From d1e7a4ede808e982baf0713f54aedf778bf3d34f Mon Sep 17 00:00:00 2001
From: Jinsoo Heo <jinsoo@chroniclelabs.org>
Date: Tue, 21 Jul 2026 12:15:18 +0900
Subject: [PATCH 1/5] feat(gofer): support isolated fire-drill sidecars
 [sc-19068]

---
 .github/workflows/lint-test.yaml          |  9 ++++-
 charts/gofer/Chart.yaml                   |  2 +-
 charts/gofer/README.md                    |  5 ++-
 charts/gofer/ci/fire-drill-render.yaml    | 19 ++++++++++
 charts/gofer/ci/test-fire-drill-render.sh | 45 +++++++++++++++++++++++
 charts/gofer/templates/deployment.yaml    | 10 +++++
 charts/gofer/values.yaml                  |  9 +++++
 7 files changed, 96 insertions(+), 3 deletions(-)
 create mode 100644 charts/gofer/ci/fire-drill-render.yaml
 create mode 100644 charts/gofer/ci/test-fire-drill-render.sh

diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index 8ca7864e..b4c3c631 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -2,6 +2,9 @@ name: Lint and Test Charts
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   lint-test:
     runs-on: ubuntu-latest
@@ -11,12 +14,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
         with:
           version: v3.11.2
 
+      - name: Test gofer fire-drill pod extensions
+        run: bash charts/gofer/ci/test-fire-drill-render.sh
+
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: '3.14'
@@ -30,7 +37,7 @@ jobs:
         run: |
           changed=$(ct list-changed --config ct.yaml)
           if [[ -n "$changed" ]]; then
-            echo "::set-output name=changed::true"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Run chart-testing (lint)
diff --git a/charts/gofer/Chart.yaml b/charts/gofer/Chart.yaml
index 50a76c84..f6f257b3 100644
--- a/charts/gofer/Chart.yaml
+++ b/charts/gofer/Chart.yaml
@@ -23,7 +23,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.3
+version: 0.4.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/gofer/README.md b/charts/gofer/README.md
index cb8a65e3..445326bb 100644
--- a/charts/gofer/README.md
+++ b/charts/gofer/README.md
@@ -1,6 +1,6 @@
 # gofer
 
-![Version: 0.4.3](https://img.shields.io/badge/Version-0.4.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.61](https://img.shields.io/badge/AppVersion-0.61-informational?style=flat-square)
+![Version: 0.4.4](https://img.shields.io/badge/Version-0.4.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.61](https://img.shields.io/badge/AppVersion-0.61-informational?style=flat-square)
 
