BUG/MINOR: haproxy: gate PSP Role and RoleBinding on k8s < 1.25, update appVersion to 3.4.4

[dkorunic]

Same defect as #384, found while reviewing all three charts for Kubernetes 1.37 compatibility.

Problem

podsecuritypolicy.yaml:17 is gated behind semverCompare "<1.25.0-0", but role.yaml:17 and rolebinding.yaml:17 — which grant use on that PodSecurityPolicy — were gated only on rbac.create and podSecurityPolicy.enabled.

On Kubernetes 1.25+ with podSecurityPolicy.enabled=true, the chart rendered a Role granting use on policy/podsecuritypolicies (API removed in 1.25) plus its RoleBinding, while the PodSecurityPolicy itself was correctly omitted.

RBAC rules are not validated against discovery, so these applied without error — dead configuration. The practical harm is that podSecurityPolicy.enabled=true looked effective on clusters where it can no longer do anything.

Fix

Add the same version gate to both templates so all three objects appear and disappear as a unit.

Verification

Rendered across the chart’s full >=1.17 support range:

kube-version	PodSecurityPolicy	Role	RoleBinding
1.17.0	1	1	1
1.19.0	1	1	1
1.24.9	1	1	1
1.25.0	0	0	0
1.26.0	0	0	0
1.37.0	0	0	0
v1.37.1-gke.1000	0	0	0
1.37.0+k3s1	0	0	0

• ./test/local-test.sh haproxy — 38 passed, 0 failed
• ./test/ct-test.sh lint haproxy — ✔︎ passed

Chart version bumped 1.30.1 → 1.30.2 (patch; bugfix), with the artifacthub.io/changes list replaced by this release’s entry.

Notes

• No behaviour change below 1.25 — the PSP path is untouched.
• On 1.25+, existing installs will have the orphaned Role/RoleBinding removed on next helm upgrade. They were inert, but it is a resource deletion worth a changelog line.
• Not addressed here (cosmetic, separate concern): podsecuritypolicy.yaml:22 branches on .Capabilities.APIVersions.Has "policy/v1/PodSecurityPolicy", but PSP never graduated to policy/v1 — that branch is permanently false and falls through to policy/v1beta1. Harmless, since the file is gated off above 1.25.

---

Second commit: appVersion 3.4.3 → 3.4.4

Moves the chart to the HAProxy 3.4.4 base image. values.yaml has image.tag: "", which falls back to the chart appVersion, so the appVersion bump is what moves the rendered image; the artifacthub.io/images annotation is updated to match.

Verified:

• docker.io/haproxytech/haproxy-alpine:3.4.4 exists upstream (amd64 + arm64, pushed 2026-09-03)
• Deployment and DaemonSet both render haproxy-alpine:3.4.4 by default
• An explicit --set image.tag=3.4.2 override still takes precedence
• No stale 3.4.3 references remain anywhere in the chart
• local-test.sh haproxy 38/38 passed, ct-test.sh lint haproxy passed

Both changes ship under the single 1.30.2 bump since neither has been released yet.