fix(helm): anchor metrics port regex so host-qualified addresses parse

`regexFind "[0-9]+"` returns the first digit run, so a perfectly valid
bindAddress like `127.0.0.1:8443` would extract `127` and the rendered
Service would point at the wrong port. Anchor the match to the end of
the string with `[0-9]+$` so every Go-style address form yields the
trailing port: bare `:port`, host-qualified `host:port`, and bracketed
IPv6 `[::1]:port` all parse correctly.

The shared logic lives behind a `kagent.controller.metricsPort` helper
in `_helpers.tpl` so the deployment containerPort and the Service
targetPort cannot fall out of sync if the parsing rule evolves.

Disabling metrics is exclusively the job of
`controller.metrics.enabled=false`; the chart does not engage with the
controller binary's `bindAddress=0` disable sentinel, since wiring two
ways to express the same intent only invites contradictory
configuration.

Addresses review feedback on kagent-dev#1803.

Signed-off-by: Daniel Orbach <ddorbach@gmail.com>

Author: danielorbach

helm/kagent/templates/_helpers.tpl

@@ -132,6 +132,20 @@ Check if leader election should be enabled (more than 1 replica)
 {{- gt (.Values.controller.replicas | int) 1 -}}
 {{- end -}}
 
+{{/*
+Extract the TCP port from controller.metrics.bindAddress.
+
+Anchors the digit run to the end of the string so every Go-style
+address form the controller binary accepts is handled correctly: bare
+":port", host-qualified "host:port", and bracketed IPv6 "[::1]:port"
+all yield the trailing port. Disabling metrics is exclusively the job
+of controller.metrics.enabled=false; bindAddress is expected to carry
+a real, non-zero port whenever the metrics resources render.
+*/}}
+{{- define "kagent.controller.metricsPort" -}}
+{{- regexFind "[0-9]+$" (.Values.controller.metrics.bindAddress | toString) -}}
+{{- end -}}
+
 {{/*
 PostgreSQL service name for the bundled postgres instance
 */}}

helm/kagent/templates/controller-deployment.yaml

@@ -105,7 +105,7 @@ spec:
               protocol: TCP
             {{- if .Values.controller.metrics.enabled }}
             - name: metrics
-              containerPort: {{ .Values.controller.metrics.bindAddress | regexFind "[0-9]+" | int }}
+              containerPort: {{ include "kagent.controller.metricsPort" . | int }}
               protocol: TCP
             {{- end }}
           resources:

helm/kagent/templates/controller-metrics-service.yaml

@@ -11,7 +11,7 @@ spec:
   ports:
     - name: {{ ternary "https" "http-metrics" .Values.controller.metrics.secureServing }}
       port: {{ .Values.controller.metrics.service.port }}
-      targetPort: {{ .Values.controller.metrics.bindAddress | regexFind "[0-9]+" | int }}
+      targetPort: {{ include "kagent.controller.metricsPort" . | int }}
       protocol: TCP
   selector:
     {{- include "kagent.controller.selectorLabels" . | nindent 4 }}

helm/kagent/tests/controller-deployment_test.yaml

@@ -580,6 +580,32 @@ tests:
             containerPort: 9443
             protocol: TCP
 
+  - it: should derive metrics container port from a host-qualified bindAddress
+    template: controller-deployment.yaml
+    set:
+      controller.metrics.enabled: true
+      controller.metrics.bindAddress: "127.0.0.1:9443"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: metrics
+            containerPort: 9443
+            protocol: TCP
+
+  - it: should derive metrics container port from a bracketed IPv6 bindAddress
+    template: controller-deployment.yaml
+    set:
+      controller.metrics.enabled: true
+      controller.metrics.bindAddress: "[::1]:9443"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: metrics
+            containerPort: 9443
+            protocol: TCP
+
   - it: should let controller.env override the chart-supplied metrics env
     template: controller-deployment.yaml
     set:

helm/kagent/tests/controller-metrics-service_test.yaml

@@ -52,6 +52,26 @@ tests:
           path: spec.ports[0].targetPort
           value: 9443
 
+  - it: should derive targetPort from a host-qualified bindAddress
+    set:
+      controller.metrics.enabled: true
+      controller.metrics.bindAddress: "127.0.0.1:9443"
+      controller.metrics.service.port: 9443
+    asserts:
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 9443
+
+  - it: should derive targetPort from a bracketed IPv6 bindAddress
+    set:
+      controller.metrics.enabled: true
+      controller.metrics.bindAddress: "[::1]:9443"
+      controller.metrics.service.port: 9443
+    asserts:
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 9443
+
   - it: should rename port when secure serving disabled
     set:
       controller.metrics.enabled: true