 A Helm chart for deploying gofer to Kubernetes
 
@@ -17,6 +17,7 @@ A Helm chart for deploying gofer to Kubernetes
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | argsOverride | list | `[]` | Note: If you want to override the default command and args, use `argsOverride` and `entryPointOverride`. |
+| automountServiceAccountToken | string | `nil` | Override whether Kubernetes mounts the service-account token into gofer pods. |
 | autoscaling.enabled | bool | `false` |  |
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
@@ -26,7 +27,9 @@ A Helm chart for deploying gofer to Kubernetes
 | env | object | `{"normal":{},"raw":{}}` | Environment variable listing |
 | env.normal | object | `{}` | un-encrypted env vars passed to the pod |
 | extraArgs | list | `[]` |  |
+| extraContainers | list | `[]` | Additional containers to run in the gofer pod. |
 | extraObjects | list | `[]` | Extra K8s manifests to deploy |
+| extraVolumes | list | `[]` | Additional volumes to make available to containers in the gofer pod. |
 | fullnameOverride | string | `""` |  |
 | goferMode | string | `"run"` | can be `run`, `models`, `data`, or `proxy` |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
diff --git a/charts/gofer/ci/fire-drill-render.yaml b/charts/gofer/ci/fire-drill-render.yaml
new file mode 100644
index 00000000..f37009bd
--- /dev/null
+++ b/charts/gofer/ci/fire-drill-render.yaml
@@ -0,0 +1,19 @@
+automountServiceAccountToken: false
+
+extraContainers:
+  - name: fire-drill
+    image: ghcr.io/chronicleprotocol/gofer:0.61@sha256:3915d2e41e041ea8aaba26149c48c4290de9df88f5aed6c271702d90ecb27e4c
+    args:
+      - fire-drill
+    volumeMounts:
+      - name: fire-drill-namespace
+        mountPath: /var/run/chronicle/fire-drill
+        readOnly: true
+
+extraVolumes:
+  - name: fire-drill-namespace
+    downwardAPI:
+      items:
+        - path: namespace
+          fieldRef:
+            fieldPath: metadata.namespace
diff --git a/charts/gofer/ci/test-fire-drill-render.sh b/charts/gofer/ci/test-fire-drill-render.sh
new file mode 100644
index 00000000..27b491e1
--- /dev/null
+++ b/charts/gofer/ci/test-fire-drill-render.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copyright (C) 2021-2025 Chronicle Labs, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+rendered="$(helm template fire-drill "$chart_dir" \
+  --values "$chart_dir/ci/fire-drill-render.yaml" \
+  --show-only templates/deployment.yaml)"
+default_rendered="$(helm template default "$chart_dir" \
+  --show-only templates/deployment.yaml)"
+
+if [[ "$default_rendered" == *'automountServiceAccountToken:'* ]]; then
+  printf 'default render must preserve Kubernetes service-account automount behavior\n' >&2
+  exit 1
+fi
+
+required=(
+  'automountServiceAccountToken: false'
+  'name: fire-drill'
+  'mountPath: /var/run/chronicle/fire-drill'
+  'name: fire-drill-namespace'
+  'downwardAPI:'
+  'fieldPath: metadata.namespace'
+)
+
+for expected in "${required[@]}"; do
+  if [[ "$rendered" != *"$expected"* ]]; then
+    printf 'missing rendered fire-drill field: %s\n' "$expected" >&2
+    exit 1
+  fi
+done
diff --git a/charts/gofer/templates/deployment.yaml b/charts/gofer/templates/deployment.yaml
index 9733a223..0130b427 100644
--- a/charts/gofer/templates/deployment.yaml
+++ b/charts/gofer/templates/deployment.yaml
@@ -28,6 +28,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "gofer.serviceAccountName" . }}
+      {{- if not (eq .Values.automountServiceAccountToken nil) }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
@@ -80,6 +83,13 @@ spec:
           {{- if .Values.env.raw }}
             {{- toYaml .Values.env.raw | nindent 12 }}
           {{- end }}
+        {{- with .Values.extraContainers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/gofer/values.yaml b/charts/gofer/values.yaml
index 4318961f..c1125bc6 100644
--- a/charts/gofer/values.yaml
+++ b/charts/gofer/values.yaml
@@ -48,6 +48,15 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+# -- Override whether Kubernetes mounts the service-account token into gofer pods.
+automountServiceAccountToken: null
+
+# -- Additional containers to run in the gofer pod.
+extraContainers: []
+
+# -- Additional volumes to make available to containers in the gofer pod.
+extraVolumes: []
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true

From 63952aa7d2601be40869614718b12064269b6e47 Mon Sep 17 00:00:00 2001
From: Jinsoo Heo <jinsoo@chroniclelabs.org>
Date: Tue, 21 Jul 2026 18:27:25 +0900
Subject: [PATCH 2/5] test(gofer): fix proxy health probe fixture [sc-19068]

---
 charts/gofer/ci/proxy-values.yaml         |  8 ++++----
 charts/gofer/ci/test-fire-drill-render.sh | 11 +++++++++++
 charts/gofer/values.yaml                  |  4 ++--
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/charts/gofer/ci/proxy-values.yaml b/charts/gofer/ci/proxy-values.yaml
index d3ccd941..98b5e9d4 100644
--- a/charts/gofer/ci/proxy-values.yaml
+++ b/charts/gofer/ci/proxy-values.yaml
@@ -7,14 +7,14 @@ env:
 
 livenessProbe:
   httpGet:
-    path: /livez
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 120
 
 readinessProbe:
   httpGet:
-    path: /readyz
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 60
diff --git a/charts/gofer/ci/test-fire-drill-render.sh b/charts/gofer/ci/test-fire-drill-render.sh
index 27b491e1..5eeee0ee 100644
--- a/charts/gofer/ci/test-fire-drill-render.sh
+++ b/charts/gofer/ci/test-fire-drill-render.sh
@@ -22,6 +22,9 @@ rendered="$(helm template fire-drill "$chart_dir" \
   --show-only templates/deployment.yaml)"
 default_rendered="$(helm template default "$chart_dir" \
   --show-only templates/deployment.yaml)"
+proxy_rendered="$(helm template proxy "$chart_dir" \
+  --values "$chart_dir/ci/proxy-values.yaml" \
+  --show-only templates/deployment.yaml)"
 
