Chart / Sec Hardening

Goal

Harden the mecak8s Helm chart and Redis persistence posture for secure, reliable production operation.

This tracker follows a Kubernetes architecture, Helm, and security/SRE review of deploy/helm/mecak8s. The chart already has strong pod security contexts, verified Redis TLS, secure-provider validation, resource defaults, health probes, graceful shutdown, a strict values schema, and extensive Go/render tests. The linked sub-issues cover the remaining concrete risks and test gaps.

Scope

• Isolate the unauthenticated drain endpoint.
• Make Kubernetes Lease renewal and retained-object cardinality scale-safe.
• Isolate Lease/scheduler domains between releases.
• Improve HA placement and disruption behavior.
• Enforce shutdown/probe timing invariants.
• Reject invalid Helm value combinations and scope local Redis resources.
• Close remaining chart operational hardening gaps.
• Add application-level encryption for sensitive Redis payloads.
• Add helm-unittest coverage.

Each work item is tracked as a native GitHub sub-issue.

Start with the native sub-issues for the remaining risks in deploy/helm/mecak8s, then review the existing Go/render tests and the requested helm-unittest coverage. The work is done when the listed endpoint, Lease, placement, timing, values, Redis, encryption, and chart-hardening gaps are addressed with corresponding test coverage.