Prepare durable isolated Vergabe pilot deployment and recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

charts/vergabe-teilnahme/templates/_helpers.tpl

@@ -21,8 +21,34 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "vergabe.image" -}}
+{{- if .Values.image.digest -}}
+{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}}
+{{- fail "image.digest must be a sha256 OCI digest" -}}
+{{- end -}}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- else -}}
 {{- if not .Values.image.tag -}}
 {{- fail "image.tag is required — pin it in helm/vergabe-teilnahme-values.yaml" -}}
 {{- end -}}
 {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
 {{- end -}}
+{{- end -}}
+
+{{- define "vergabe.validatePilot" -}}
+{{- if .Values.pilot.enabled -}}
+{{- if ne (int .Values.replicaCount) 1 -}}
+{{- fail "invited pilot requires exactly one application replica" -}}
+{{- end -}}
+{{- if or (not .Values.persistence.media.enabled) (not .Values.persistence.appState.enabled) -}}
+{{- fail "invited pilot requires persistent media and appState" -}}
+{{- end -}}
+{{- if not .Values.image.digest -}}
+{{- fail "invited pilot requires an immutable image.digest" -}}
+{{- end -}}
+{{- $mediaClaim := default (printf "%s-media" (include "vergabe.fullname" .)) .Values.persistence.media.existingClaim -}}
+{{- $stateClaim := default (printf "%s-app-state" (include "vergabe.fullname" .)) .Values.persistence.appState.existingClaim -}}
+{{- if eq $mediaClaim $stateClaim -}}
+{{- fail "media and appState must use distinct claims; operational state must not be downloadable" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/vergabe-teilnahme/templates/deployment.yaml

@@ -1,3 +1,4 @@
+{{- include "vergabe.validatePilot" . }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,10 +9,14 @@ spec:
   selector:
     matchLabels: {{- include "vergabe.selectorLabels" . | nindent 6 }}
   strategy:
+    {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
+    type: Recreate
+    {{- else }}
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 0
+    {{- end }}
   template:
     metadata:
       labels: {{- include "vergabe.selectorLabels" . | nindent 8 }}
@@ -59,16 +64,29 @@ spec:
             failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
           {{- end }}
           resources: {{- toYaml .Values.resources | nindent 12 }}
-          {{- if .Values.persistence.media.enabled }}
+          {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
           volumeMounts:
+            {{- if .Values.persistence.media.enabled }}
             - name: media
               mountPath: /app/media
+            {{- end }}
+            {{- if .Values.persistence.appState.enabled }}
+            - name: app-state
+              mountPath: /app/.issue-facade
+            {{- end }}
           {{- end }}
-      {{- if .Values.persistence.media.enabled }}
+      {{- if or .Values.persistence.media.enabled .Values.persistence.appState.enabled }}
       volumes:
+        {{- if .Values.persistence.media.enabled }}
         - name: media
           persistentVolumeClaim:
-            claimName: {{ include "vergabe.fullname" . }}-media
+            claimName: {{ default (printf "%s-media" (include "vergabe.fullname" .)) .Values.persistence.media.existingClaim }}
+        {{- end }}
+        {{- if .Values.persistence.appState.enabled }}
+        - name: app-state
+          persistentVolumeClaim:
+            claimName: {{ default (printf "%s-app-state" (include "vergabe.fullname" .)) .Values.persistence.appState.existingClaim }}
+        {{- end }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector: {{- toYaml . | nindent 8 }}

charts/vergabe-teilnahme/templates/service.yaml

@@ -11,12 +11,14 @@ spec:
       protocol: TCP
       name: http
   selector: {{- include "vergabe.selectorLabels" . | nindent 4 }}
-{{- if .Values.persistence.media.enabled }}
+{{- if and .Values.persistence.media.enabled (not .Values.persistence.media.existingClaim) }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: {{ include "vergabe.fullname" . }}-media
+  annotations:
+    helm.sh/resource-policy: keep
   labels: {{- include "vergabe.labels" . | nindent 4 }}
 spec:
   storageClassName: {{ .Values.persistence.media.storageClass }}
@@ -25,3 +27,19 @@ spec:
     requests:
       storage: {{ .Values.persistence.media.size }}
 {{- end }}
+{{- if and .Values.persistence.appState.enabled (not .Values.persistence.appState.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "vergabe.fullname" . }}-app-state
+  annotations:
+    helm.sh/resource-policy: keep
+  labels: {{- include "vergabe.labels" . | nindent 4 }}
+spec:
+  storageClassName: {{ .Values.persistence.appState.storageClass }}
+  accessModes: [{{ .Values.persistence.appState.accessMode }}]
+  resources:
+    requests:
+      storage: {{ .Values.persistence.appState.size }}
+{{- end }}