 if [[ "$default_rendered" == *'automountServiceAccountToken:'* ]]; then
   printf 'default render must preserve Kubernetes service-account automount behavior\n' >&2
@@ -43,3 +46,11 @@ for expected in "${required[@]}"; do
     exit 1
   fi
 done
+
+for expected in 'path: /healthz' 'port: healthcheck'; do
+  count="$(grep -Fc -- "$expected" <<< "$proxy_rendered" || true)"
+  if [[ "$count" -ne 2 ]]; then
+    printf 'proxy CI fixture must set both probes to %s, found %s\n' "$expected" "$count" >&2
+    exit 1
+  fi
+done
diff --git a/charts/gofer/values.yaml b/charts/gofer/values.yaml
index c1125bc6..dd51b796 100644
--- a/charts/gofer/values.yaml
+++ b/charts/gofer/values.yaml
@@ -114,7 +114,7 @@ livenessProbe: {}
   # -- for proxy mode:
   # httpGet:
   #   path: /healthz
-  #   port: gofer
+  #   port: healthcheck
   # initialDelaySeconds: 60
   # periodSeconds: 120
 
@@ -127,7 +127,7 @@ readinessProbe: {}
   # -- for proxy mode:
   # httpGet:
   #   path: /healthz
-  #   port: gofer
+  #   port: healthcheck
   # initialDelaySeconds: 60
   # periodSeconds: 60
 

From aad1732894e7f23634f58a419cc3ed120c41369a Mon Sep 17 00:00:00 2001
From: Jinsoo Heo <jinsoo@chroniclelabs.org>
Date: Wed, 22 Jul 2026 11:07:04 +0900
Subject: [PATCH 3/5] chore(gofer): remove dedicated chart test scaffolding
 [sc-19068]

---
 .github/workflows/lint-test.yaml          |  9 +---
 charts/gofer/ci/fire-drill-render.yaml    | 19 --------
 charts/gofer/ci/proxy-values.yaml         |  8 ++--
 charts/gofer/ci/test-fire-drill-render.sh | 56 -----------------------
 4 files changed, 5 insertions(+), 87 deletions(-)
 delete mode 100644 charts/gofer/ci/fire-drill-render.yaml
 delete mode 100644 charts/gofer/ci/test-fire-drill-render.sh

diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index b4c3c631..8ca7864e 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -2,9 +2,6 @@ name: Lint and Test Charts
 
 on: pull_request
 
-permissions:
-  contents: read
-
 jobs:
   lint-test:
     runs-on: ubuntu-latest
@@ -14,16 +11,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
         with:
           version: v3.11.2
 
-      - name: Test gofer fire-drill pod extensions
-        run: bash charts/gofer/ci/test-fire-drill-render.sh
-
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: '3.14'
@@ -37,7 +30,7 @@ jobs:
         run: |
           changed=$(ct list-changed --config ct.yaml)
           if [[ -n "$changed" ]]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "::set-output name=changed::true"
           fi
 
       - name: Run chart-testing (lint)
diff --git a/charts/gofer/ci/fire-drill-render.yaml b/charts/gofer/ci/fire-drill-render.yaml
deleted file mode 100644
index f37009bd..00000000
--- a/charts/gofer/ci/fire-drill-render.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-automountServiceAccountToken: false
-
-extraContainers:
-  - name: fire-drill
-    image: ghcr.io/chronicleprotocol/gofer:0.61@sha256:3915d2e41e041ea8aaba26149c48c4290de9df88f5aed6c271702d90ecb27e4c
-    args:
-      - fire-drill
-    volumeMounts:
-      - name: fire-drill-namespace
-        mountPath: /var/run/chronicle/fire-drill
-        readOnly: true
-
-extraVolumes:
-  - name: fire-drill-namespace
-    downwardAPI:
-      items:
-        - path: namespace
-          fieldRef:
-            fieldPath: metadata.namespace
diff --git a/charts/gofer/ci/proxy-values.yaml b/charts/gofer/ci/proxy-values.yaml
index 98b5e9d4..d3ccd941 100644
--- a/charts/gofer/ci/proxy-values.yaml
+++ b/charts/gofer/ci/proxy-values.yaml
@@ -7,14 +7,14 @@ env:
 
 livenessProbe:
   httpGet:
-    path: /healthz
-    port: healthcheck
+    path: /livez
+    port: gofer
   initialDelaySeconds: 60
   periodSeconds: 120
 
