/fdb-operator/templates/rbac/rbac_role_binding.yaml (1)

21-25: Always set ServiceAccount namespace in subjects

Be explicit for both RoleBinding and ClusterRoleBinding to avoid ambiguity and future refactors moving the binding across namespaces.

 subjects:
 - kind: ServiceAccount
   name: {{ include "fdb-operator.serviceAccountName" . }}
-  {{- if .Values.globalMode.enabled }}
-  namespace: {{ .Release.Namespace }}
-  {{- end }}
+  namespace: {{ .Release.Namespace }}

hack/e2e-apps/foundationdb.bats (1)

47-49: Use fully qualified resource for Flux HelmRelease to reduce alias issues

Some clusters won’t have the hr shortname. Use the full GVK.

-  kubectl -n tenant-test wait hr foundationdb-\$name --timeout=180s --for=condition=ready
+  kubectl -n tenant-test wait helmrelease.helm.toolkit.fluxcd.io foundationdb-\$name --timeout=180s --for=condition=ready

packages/apps/foundationdb/templates/backup.yaml (4)

11-14: Prefer stringData over pre‑base64 encoding for Secrets.

Avoids accidental double-encoding and improves ergonomics.

Apply this diff:

 type: Opaque
-data:
-  AWS_ACCESS_KEY_ID: {{ .Values.backup.s3.credentials.accessKeyId | b64enc }}
-  AWS_SECRET_ACCESS_KEY: {{ .Values.backup.s3.credentials.secretAccessKey | b64enc }}
+stringData:
+  AWS_ACCESS_KEY_ID: {{ .Values.backup.s3.credentials.accessKeyId | quote }}
+  AWS_SECRET_ACCESS_KEY: {{ .Values.backup.s3.credentials.secretAccessKey | quote }}

---

42-44: Run as non‑root unless strictly required.

Root in backup pods is unnecessary in most setups; align with operator’s non-root posture.

Apply this diff:

-            securityContext:
-              runAsUser: 0
+            securityContext:
+              runAsNonRoot: true
+              runAsUser: 4059
+              runAsGroup: 4059
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop: ["ALL"]

If the backup image truly needs root, please justify and scope privileges minimally.

---

7-11: Unify labels via chart helper for consistency.

Reuse the shared labels helper to prevent drift across templates.

Apply this diff:

   labels:
-    app.kubernetes.io/name: foundationdb
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "foundationdb.labels" . | nindent 4 }}

(Repeat the same replacement for the FoundationDBBackup metadata.labels.)

Also applies to: 22-24

---

56-64: Optional: allow using an existing Secret instead of creating one.

Common pattern: gate Secret creation and reference an externally‑managed secret.

I can send a follow-up patch adding:

• Values: backup.s3.existingSecretName, backup.s3.createSecret (default true)
• Conditional Secret rendering and reference.
  Want me to draft it?

packages/system/foundationdb-operator/charts/fdb-operator/values.yaml (3)

49-55: Consider lowering manager CPU requests or documenting rationale.

500m request/limit is high for idle operators; 100–200m is typical unless load-tested.

Apply this diff if appropriate:

 resources:
   limits:
-    cpu: 500m
+    cpu: 200m
     memory: 256Mi
   requests:
-    cpu: 500m
+    cpu: 100m
     memory: 256Mi

---

2-5: Supply‑chain hardening: support digest pinning.

Expose optional image.digest fields to allow tag+digest pinning.

I can open a small PR to add:

• values: image.digest, initContainers.*.image.digest
• template: use “repository@digest” when set, else fall back to tag.

---

70-70: Double‑check need for node‑read ClusterRole by default.

If not strictly required, default to false and document when to enable.

packages/apps/foundationdb/templates/_resources.tpl (1)

11-18: Labels helper looks good; ensure templates consume it consistently.

Several templates handcraft labels; prefer this helper everywhere.

packages/system/foundationdb-operator/charts/fdb-operator/templates/_helpers.tpl (1)

37-41: Version label source is reasonable; minor tweak.

If image.tag carries a “v” prefix inconsistently, consider falling back to Chart.AppVersion when tag is unset.

packages/system/foundationdb-operator/charts/fdb-operator/templates/manager/deployment.yaml (3)

43-67: Deterministic init container ordering.

