Prepare durable isolated Vergabe pilot deployment and recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

charts/vergabe-teilnahme/Chart.yaml

@@ -4,7 +4,7 @@ description: |
   Vergabe Teilnahme — internal Django tender/bid management web app.
   Single-instance v1 deployment; HA and canary are deferred.
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "0.1.0"
 keywords:
   - django

charts/vergabe-teilnahme/templates/_helpers.tpl

@@ -21,8 +21,34 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "vergabe.image" -}}
+{{- if .Values.image.digest -}}
+{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}}
+{{- fail "image.digest must be a sha256 OCI digest" -}}
+{{- end -}}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- else -}}
 {{- if not .Values.image.tag -}}
 {{- fail "image.tag is required — pin it in helm/vergabe-teilnahme-values.yaml" -}}
 {{- end -}}
 {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
 {{- end -}}
+{{- end -}}
+
+{{- define "vergabe.validatePilot" -}}
+{{- if .Values.pilot.enabled -}}
+{{- if ne (int .Values.replicaCount) 1 -}}
+{{- fail "invited pilot requires exactly one application replica" -}}
+{{- end -}}
+{{- if or (not .Values.persistence.media.enabled) (not .Values.persistence.appState.enabled) -}}
+{{- fail "invited pilot requires persistent media and appState" -}}
+{{- end -}}
+{{- if not .Values.image.digest -}}
+{{- fail "invited pilot requires an immutable image.digest" -}}
+{{- end -}}
+{{- $mediaClaim := default (printf "%s-media" (include "vergabe.fullname" .)) .Values.persistence.media.existingClaim -}}
+{{- $stateClaim := default (printf "%s-app-state" (include "vergabe.fullname" .)) .Values.persistence.appState.existingClaim -}}
+{{- if eq $mediaClaim $stateClaim -}}
+{{- fail "media and appState must use distinct claims; operational state must not be downloadable" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/vergabe-teilnahme/templates/deployment.yaml

@@ -1,3 +1,4 @@
+{{- include "vergabe.validatePilot" . }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,10 +9,14 @@ spec:
   selector:
     matchLabels: {{- include "vergabe.selectorLabels" . | nindent 6 }}
   strategy:
+    {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
+    type: Recreate
+    {{- else }}
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 0
+    {{- end }}
   template:
     metadata:
       labels: {{- include "vergabe.selectorLabels" . | nindent 8 }}
@@ -59,16 +64,29 @@ spec:
             failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
           {{- end }}
           resources: {{- toYaml .Values.resources | nindent 12 }}
-          {{- if .Values.persistence.media.enabled }}
+          {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
           volumeMounts:
+            {{- if .Values.persistence.media.enabled }}
             - name: media
               mountPath: /app/media
+            {{- end }}
+            {{- if .Values.persistence.appState.enabled }}
+            - name: app-state
+              mountPath: /app/.issue-facade
+            {{- end }}
           {{- end }}
-      {{- if .Values.persistence.media.enabled }}
+      {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
       volumes:
+        {{- if .Values.persistence.media.enabled }}
         - name: media
           persistentVolumeClaim:
-            claimName: {{ include "vergabe.fullname" . }}-media
+            claimName: {{ default (printf "%s-media" (include "vergabe.fullname" .)) .Values.persistence.media.existingClaim }}
+        {{- end }}
+        {{- if .Values.persistence.appState.enabled }}
+        - name: app-state
+          persistentVolumeClaim:
+            claimName: {{ default (printf "%s-app-state" (include "vergabe.fullname" .)) .Values.persistence.appState.existingClaim }}
+        {{- end }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector: {{- toYaml . | nindent 8 }}

charts/vergabe-teilnahme/templates/service.yaml

@@ -11,12 +11,14 @@ spec:
       protocol: TCP
       name: http
   selector: {{- include "vergabe.selectorLabels" . | nindent 4 }}
-{{- if .Values.persistence.media.enabled }}
+{{- if and .Values.persistence.media.enabled (not .Values.persistence.media.existingClaim) }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: {{ include "vergabe.fullname" . }}-media
+  annotations:
+    helm.sh/resource-policy: keep
   labels: {{- include "vergabe.labels" . | nindent 4 }}
 spec:
   storageClassName: {{ .Values.persistence.media.storageClass }}
@@ -25,3 +27,19 @@ spec:
     requests:
       storage: {{ .Values.persistence.media.size }}
 {{- end }}
+{{- if and .Values.persistence.appState.enabled (not .Values.persistence.appState.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "vergabe.fullname" . }}-app-state
+  annotations:
+    helm.sh/resource-policy: keep
+  labels: {{- include "vergabe.labels" . | nindent 4 }}
+spec:
+  storageClassName: {{ .Values.persistence.appState.storageClass }}
+  accessModes: [{{ .Values.persistence.appState.accessMode }}]
+  resources:
+    requests:
+      storage: {{ .Values.persistence.appState.size }}
+{{- end }}

charts/vergabe-teilnahme/values.yaml

@@ -1,10 +1,15 @@
 image:
   repository: forgejo.coulomb.social/coulomb/vergabe-teilnahme
   tag: ""             # required; pinned via helm/vergabe-teilnahme-values.yaml
+  digest: ""          # preferred; takes precedence over tag
   pullPolicy: IfNotPresent
 
 replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
 
+# An invited company pilot requires an immutable image and both data volumes.
+pilot:
+  enabled: false
+
 service:
   type: ClusterIP
   port: 80
@@ -19,8 +24,7 @@ resources:
     memory: 1Gi
 
 # Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
-# Holds SECRET_KEY + DATABASE_URL. Created by the operator with kubectl
-# create secret generic vergabe-teilnahme-env --from-literal=...
+# Holds SECRET_KEY + DATABASE_URL. Deliver via the admitted platform custody lane.
 envSecretName: vergabe-teilnahme-env
 
 # Non-secret env injected directly into the Deployment.
@@ -45,14 +49,21 @@ probes:
     timeoutSeconds: 5
     failureThreshold: 3
 
-# PVC for media uploads is deferred — Django MEDIA is in-pod ephemeral
-# for v1. Switch to true + a storageClass once media uploads land.
+# Existing installations remain opt-in. Pilot mode refuses ephemeral state.
+# PVCs are retained on Helm uninstall; a verified off-host backup is still required.
 persistence:
   media:
     enabled: false
     storageClass: local-path
     size: 5Gi
     accessMode: ReadWriteOnce
+    existingClaim: ""
+  appState:
+    enabled: false
+    storageClass: local-path
+    size: 1Gi
+    accessMode: ReadWriteOnce
+    existingClaim: ""
 
 podSecurityContext:
   runAsNonRoot: true