ontoserver-indexer-0.2.0

Note: checked against the ontoserver-indexer-0.1.0 tag by diffing the values keys, not assembled from commit
messages, so nothing user-facing since that release is missing.

Added

• resources.heapGb — sets the JVM -Xmx independently of the container memory limit. The
  default is memoryGb - 2, leaving 2 GiB for non-heap JVM memory (metaspace, code cache,
  thread stacks, GC structures, direct buffers). Previously -Xmx was set equal to the memory
  limit, which guarantees an eventual OOMKill.
• Validation rejecting a heap that meets or exceeds resources.memoryGb, so the misconfiguration
  fails at install time rather than as an OOMKill mid-index.
• Opt-in security context: job.podSecurityContext, job.containerSecurityContext and
  job.automountServiceAccountToken, all unset by default so existing users see no change. The
  README documents a hardened configuration; note a non-root Job needs an fsGroup that can
  write the output PVC.
• job.extraVolumes and job.extraVolumeMounts — arbitrary volumes and mounts for the indexer
  container, rendered verbatim and appended after the chart's own output-volume/input-volume
  entries so those win a name collision. Both default to empty, so nothing changes for existing
  users. This makes readOnlyRootFilesystem: true reachable: the indexer runs the same Spring Boot
  image as the server and needs a writable /tmp, which the chart previously could not supply.

Fixed

• Registry credentials containing a " or \ no longer corrupt the image pull secret. The
  .dockerconfigjson was built by interpolating the username and password into a JSON string
  literal with printf, so either character produced invalid JSON — which the kubelet reports
  only as an opaque ImagePullBackOff. It is now built with dict and toJson.

Changed

• The default Job name is now <release name>-<release revision> rather than the release name,
  so an upgrade creates a new Job instead of failing on the immutable pod template of the
  existing one.