feat(k8s-reporter): add extraVolumes, extraVolumeMounts, extraEnvVars, customCA

[AlexKantor87]

Closes #776.

Summary

Adds two layers of support for customers running the k8s-reporter behind a TLS-inspecting proxy that requires a corporate CA bundle:

1. Generic escape hatch — extraVolumes, extraVolumeMounts, extraEnvVars (Bitnami / prometheus-community naming convention).
2. customCA convenience wrapper — single config block that mounts the CA via subPath into /etc/ssl/certs/ so Go's stdlib picks it up additively alongside the system bundle. Deliberately does not set SSL_CERT_FILE — that would replace the system bundle and break trust for any public CAs the customer's bundle does not include.

No changes to the Kosli CLI itself: it's Go and uses net/http's default transport, so crypto/x509 reads /etc/ssl/certs/ automatically.

Files changed

• charts/k8s-reporter/values.yaml — new top-level fields with documented examples
• charts/k8s-reporter/templates/cronjob.yaml — three injection points (volumes, volumeMounts, env)
• charts/k8s-reporter/Chart.yaml — bump 2.1.0 → 2.2.0 (additive, minor)
• charts/k8s-reporter/_templates.gotmpl — new "Running behind a TLS-inspecting proxy" docs section
• charts/k8s-reporter/README.md.gotmpl — wire the new section into the README
• charts/k8s-reporter/README.md + docs.kosli.com/content/helm/_index.md — regenerated via make helm-docs

Verification

helm lint and helm template validated against five scenarios:

Scenario	Result
Baseline (both layers off)	identical to main — no behaviour change for existing users
customCA only	volume + subPath mount injected at correct nesting
Generic fields only	extraVolumes, extraVolumeMounts, extraEnvVars all render
Both layers together	both inject without collision
customCA.enabled=true with no secretName	clean error: customCA.secretName is required when customCA.enabled is true

make helm-lint passes (strict mode too).

Test plan

• Reviewer renders helm template locally with customCA.enabled=true and confirms the mount appears at /etc/ssl/certs/kosli-custom-ca.crt with subPath: ca.crt
• Reviewer renders helm template with the generic extraVolumes example from values.yaml and confirms it appears alongside the chart's own environments-config volume
• CI: make helm-lint passes
• CI: make helm-docs produces no diff (already regenerated in this PR)

Deliberately deferred

• Helm template golden-file tests in CI. The chart has no test infrastructure today (no tests/ directory, CI only runs helm lint). Adding a snapshot/golden-file harness is a meaningful new pattern for this repo and belongs as its own thin slice rather than bundled here. Suggest a follow-up issue if desired.
• customCA.mountPath / volume-name override. The wrapper hardcodes /etc/ssl/certs/kosli-custom-ca.crt and volume name custom-ca to keep the UX one-decision-deep. Customers who need different conventions should use the generic fields.

Customer context

Reported by a customer whose environment sits behind a TLS-inspecting appliance that re-signs HTTPS traffic with a corporate CA. They confirmed that the dedicated customCA wrapper would materially help their deployment flow, which is why it ships in the same PR as the generic fields rather than as a follow-up.

[claude]

Claude finished @AlexKantor87's task in 3m 16s —— View job

---

PR Review: feat(k8s-reporter): add extraVolumes, extraVolumeMounts, extraEnvVars, customCA

• Run static analysis checks (go build, go vet, go mod tidy)
• Read and review all changed files
• Post inline comments on specific issues
• Post summary review

---

Static Analysis

All passing — no issues:

• go build ./... — clean
• go vet ./... — clean
• go mod tidy — no diff in go.mod/go.sum

(Could not run helm lint / helm template due to tool permissions — recommend verifying in CI.)

---

Review Summary

This is a well-structured, additive-only Helm chart change. The previous two review rounds caught real issues (required guard on customCA.key, env value quoting, whitespace trimming) and all have been addressed. The current state looks solid.

What looks good

• Correct subPath approach: Mounting the CA cert as a single file via subPath into /etc/ssl/certs/ is the right call — Go's crypto/x509 directory scan picks it up additively without overriding the system bundle. The deliberate decision not to set SSL_CERT_FILE avoids a common footgun.
• required guards on both secretName and key: Fail-fast with clear error messages rather than producing broken manifests.
• Quoting fixes: Adding | quote to podLabels values, env values, secretName, and subPath protects against YAML-special characters. Good defensive improvement that also fixes pre-existing issues.
• Whitespace trimming: {{- end }} on podLabels and env ranges cleans up blank lines in rendered output.
• nindent values are correct: 10 for volumes, 12 for volumeMounts, 14 for env entries — all match the existing indentation structure.
• README and docs in sync: charts/k8s-reporter/README.md and docs.kosli.com/content/helm/_index.md are identical (verified via diff).
• Thorough documentation: The _templates.gotmpl section explains why the design works (Go cert loading behavior, PSS compatibility, SSL_CERT_FILE trade-off) — not just how to use it.
• Chart version bump: 2.1.0 → 2.2.0 is correct semver for additive features.

Minor observations (non-blocking)

1. Pre-existing: dryRun/httpProxy arg blocks (cronjob.yaml:94-100) — these still use {{ if }}/{{ end }} without leading hyphens, producing extra blank lines in rendered YAML. Now the only remaining instances after this PR's cleanup. Worth a follow-up one-liner.

2. defaultMode: 0644 — correct (YAML 1.1 interprets leading 0 as octal → decimal 420 = rw-r--r--), but worth noting that some linters flag bare octal literals. If a future linter run catches this, the fix is just wrapping in quotes: defaultMode: "0644".

Verdict

LGTM — clean, well-documented, and the previous review feedback has been thoroughly addressed. The only remaining nit is the pre-existing whitespace issue in the dryRun/httpProxy blocks, which is outside this PR's scope.

[tooky]

Do we need to pull docs changes through to mintlify?

[mbevc1]

There is a scheduled run that should pick this up

[mbevc1]

@tooky ignore previous comment, it needed manual prompt. Automation is there only for backed and CLI + TF provider

[mbevc1]

kosli-dev/docs#148