Description
Remediate the three Helm findings and regenerate chart artifacts using the pinned toolchain.
Acceptance Criteria
- #1 Pod-level service-account token automount policy applies when using chart-created, external, or default service accounts
- #2 Every Secret-typed configuration path is excluded from ConfigMap rendering, including map-valued OTLP and Pyroscope headers and route credentials
- #3 Generated rotation guidance accurately describes rolloutTrigger or external reloader requirements and never promises automatic secret rotation
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Render pod-level automount policy, inventory all Secret-valued maps and route credentials, correct the source rotation guidance, regenerate pinned artifacts, and validate deterministic Helm renders.
Resume only to clear the shared full-suite workflow-contract gate; no Helm security implementation changes.
Implementation Notes
Pinned generators, Helm lint, and deterministic Secret/automount renders pass. Final go test -race ./… is blocked only by unchanged internal/ci workflow-contract assertions outside this lane.
Shared workflow-contract blocker cleared: full build, vet, race suite, lint, and actionlint passed on 2026-08-25.
Final Summary
Applied pod-level automount policy, complete Secret-path routing, and accurate explicit credential-rotation guidance; regenerated chart artifacts.
The complete repository gate now passes.