 readinessProbe:
   httpGet:
-    path: /healthz
-    port: healthcheck
+    path: /readyz
+    port: gofer
   initialDelaySeconds: 60
   periodSeconds: 60
diff --git a/charts/gofer/ci/test-fire-drill-render.sh b/charts/gofer/ci/test-fire-drill-render.sh
deleted file mode 100644
index 5eeee0ee..00000000
--- a/charts/gofer/ci/test-fire-drill-render.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) 2021-2025 Chronicle Labs, Inc.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-set -euo pipefail
-
-chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-rendered="$(helm template fire-drill "$chart_dir" \
-  --values "$chart_dir/ci/fire-drill-render.yaml" \
-  --show-only templates/deployment.yaml)"
-default_rendered="$(helm template default "$chart_dir" \
-  --show-only templates/deployment.yaml)"
-proxy_rendered="$(helm template proxy "$chart_dir" \
-  --values "$chart_dir/ci/proxy-values.yaml" \
-  --show-only templates/deployment.yaml)"
-
-if [[ "$default_rendered" == *'automountServiceAccountToken:'* ]]; then
-  printf 'default render must preserve Kubernetes service-account automount behavior\n' >&2
-  exit 1
-fi
-
-required=(
-  'automountServiceAccountToken: false'
-  'name: fire-drill'
-  'mountPath: /var/run/chronicle/fire-drill'
-  'name: fire-drill-namespace'
-  'downwardAPI:'
-  'fieldPath: metadata.namespace'
-)
-
-for expected in "${required[@]}"; do
-  if [[ "$rendered" != *"$expected"* ]]; then
-    printf 'missing rendered fire-drill field: %s\n' "$expected" >&2
-    exit 1
-  fi
-done
-
-for expected in 'path: /healthz' 'port: healthcheck'; do
-  count="$(grep -Fc -- "$expected" <<< "$proxy_rendered" || true)"
-  if [[ "$count" -ne 2 ]]; then
-    printf 'proxy CI fixture must set both probes to %s, found %s\n' "$expected" "$count" >&2
-    exit 1
-  fi
-done

From 3ebdf184a82d83d90e40c77bc24c3ef5837f4769 Mon Sep 17 00:00:00 2001
From: Jinsoo Heo <jinsoo@chroniclelabs.org>
Date: Wed, 22 Jul 2026 15:07:11 +0900
Subject: [PATCH 4/5] fix(gofer): keep proxy chart install healthy [sc-19068]

---
 charts/gofer/ci/proxy-values.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/charts/gofer/ci/proxy-values.yaml b/charts/gofer/ci/proxy-values.yaml
index d3ccd941..98b5e9d4 100644
--- a/charts/gofer/ci/proxy-values.yaml
+++ b/charts/gofer/ci/proxy-values.yaml
@@ -7,14 +7,14 @@ env:
 
 livenessProbe:
   httpGet:
-    path: /livez
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 120
 
 readinessProbe:
   httpGet:
-    path: /readyz
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 60

From faa21008799abf71a522ff884af0da276bc12e4c Mon Sep 17 00:00:00 2001
From: Jinsoo Heo <jinsoo@chroniclelabs.org>
Date: Thu, 30 Jul 2026 13:59:12 +0900
Subject: [PATCH 5/5] test(gofer): cover generic pod extensions [sc-19068]

---
 charts/gofer/ci/pod-extensions-values.yaml | 28 ++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 charts/gofer/ci/pod-extensions-values.yaml

diff --git a/charts/gofer/ci/pod-extensions-values.yaml b/charts/gofer/ci/pod-extensions-values.yaml
new file mode 100644
index 00000000..d5d76af5
--- /dev/null
+++ b/charts/gofer/ci/pod-extensions-values.yaml
@@ -0,0 +1,28 @@
+automountServiceAccountToken: false
+
+extraContainers:
+  - name: auxiliary
+    image: registry.k8s.io/pause:3.10.1@sha256:278fb9dbcca9518083ad1e11276933a2e96f23de604a3a08cc3c80002767d24c
+    imagePullPolicy: IfNotPresent
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 65532
+    resources:
+      requests:
+        cpu: 1m
+        memory: 4Mi
+      limits:
+        cpu: 10m
+        memory: 16Mi
+    volumeMounts:
+      - name: auxiliary-data
+        mountPath: /var/run/auxiliary
+
+extraVolumes:
+  - name: auxiliary-data
+    emptyDir: {}