Map iteration order is non-deterministic; sort versions for stable manifests.

Apply this diff:

-      {{- range $version, $params := .Values.initContainers }}
+      {{- $keys := keys .Values.initContainers | sortAlpha -}}
+      {{- range $idx, $version := $keys -}}
+      {{- $params := index $.Values.initContainers $version -}}
       - name: foundationdb-kubernetes-init-{{ $version | replace "." "-" }}
         image: {{ $params.image.repository }}:{{ $params.image.tag }}
         imagePullPolicy: {{ $params.image.pullPolicy }}
         args:

---

93-99: Add readinessProbe alongside liveness.

Avoids serving metrics-only readiness as a proxy; but minimally mirror liveness to readiness.

Apply this diff:

         livenessProbe:
           httpGet:
             path: /metrics
             port: metrics
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: metrics

---

35-41: Harden security context with seccomp profile.

Set RuntimeDefault at pod/container level.

Apply this diff:

       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
+        seccompProfile:
+          type: RuntimeDefault
@@
         securityContext:
           {{- toYaml .Values.containerSecurityContext | nindent 10 }}
+          seccompProfile:
+            type: RuntimeDefault

Also applies to: 91-99

packages/apps/foundationdb/templates/cluster.yaml (2)

6-9: Use shared labels helper for consistency.

Prefer the chart helper to avoid label drift.

Apply this diff:

   labels:
-    app.kubernetes.io/name: foundationdb
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "foundationdb.labels" . | nindent 4 }}

---

46-49: Reuse the resources helper consistently.

You already defined foundationdb.resources; use it instead of calling cozy‑lib directly.

Apply this diff:

-              resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resources.preset .Values.resources $) | nindent 16 }}
+              resources: {{- include "foundationdb.resources" . | nindent 16 }}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/apps/foundationdb/values.yaml (2)

84-90: Default to non‑root; gate root behind an explicit flag.

Running containers as UID/GID 0 by default is risky. Default to non‑root and disallow privilege escalation; allow opt‑out only if images require root.

Apply:

 securityContext:
-  runAsUser: 0
-  runAsGroup: 0
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 1001
+  allowPrivilegeEscalation: false

If some images need root, add an advanced.allowRoot: true flag and conditionally render 0 in templates.

---

64-67: Stop inlining S3 credentials; switch to Secret refs.

Plaintext keys in values are unsafe and leak via ConfigMaps and Git history. Use a Secret reference instead and adapt templates to read it.

Apply:

 backup:
   enabled: false
   s3:
     bucket: ""
     endpoint: ""
     region: "us-east-1"
-    credentials:
-      accessKeyId: ""
-      secretAccessKey: ""
+    secretRef:
+      name: ""            # required: Secret name in the release namespace
+      accessKeyKey: accessKeyId
+      secretKeyKey: secretAccessKey

Follow-up: update templates to consume .Values.backup.s3.secretRef via envFrom/secretKeyRef or lookup. Also document required Secret keys.

packages/apps/foundationdb/templates/cluster.yaml (1)

16-23: Move faultDomain to spec.faultDomain (not under automationOptions).

The CRD expects faultDomain at the top level of spec; nesting under automationOptions will be ignored/invalid. (github.com)

Apply:

   automationOptions:
     replacements:
       enabled: {{ .Values.automaticReplacements }}
-    faultDomain:
-      key: {{ .Values.cluster.faultDomain.key }}
-      {{- if .Values.cluster.faultDomain.valueFrom }}
-      valueFrom: {{ .Values.cluster.faultDomain.valueFrom }}
-      {{- end }}
-    imageType: {{ .Values.imageType }}
+  faultDomain:
+    key: {{ .Values.cluster.faultDomain.key }}
+    {{- if .Values.cluster.faultDomain.valueFrom }}
+    valueFrom: {{ .Values.cluster.faultDomain.valueFrom }}
+    {{- end }}

Place this block right under version/processCounts.

packages/apps/foundationdb/values.yaml (1)

92-92: Add trailing newline.

YAMLlint flags missing newline at EOF.

