fix(ontoserver): reject scaledReadOnly overrides from the config passthroughs

The chart sets ontoserver.internal.deployment.scaledReadOnly on scaled
deployments, but ontoserver.config and ontoserver.secretConfig render after it in
the container's env list. Kubernetes does not reject duplicate env names and the
later entry is the one that applies, so a passthrough copy silently overrode the
chart and re-enabled scaled read-write while still satisfying the isReadOnly
guard. Removing allowScaledReadWrite in 0.5.1 closed one route to that topology
and left this one open.

Validation now rejects the key in either passthrough. Matching is normalised —
lowercased with _ and - folded to . — so the dotted name, the older all-lowercase
spelling, and the uppercase underscored environment form are all caught, since
Spring resolves the property from any of them.

existingSecretConfig and externalSecret are deliberately not checked: their
contents are opaque at render time, and they arrive via envFrom, which Kubernetes
applies before the container's own env, so the chart's entry still wins.

Author: attilaedelenyi

charts/ontoserver/README.md

@@ -83,7 +83,11 @@ The chart supports four deployment combinations controlled by `ontoserver.deploy
 > on any scaled deployment**: setting `ontoserver.deployment.scaled` makes the server reject writes
 > regardless of what else is configured, so a scaled read-write server is not a topology that exists.
 > The chart therefore refuses to render `type: scaled` with `isReadOnly: false` rather than deploy
-> something that cannot work.
+> something that cannot work. It also rejects an `ontoserver.config` or `ontoserver.secretConfig`
+> entry for `ontoserver.internal.deployment.scaledReadOnly`: the passthroughs render after the
+> chart's own env entry and a later duplicate wins at runtime, so such a copy would quietly
+> contradict the chart. All spellings Spring accepts are matched, including the uppercase
+> underscored environment form.
 >
 > Load content with a **single-instance read-write** deployment, then publish it to a syndication
 > server and serve it from a **scaled read-only** cluster. See

charts/ontoserver/templates/validate-values.yaml

@@ -124,6 +124,28 @@
   {{- fail "Scaled deployments must set ontoserver.deployment.isReadOnly: true. Ontoserver forces read-only on a scaled deployment, and each replica has its own Lucene index, so content written through the round-robin Service is only indexed on the replica that served the write and $expand/$validate-code fail on the others. Load content with a single-instance read-write deployment, then serve it scaled and read-only." }}
 {{- end }}
 
+{{- /* The chart sets ontoserver.internal.deployment.scaledReadOnly itself on scaled deployments.
+     The config passthroughs render after that entry in the container's env list, and a later
+     duplicate wins, so a passthrough copy would silently override the chart and re-enable the
+     unsupported scaled read-write topology while still passing the isReadOnly guard above.
+     Reject it instead of rendering a manifest that contradicts itself.
+
+     Matching is normalised because Spring resolves a property from the environment in several
+     forms: the dotted name, an older all-lowercase spelling of it, and the uppercase underscored
+     form. Lowercasing and folding _ and - to . collapses all of them to one comparison.
+
+     Not checked, because it cannot be: existingSecretConfig and externalSecret contents are
+     opaque at render time. They arrive via envFrom, which Kubernetes applies *before* the
+     container's own env, so the chart's entry still wins there. */ -}}
+{{- $reserved := "ontoserver.internal.deployment.scaledreadonly" }}
+{{- range $section, $entries := dict "ontoserver.config" (.Values.ontoserver.config | default dict) "ontoserver.secretConfig" (.Values.ontoserver.secretConfig | default dict) }}
+  {{- range $key, $value := $entries }}
+    {{- if eq ($key | lower | replace "_" "." | replace "-" ".") $reserved }}
+      {{- fail (printf "%s must not set %s. Scaled read-write is not supported: Ontoserver forces read-only on a scaled deployment and the chart sets this itself, so a passthrough copy would only produce a manifest whose env list contradicts itself. Remove the entry. To serve content read-write, use a single-instance deployment." $section $key) }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+
 {{- if and (eq .Values.ontoserver.deployment.kind "StatefulSet") .Values.ontoserver.deployment.persistence.files.existingVolume.enabled }}
   {{- fail "StatefulSet deployments do not support ontoserver.deployment.persistence.files.existingVolume. Each replica needs its own volume; use dynamic provisioning via storageClass or a Deployment for single-instance prebound volumes." }}
 {{- end }}

charts/ontoserver/tests/validate_values_test.yaml

@@ -204,6 +204,59 @@ tests:
       - failedTemplate:
           errorMessage: "Scaled deployments must set ontoserver.deployment.isReadOnly: true. Ontoserver forces read-only on a scaled deployment, and each replica has its own Lucene index, so content written through the round-robin Service is only indexed on the replica that served the write and $expand/$validate-code fail on the others. Load content with a single-instance read-write deployment, then serve it scaled and read-only."
 
+  # The chart sets scaledReadOnly itself, and the config passthroughs render after it, so a
+  # duplicate would win at runtime and re-enable scaled read-write while still passing the
+  # isReadOnly guard. Each accepted spelling must be rejected.
+  - it: rejects a scaledReadOnly override in ontoserver.config
+    values:
+      - fixtures/scaled-values.yaml
+    set:
+      ontoserver.config:
+        ontoserver.internal.deployment.scaledReadOnly: "false"
+    asserts:
+      - failedTemplate:
+          errorPattern: "ontoserver\\.config must not set .*Scaled read-write is not supported"
+
+  - it: rejects the older lowercase scaledReadonly spelling
+    values:
+      - fixtures/scaled-values.yaml
+    set:
+      ontoserver.config:
+        ontoserver.internal.deployment.scaledReadonly: "false"
+    asserts:
+      - failedTemplate:
+          errorPattern: "must not set .*Scaled read-write is not supported"
+
+  - it: rejects the uppercase underscored environment form
+    values:
+      - fixtures/scaled-values.yaml
+    set:
+      ontoserver.config:
+        ONTOSERVER_INTERNAL_DEPLOYMENT_SCALEDREADONLY: "false"
+    asserts:
+      - failedTemplate:
+          errorPattern: "must not set ONTOSERVER_INTERNAL_DEPLOYMENT_SCALEDREADONLY"
+
+  - it: rejects a scaledReadOnly override in ontoserver.secretConfig
+    values:
+      - fixtures/scaled-values.yaml
+    set:
+      ontoserver.secretConfig:
+        ontoserver.internal.deployment.scaledReadOnly: "false"
+    asserts:
+      - failedTemplate:
+          errorPattern: "ontoserver\\.secretConfig must not set"
+
+  # The guard must not catch unrelated passthrough entries.
+  - it: allows other ontoserver.config entries on a scaled deployment
+    values:
+      - fixtures/scaled-values.yaml
+    set:
+      ontoserver.config:
+        ontoserver.fhir.closureTable.max: "500"
+    asserts:
+      - notFailedTemplate: {}
+
   # A single-instance deployment is the supported way to load content, so read-write there
   # must stay legal — the guard has to key on `type`, not on isReadOnly alone.
   - it: allows a single read-write deployment