fix(helm): address review feedback and CI failures

- Fix HTTPRoute template YAML structure: emit list dash unconditionally
  per rule so match-less catch-all rules produce valid YAML arrays
- Update artifacthub.io/changes annotation in Chart.yaml
- Regenerate README.md via helm-docs
- Add httpRoute and externalSecret fields to values.schema.json

Author: jonasschultheiss

helm/defectdojo/Chart.yaml

@@ -34,4 +34,8 @@ dependencies:
 #     description: Critical bug
 annotations:
   artifacthub.io/prerelease: "true"
-  artifacthub.io/changes: ""
+  artifacthub.io/changes: |
+    - kind: added
+      description: Add Gateway API HTTPRoute support as an alternative to Ingress
+    - kind: added
+      description: Add External Secrets Operator (ESO) support for external secret stores

helm/defectdojo/README.md

@@ -618,6 +618,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | django.extraInitContainers | list | `[]` | A list of additional initContainers to run before the uwsgi and nginx containers. |
 | django.extraVolumeMounts | list | `[]` | Array of additional volume mount points common to all containers and initContainers. |
 | django.extraVolumes | list | `[]` | A list of extra volumes to mount. |
+| django.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"labels":{},"parentRefs":[],"rules":[]}` | Kubernetes Gateway API HTTPRoute configuration (alternative to Ingress) |
 | django.ingress.activateTLS | bool | `true` |  |
 | django.ingress.annotations | object | `{}` | Restricts the type of ingress controller that can interact with our chart (nginx, traefik, ...) `kubernetes.io/ingress.class: nginx` Depending on the size and complexity of your scans, you might want to increase the default ingress timeouts if you see repeated 504 Gateway Timeouts `nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"` `nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"` |
 | django.ingress.enabled | bool | `true` |  |
@@ -683,6 +684,12 @@ A Helm chart for Kubernetes to install DefectDojo
 | django.uwsgi.startupProbe.periodSeconds | int | `5` |  |
 | django.uwsgi.startupProbe.successThreshold | int | `1` |  |
 | django.uwsgi.startupProbe.timeoutSeconds | int | `1` |  |
+| externalSecret | object | `{"annotations":{},"data":[],"enabled":false,"labels":{},"refreshInterval":"1h0m0s","secretStoreRef":{"kind":"","name":""},"targetSecretName":""}` | External Secrets Operator integration |
+| externalSecret.data | list | `[]` | Data mappings from the external store |
+| externalSecret.enabled | bool | `false` | Enable the ExternalSecret resource |
+| externalSecret.refreshInterval | string | `"1h0m0s"` | How often to refresh the secret from the external store |
+| externalSecret.secretStoreRef | object | `{"kind":"","name":""}` | Reference to a SecretStore or ClusterSecretStore |
+| externalSecret.targetSecretName | string | `""` | Name of the Kubernetes Secret created by ESO |
 | extraAnnotations | object | `{}` | Annotations globally added to all resources |
 | extraConfigs | object | `{}` | To add extra variables not predefined by helm config it is possible to define in extraConfigs block, e.g. below: NOTE  Do not store any kind of sensitive information inside of it ``` DD_SOCIAL_AUTH_AUTH0_OAUTH2_ENABLED: 'true' DD_SOCIAL_AUTH_AUTH0_KEY: 'dev' DD_SOCIAL_AUTH_AUTH0_DOMAIN: 'xxxxx' ``` |
 | extraEnv | list | `[]` | To add (or override) extra variables which need to be pulled from another configMap, you can use extraEnv. For example: ``` - name: DD_DATABASE_HOST   valueFrom:     configMapKeyRef:       name: my-other-postgres-configmap       key: cluster_endpoint ``` |

helm/defectdojo/templates/django-httproute.yaml

@@ -37,14 +37,14 @@ spec:
   {{- end }}
   rules:
     {{- range .Values.django.httpRoute.rules }}
-    {{- with .matches }}
-    - matches:
-      {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .filters }}
+    - {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
       filters:
-      {{- toYaml . | nindent 8 }}
-    {{- end }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       backendRefs:
         - group: ""
           kind: Service

helm/defectdojo/values.schema.json

@@ -388,6 +388,46 @@
             "description": "create valkey secret in defectdojo chart, outside of valkey chart",
             "type": "boolean"
         },
+        "externalSecret": {
+            "description": "External Secrets Operator integration",
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "description": "Enable the ExternalSecret resource",
+                    "type": "boolean"
+                },
+                "labels": {
+                    "type": "object"
+                },
+                "annotations": {
+                    "type": "object"
+                },
+                "refreshInterval": {
+                    "description": "How often to refresh the secret from the external store",
+                    "type": "string"
+                },
+                "secretStoreRef": {
+                    "description": "Reference to a SecretStore or ClusterSecretStore",
+                    "type": "object",
+                    "properties": {
+                        "name": {
+                            "type": "string"
+                        },
+                        "kind": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "targetSecretName": {
+                    "description": "Name of the Kubernetes Secret created by ESO",
+                    "type": "string"
+                },
+                "data": {
+                    "description": "Data mappings from the external store",
+                    "type": "array"
+                }
+            }
+        },
         "dbMigrationChecker": {
             "type": "object",
             "properties": {
@@ -511,6 +551,33 @@
                     "description": "A list of extra volumes to mount.",
                     "type": "array"
                 },
+                "httpRoute": {
+                    "description": "Kubernetes Gateway API HTTPRoute configuration (alternative to Ingress)",
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "labels": {
+                            "type": "object"
+                        },
+                        "annotations": {
+                            "type": "object"
+                        },
+                        "parentRefs": {
+                            "type": "array"
+                        },
+                        "hostnames": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        },
+                        "rules": {
+                            "type": "array"
+                        }
+                    }
+                },
                 "ingress": {
                     "type": "object",
                     "properties": {