Apply:

-automaticReplacements: true
+automaticReplacements: true
+

packages/apps/foundationdb/values.schema.json (2)

267-290: Extend securityContext and default to non‑root.

Reflect values.yaml change: add runAsNonRoot and allowPrivilegeEscalation; default uid/gid to 1001. Remove hard “required” to allow partial overrides.

Apply:

 "securityContext": {
   "description": "Security context for containers",
   "type": "object",
-  "default": {
-    "runAsGroup": 0,
-    "runAsUser": 0
-  },
-  "required": [
-    "runAsGroup",
-    "runAsUser"
-  ],
+  "default": {
+    "runAsNonRoot": true,
+    "allowPrivilegeEscalation": false,
+    "runAsGroup": 1001,
+    "runAsUser": 1001
+  },
   "properties": {
+    "runAsNonRoot": {
+      "description": "Require the container to run as a non-root user",
+      "type": "boolean",
+      "default": true
+    },
     "runAsGroup": {
       "description": "Group ID to run the container",
-      "type": "integer",
-      "default": 0
+      "type": "integer",
+      "default": 1001,
+      "minimum": 0
     },
     "runAsUser": {
       "description": "User ID to run the container",
-      "type": "integer",
-      "default": 0
+      "type": "integer",
+      "default": 1001,
+      "minimum": 0
+    },
+    "allowPrivilegeEscalation": {
+      "description": "Whether a process can gain more privileges than its parent process",
+      "type": "boolean",
+      "default": false
     }
   }
 }

---

298-301: Make storageClass optional.

Requiring storageClass forces users to set an empty string to pass validation. Prefer optional to inherit the cluster default.

Apply:

   "required": [
-    "size",
-    "storageClass"
+    "size"
   ],

packages/apps/foundationdb/templates/cluster.yaml (2)

13-15: Silence yamllint by avoiding left‑trim in templating.

Change “{{- … | nindent 4 }}” to “{{ … | nindent 4 }}” so linters don’t choke on “{{-” after a mapping key.

Apply:

-  processCounts:
-    {{- toYaml .Values.cluster.processCounts | nindent 4 }}
+  processCounts:
+    {{ toYaml .Values.cluster.processCounts | nindent 4 }}

---

48-49: Propagate full security context and prefer podSecurityContext when possible.

Once values add runAsNonRoot/allowPrivilegeEscalation, render them here. Consider setting pod-level fsGroup if volumes require it.

Apply:

-              securityContext:
-                {{- toYaml .Values.securityContext | nindent 16 }}
+              securityContext:
+                {{ toYaml .Values.securityContext | nindent 16 }}
@@
-              securityContext:
-                {{- toYaml .Values.securityContext | nindent 16 }}
+              securityContext:
+                {{ toYaml .Values.securityContext | nindent 16 }}
@@
-              securityContext:
-                {{- toYaml .Values.securityContext | nindent 16 }}
+              securityContext:
+                {{ toYaml .Values.securityContext | nindent 16 }}

Optional pod template addition (if needed for storage permissions):

podSecurityContext:
  fsGroup: 1001

Also applies to: 58-59, 69-70

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/system/foundationdb-operator/charts/fdb-operator/crds/apps.foundationdb.org_foundationdbrestores.yaml (2)

29-37: Make spec mandatory at the top level.

Add required: [spec] under openAPIV3Schema to enforce structural schema and prevent empty objects.

       openAPIV3Schema:
         properties:
           apiVersion:
             type: string
           kind:
             type: string
           metadata:
             type: object
+        required:
+        - spec
         type: object

---

71-84: Relax overly restrictive regex for keyRanges bounds.

^[A-Za-z0-9\/\\-]+$ will reject valid FDB keys (including empty bounds and non‑ASCII bytes). Prefer length guards.

                   properties:
                     end:
-                      pattern: ^[A-Za-z0-9\/\\-]+$
-                      type: string
+                      type: string
+                      maxLength: 4096
                     start:
-                      pattern: ^[A-Za-z0-9\/\\-]+$
-                      type: string
+                      type: string
+                      maxLength: 4096
                   required:
                     - end
                     - start

If empty bounds should be allowed, either drop required or add minLength: 0 while keeping both required. Please confirm with operator semantics.

packages/system/foundationdb-operator/Chart.yaml (1)

1-3: Missing subchart dependency; operator chart won’t package/install the upstream chart.

