[qu0b]

Problem

Gating the faucet behind nginx basic auth today means setting the two annotations in values and creating the Secret they reference somewhere else — by hand, or in whatever renders the values. The chart has no idea its ingress depends on that object.

That fails badly: when the secret is missing, the ingress controller does not fall through to the upstream, it returns 503 for the whole host, unauthenticated requests included. A network that forgot the manual step serves a dead faucet with nothing in the response pointing at the cause. One of ours has been in that state since it was deployed.

Change

ingress.basicAuth takes the htpasswd line. Set it and the chart creates <fullname>-basic-auth and sets auth-type / auth-secret for you; leave it empty and nothing changes.

nginx accepts user:{PLAIN}password as well as a hashed line, so deployments that resolve credentials from a secret store at sync time can pass the credential straight through without pre-hashing it.

Compatibility

Additive, empty default, hence the minor bump to 1.2.0. Rendered with --set ingress.enabled=true and no basicAuth:

• no Secret is produced
• the Ingress is byte-identical to 1.1.0 apart from the chart version label

With --set 'ingress.basicAuth=srv:{PLAIN}hunter2':

kind: Secret
metadata:
  name: pf-powfaucet-basic-auth
stringData:
  auth: "srv:{PLAIN}hunter2"
---
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-secret: pf-powfaucet-basic-auth
    nginx.ingress.kubernetes.io/auth-type: basic

helm lint clean, README regenerated with make docs.

[qu0b]

Good catch, fixed in the follow-up commit.

ingress.annotations: null is a legitimate way to write "no annotations" and rendered fine before, but set on it took the whole release down:

Error: template: powfaucet/templates/ingress.yaml:10:21: executing "powfaucet/templates/ingress.yaml"
at <.Values.ingress.annotations>: wrong type for value; expected map[string]interface {}; got interface {}

Now the map is built with default dict and written back, so all four combinations render:

annotations	basicAuth	result
null	set	both auth annotations, no error
{} (default)	set	both auth annotations
existing entry	set	merged, existing entry preserved
null	unset	no auth annotations, no Secret

helm lint still clean.

[redpandabot]

Adds an opt-in ingress basic-auth: setting ingress.basicAuth makes the chart create a -basic-auth Secret and the nginx auth-type/auth-secret annotations, with an empty default so non-users see no change. I rendered the chart in all relevant configurations (no-auth vs 1.1.0 byte-identical, basicAuth, null annotations, custom annotations, ingress disabled) and verified the nginx-facing details against upstream source (ingress-nginx reads secret key 'auth' and resolves a bare auth-secret name to the ingress's own namespace; nginx's ngx_crypt accepts {PLAIN}/{SHA}/{SSHA}/$apr1$). helm lint is clean; the .Values mutation is the repo's established ingress-template pattern with no cross-template leak. No correctness problems found.

---

_{Reviewed 5 changed file(s) @ 2d739d53 — no blocking issues found.
"Pets vs. cattle." — Bill Baker}