fix(tenant): render the chart without the platform's injected values - #3636

What this PR does

helm lint packages/apps/tenant fails on main with three errors. This removes two of the three; the branch name notwithstanding, lint still exits 1 afterwards on the third, which is a repository-wide convention question rather than a defect in this chart.

The chart cannot be rendered outside a cluster at all. templates/keycloakgroups.yaml reads index .Values._cluster "oidc-enabled", and _cluster is injected by the platform, so it is absent whenever the chart is rendered on its own. index on a nil map is a hard error, not an empty result, so both helm lint and a plain helm template die on line 1.

The idiom the neighbouring charts use for the same lookup does not rescue this on its own, which is worth stating because it looks exactly like a guard. (index .Values._cluster "x") | default "y" still fails: index is evaluated first and errors on the nil map, so default never receives a result to substitute; it only ever covered a key missing from a map that exists.

The spelling alone does not decide whether a chart breaks, though. packages/system/cozystack-basics uses it and lints clean, because line 1 of its values.yaml is _cluster: {}, which makes the map non-nil before index runs. A chart is broken only when it neither declares the empty map nor guards at the use site, and a lint sweep across the catalog found 27 in that state. Guarding at the use site is the choice here because it makes the template correct whatever values.yaml contains, and because _cluster is platform-internal while this chart's values.yaml, schema and README are generated together from api/apps/v1alpha1/tenant/types.go as user-facing output. The guard has to sit on the map rather than on the value it returns:

{{- $oidcEnabled := index (.Values._cluster | default dict) "oidc-enabled" }}

This is behaviour-preserving, and that is checked rather than asserted. With _cluster present, | default dict returns it untouched and the lookup is what it was; with it absent the lookup is nil, the eq below is false, and the block stays unrendered, which is what an unconfigured tenant should produce. Rendering before and after gives byte-identical output:

Worth recording how that comparison has to be run, because the obvious way proves nothing. The KeycloakRealmGroup block sits behind .Capabilities.APIVersions.Has "v1.edp.epam.com/v1", which is false under a plain helm template, so a first pass rendered the same output in both the enabled and disabled cases, and a diff of those two would have compared one empty result against another. The renders above pass --api-versions v1.edp.epam.com/v1 so the guarded branch actually executes. Anyone proving neutrality on a capability-gated template needs that flag or the proof is vacuous.

Chart.yaml does not declare cozy-lib, which is present as a symlink under charts/, so lint reports missing chart metadata. It is declared the way packages/apps/qdrant does it, that being the one chart in the tree which declares it and does not carry this error. Rendering is unchanged by the declaration, checked the same way as above.

Two things that could plausibly have broken and did not, checked rather than assumed: rendering from a packaged helm package artifact is byte-identical, and the charts/cozy-lib symlink is still expanded into the tgz with the dependency declared. And neither hack/update-crd.sh nor the fix-charts target in packages/apps/Makefile reads the dependencies: block, so nothing needs regenerating.

The icon error is left in place on purpose, and the relative path is load-bearing. helm lint wants a URL with a scheme, and /logos/tenant.svg has none. But hack/update-crd.sh consumes exactly this form: it rewrites a leading slash to ./, then reads that file off disk and base64-encodes it into .spec.dashboard.icon of the generated ApplicationDefinition. packages/apps/tenant/logos/tenant.svg is that file. Give the chart a URL with a scheme and the generator's [[ ! -f "$ICON_PATH" ]] check no longer finds anything to encode. So the relative form is a requirement of the pipeline rather than a stylistic convention, all 31 icon-carrying charts use it, and satisfying helm lint here means changing the generator, not the charts. That is a repository-wide decision and not this PR's.

tests/keycloakgroups_oidc_test.yaml pins the gate in all three directions: four realm groups when oidc-enabled is "true", none when it is "false", and none when the platform injected no _cluster at all. The last case is the one the guard exists for, and it needs no mocking, since _cluster is absent from values.yaml and "not injected" is just the chart's default state. Against the unguarded template that suite fails with index of untyped nil. The chart's other seven suites pass identically with and without the fix, which is precisely why the change needed its own.

Two limits of the new suite, stated rather than left to be found. It pins how many documents render, not which: renaming the four groups or breaking a realmRef would pass. And the template's second gate, .Capabilities.APIVersions.Has "v1.edp.epam.com/v1", is enabled for the whole suite, so no case covers its absence. Both are worth closing on the next touch of this file; neither weakens what the suite does pin, which is that the chart renders at all when the platform injected nothing.

A trap for anyone reproducing this by hand: the gate compares against the string "true", so --set _cluster.oidc-enabled=true passes a YAML boolean and renders nothing, while --set-string renders the four groups. The platform writes a genuine string, and it survives the round-trip through a Secret because toYaml quotes it. Note also that this chart's helpers reject a release name that does not begin with tenant-, which will silently render nothing for either form.

One note in case a future change teaches the linter to inject the platform's values, which would hide this class of error without fixing it: the guard is still worth having, because it is what lets helm template packages/apps/tenant succeed with no values file at all. A chart that renders standalone can be inspected, diffed and unit-tested without reproducing the platform around it.

Screenshots

Downstream repositories

• No downstream repository is affected by this change
• cozystack/website - follow-up:
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:

Release note

fix(tenant): the tenant chart now renders without the values the platform injects, so `helm template` works on it standalone, and its `cozy-lib` dependency is declared in Chart.yaml; this clears two of the three `helm lint` errors it reported, the remaining one being the repository-wide relative icon URL

Summary by CodeRabbit

• New Features

  • Added support for using the shared Cozy library in tenant deployments.

• Bug Fixes

  • Improved tenant configuration rendering when cluster settings are unavailable.
  • OIDC-related Keycloak groups now render reliably when OIDC is enabled and required platform capabilities are present.
  • Preserved expected behavior when OIDC is disabled or configuration is omitted.

• Tests

  • Added coverage for enabled, disabled, and missing cluster configuration scenarios.