Declare fdb-operator as a local file dependency so Helm renders it.

 apiVersion: v2
 name: cozy-foundationdb-operator
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+dependencies:
+  - name: fdb-operator
+    version: 2.13.0
+    repository: "file://charts/fdb-operator"

packages/apps/foundationdb/values.yaml (2)

58-67: Don’t embed cloud keys in values; switch to Secret ref.

Avoid committing plaintext credentials or passing them via Helm values. Prefer a Secret reference the chart reads.

Apply (values shape):

 backup:
   enabled: false
   s3:
     bucket: ""
     endpoint: ""
     region: "us-east-1"
-    credentials:
-      accessKeyId: ""
-      secretAccessKey: ""
+    secretRef:
+      name: ""            # Secret with AWS creds
+      accessKeyKey: AWS_ACCESS_KEY_ID
+      secretKeyKey: AWS_SECRET_ACCESS_KEY

Then update templates to use secretRef and skip creating a Secret when provided (see backup.yaml comment).

---

84-90: Default to non‑root; allow opt‑out if images require root.

Running as UID/GID 0 by default is risky in multi‑tenant setups. Default to runAsNonRoot with an override flag if needed.

Apply:

 securityContext:
-  runAsUser: 0
-  runAsGroup: 0
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  runAsUser: 1001
+  runAsGroup: 1001

If root is required, add an explicit .Values.advanced.allowRoot and gate the root context in templates.

packages/apps/foundationdb/templates/cluster.yaml (1)

16-33: Fix CRD field placement: move faultDomain, imageType, labels, minimumUptimeSecondsForBounce to top level.

In v1beta2, these are top‑level under spec, not spec.automationOptions. Keeping them under automationOptions makes the operator ignore them.

Apply:

 spec:
   version: {{ .Values.cluster.version | quote }}
+  faultDomain:
+    key: {{ .Values.cluster.faultDomain.key }}
+    {{- if .Values.cluster.faultDomain.valueFrom }}
+    valueFrom: {{ .Values.cluster.faultDomain.valueFrom }}
+    {{- end }}
+  imageType: {{ .Values.imageType }}
+  labels:
+    filterOnOwnerReference: false
+    matchLabels:
+      foundationdb.org/fdb-cluster-name: {{ .Release.Name }}
+    processClassLabels:
+      - foundationdb.org/fdb-process-class
+    processGroupIDLabels:
+      - foundationdb.org/fdb-process-group-id
+  minimumUptimeSecondsForBounce: 60
-  automationOptions:
-    replacements:
-      enabled: {{ .Values.automaticReplacements }}
-    faultDomain:
-      key: {{ .Values.cluster.faultDomain.key }}
-      {{- if .Values.cluster.faultDomain.valueFrom }}
-      valueFrom: {{ .Values.cluster.faultDomain.valueFrom }}
-      {{- end }}
-    imageType: {{ .Values.imageType }}
-    labels:
-      filterOnOwnerReference: false
-      matchLabels:
-        foundationdb.org/fdb-cluster-name: {{ .Release.Name }}
-      processClassLabels:
-        - foundationdb.org/fdb-process-class
-      processGroupIDLabels:
-        - foundationdb.org/fdb-process-group-id
-    minimumUptimeSecondsForBounce: 60
+  automationOptions:
+    replacements:
+      enabled: {{ .Values.automaticReplacements }}

• spec.faultDomain belongs at top level. (github.com)
• spec.imageType is a top‑level field for unified/split images. (github.com)
• spec.labels and spec.minimumUptimeSecondsForBounce are top‑level, not under automationOptions. (forums.foundationdb.org)

Also applies to: 81-86

packages/apps/foundationdb/templates/backup.yaml (2)

3-15: Avoid creating a Secret from values; support SecretRef and fallback.

Prefer consuming an existing Secret via values.s3.secretRef; only create a Secret when no ref is provided.

