0005 — Guard for non-DNS `.Values.apps` keys in the emergent chart
Status: candidate
Opened: 2026-07-10 · Area: infra/charts/emergent (app templates)
Reopen trigger: the next new .Values.apps entry, or any helm-render CI lane being added — wire
the check in then.
Evidence
Section titled “Evidence”The docsEng values key (camelCase, deliberate — ADR-0051) exposed that the app templates
interpolated the raw map key into metadata.name, rendering RFC-1123-invalid names
(emergent-docsEng) that helm lint/helm template accept but kubectl apply rejects. Fixed
2026-07-10 (commit e48a5e01): every template now derives $appId := $appConfig.name | default $appName and uses it for all rendered names/hosts/label params; byte-identical renders verified
for the pre-existing apps.
Residual hazard
Section titled “Residual hazard”The fallback path is still the raw key: an app added with a non-DNS key and no name: field
reproduces the original failure, invisibly until apply time. Candidate hardening: a tiny render
check (CI or a tools/scripts guard alongside the terminology guard) that runs helm template
over baseline + dev values and asserts every metadata.name matches RFC-1123 — cheap, catches the
whole class, no template changes needed.