Apply:

-apiVersion: v1
-kind: Secret
+{{- if not .Values.backup.s3.secretRef.name }}
+apiVersion: v1
+kind: Secret
 metadata:
   name: {{ .Release.Name }}-s3-creds
 ...
 data:
   AWS_ACCESS_KEY_ID: {{ .Values.backup.s3.credentials.accessKeyId | b64enc }}
   AWS_SECRET_ACCESS_KEY: {{ .Values.backup.s3.credentials.secretAccessKey | b64enc }}
+{{- end }}

And update credentials below to reference either the provided SecretRef or this fallback Secret (see diff further down).

---

50-55: Fix S3 mapping: don’t set accountName to the bucket; pass region via urlParameters.

• accountName is the credential/host part (e.g., user@host[:port]), not the bucket.
• Region is typically provided via URL parameters for S3 endpoints.

Apply:

   blobStoreConfiguration:
-    accountName: {{ .Values.backup.s3.bucket }}
     bucket: {{ .Values.backup.s3.bucket }}
-    {{- if .Values.backup.s3.endpoint }}
-    endpoint: {{ .Values.backup.s3.endpoint }}
-    {{- end }}
+    {{- if .Values.backup.s3.endpoint }}
+    endpoint: {{ .Values.backup.s3.endpoint }}
+    {{- end }}
+    {{- if or .Values.backup.s3.region .Values.backup.s3.endpoint }}
+    urlParameters:
+    {{- if .Values.backup.s3.region }}
+      - region={{ .Values.backup.s3.region }}
+    {{- end }}
+    {{- end }}

Example usage with urlParameters is shown in operator community examples. (forums.foundationdb.org)

packages/system/foundationdb-operator/charts/fdb-operator/crds/apps.foundationdb.org_foundationdbrestores.yaml (1)

71-84: Optional: add a CEL guard for range ordering.

If lexicographic order is expected, add a per‑item validation to catch swapped bounds.

                 items:
                   properties:
                     end:
                       type: string
                       maxLength: 4096
                     start:
                       type: string
                       maxLength: 4096
                   required:
                     - end
                     - start
+                  x-kubernetes-validations:
+                  - rule: "has(self.start) && has(self.end) ? self.start <= self.end : true"
+                    message: "keyRanges.start must be <= keyRanges.end (lexicographic)"
                   type: object

Confirm that lexicographic comparison matches controller expectations for key encoding.

packages/system/foundationdb-operator/Makefile (2)

6-19: Refactor update flow: parameterize version/repo, add PHONY + smaller targets, future‑proof CRD vendoring, and satisfy checkmake.

• Add REPO/VERSION vars instead of hardcoding v2.13.0.
• Split the long recipe into short phony targets (addresses maxbodylength; adds all/clean/test that checkmake expects).
• Replace explicit CRD filenames with a glob to handle upstream additions.
• Keep behavior identical otherwise.

Apply this diff:

 export NAME=foundationdb-operator
 export NAMESPACE=cozy-$(NAME)
 
 include ../../../scripts/package.mk
 
-update:
-	rm -rf charts
-	git clone --depth 1 --branch v2.13.0 https://github.com/FoundationDB/fdb-kubernetes-operator.git tmp-repo
-	mkdir -p charts
-	cp -r tmp-repo/charts/fdb-operator charts/
-	# Remove symlinked CRDs and replace with actual files
-	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbbackups.yaml
-	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbclusters.yaml
-	rm -f charts/fdb-operator/crds/apps.foundationdb.org_foundationdbrestores.yaml
-	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbbackups.yaml charts/fdb-operator/crds/
-	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbclusters.yaml charts/fdb-operator/crds/
-	cp tmp-repo/config/crd/bases/apps.foundationdb.org_foundationdbrestores.yaml charts/fdb-operator/crds/
-	rm -rf tmp-repo
-	rm -rf charts/fdb-operator/charts
+REPO    ?= https://github.com/FoundationDB/fdb-kubernetes-operator.git
+VERSION ?= v2.13.0
+
+.PHONY: all update clean clean-charts fetch-operator vendor-crds prune-subcharts cleanup test
+
+all: update
+
+clean:
+	rm -rf charts tmp-repo
+
+update: clean-charts fetch-operator vendor-crds prune-subcharts cleanup
+
+clean-charts:
+	rm -rf charts
+
+fetch-operator:
+	git clone --depth 1 --branch $(VERSION) $(REPO) tmp-repo
+	mkdir -p charts
+	cp -r tmp-repo/charts/fdb-operator charts/
+
+vendor-crds:
+	# Replace symlinked CRDs with actual files
+	rm -f charts/fdb-operator/crds/*.yaml
+	cp tmp-repo/config/crd/bases/*.yaml charts/fdb-operator/crds/
+
+prune-subcharts:
+	rm -rf charts/fdb-operator/charts
+
+cleanup:
+	rm -rf tmp-repo
+
+test:
+	helm lint charts/fdb-operator || true

Notes:

• If you prefer strict control over CRD filenames, keep the three rm/cp lines but consider a brief comment explaining the choice.
• If CI relies on different test tooling than Helm, adjust the test target accordingly.

---

6-6: Add failure‑resilient cleanup.

If a mid‑recipe command fails, tmp-repo may be left behind. The refactor into separate targets helps, but if you keep a single recipe, use .ONESHELL with trap to ensure cleanup. Otherwise, the split targets + cleanup target as shown are fine.

packages/system/foundationdb-operator/values.yaml (1)

4-4: Add missing newline at EOF.

Minor formatting to satisfy linters.

-  nodeReadClusterRole: true
+  nodeReadClusterRole: true
+

packages/system/foundationdb-operator/Chart.yaml (1)

3-3: Add newline at EOF.

Keep linters quiet.

-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+

packages/system/foundationdb-operator/charts/fdb-operator/templates/manager/deployment.yaml (1)

93-99: Add a readinessProbe to avoid routing traffic before the manager is ready.

Small resiliency improvement; the livenessProbe alone may cause flaps during startup.

         livenessProbe:
           httpGet:
             path: /metrics
             port: metrics
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: metrics
+          initialDelaySeconds: 3
+          periodSeconds: 10

packages/apps/foundationdb/templates/workloadmonitor.yaml (1)

11-19: Version field likely should reflect FDB version, not chart packaging version.

WorkloadMonitor.spec.version is typically used to track app/runtime version; using .Chart.Version (0.1.0) may be misleading versus FDB 7.4.1. Prefer .Chart.AppVersion or .Values.cluster.version.

Apply this diff:

-  version: {{ .Chart.Version }}
+  version: {{ .Chart.AppVersion | default .Values.cluster.version | quote }}

Please confirm the expected semantics of WorkloadMonitor.version in Cozystack.

packages/apps/foundationdb/Makefile (1)

3-4: Mark phony targets and add a simple default.

Prevents accidental file/target collisions and satisfies checkmake hints.

Apply:

+.PHONY: all generate clean test
+
+all: generate
+
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+
+clean:
+	@true
+
+test:
+	@true

packages/apps/foundationdb/values.yaml (1)

58-68: Unused retentionPolicy value.

retentionPolicy is not wired in templates; either implement or remove to avoid dead config.

I can wire this into backup customParameters or document a retention workflow if you prefer.

packages/apps/foundationdb/templates/backup.yaml (1)

56-65: Make credentials source switchable to SecretRef.

Allow using an existing Secret when provided; otherwise reference the fallback Secret created above.

Apply:

     credentials:
       AWS_ACCESS_KEY_ID:
         secretKeyRef:
-          name: {{ .Release.Name }}-s3-creds
-          key: AWS_ACCESS_KEY_ID
+          name: {{ default (printf "%s-s3-creds" .Release.Name) .Values.backup.s3.secretRef.name }}
+          key: {{ default "AWS_ACCESS_KEY_ID" .Values.backup.s3.secretRef.accessKeyKey }}
       AWS_SECRET_ACCESS_KEY:
         secretKeyRef:
-          name: {{ .Release.Name }}-s3-creds
-          key: AWS_SECRET_ACCESS_KEY
+          name: {{ default (printf "%s-s3-creds" .Release.Name) .Values.backup.s3.secretRef.name }}
+          key: {{ default "AWS_SECRET_ACCESS_KEY" .Values.backup.s3.secretRef.secretKeyKey }}

Please validate against v2.13.0 CRD behavior in your env; some providers require additional urlParameters (e.g., secure_connection). (forums.foundationdb.org)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro