fix(OPENFRAM-005-8): CU-86akdypzw Kafka Helm chart dependency and Pinot/ngrok-operator/ingress-nginx charts are pulled from public upstream OCI/HTTPS repos, not the internal registry mirror

[flamingo]

Closes findings from rule OPENFRAM-005-8 — Kafka Helm chart dependency and Pinot/ngrok-operator/ingress-nginx charts are pulled from public upstream OCI/HTTPS repos, not the internal registry mirror.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 50 low — review closely	Kafka Helm chart dependency and Pinot/ngrok-operator/ingress-nginx charts are pulled from public upstream OCI/HTTPS repos, not the internal registry mirror	manifests/datasources/pinot/Chart.yaml:8

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c1688cba-c9bc-481b-b917-2b7f45403ab4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akdypzw OpenFrame Kubernetes manifest hardening secondary (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 Kafka Helm chart dependency and Pinot/ngrok-operator/ingress-nginx charts are pulled from public upstream OCI/HTTPS repos, not the internal registry mirror

In manifests/datasources/pinot/Chart.yaml, changed the pinot dependency's repository: field from the public upstream https://raw.githubusercontent.com/apache/pinot/master/helm to oci://ghcr.io/flamingo-stack/registry/helm-charts, matching the pattern used by cassandra/zookeeper/redis-cluster/kafka. This is UNVERIFIED: it assumes the internal registry mirror actually hosts/mirrors the pinot chart under that OCI path with a matching version constraint (~0.3.5); if the mirror does not proxy this specific chart, dependency resolution will fail. The finding also mentions ingress-nginx and ngrok-operator repository fields, but those dependencies are not present in this file's dependencies: list (only pinot is), so no change was made for them here — a complete fix would require locating and updating the Chart.yaml(s) that actually declare those dependencies.

🤖 Prompt for AI agents

In manifests/datasources/pinot/Chart.yaml around line 8, review and complete this code-review fix: Kafka Helm chart dependency and Pinot/ngrok-operator/ingress-nginx charts are pulled from public upstream OCI/HTTPS repos, not the internal registry mirror.
What the draft fix changed: In `manifests/datasources/pinot/Chart.yaml`, changed the `pinot` dependency's `repository:` field from the public upstream `https://raw.githubusercontent.com/apache/pinot/master/helm` to `oci://ghcr.io/flamingo-stack/registry/helm-charts`, matching the pattern used by cassandra/zookeeper/redis-cluster/kafka. This is UNVERIFIED: it assumes the internal registry mirror actually hosts/mirrors the `pinot` chart under that OCI path with a matching version constraint (`~0.3.5`); if the mirror does not proxy this specific chart, dependency resolution will fail. The finding also mentions ingress-nginx and ngrok-operator repository fields, but those dependencies are not present in this file's `dependencies:` list (only `pinot` is), so no change was made for them here — a complete fix would require locating and updating the Chart.yaml(s) that actually declare those dependencies.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 50 low — review closely — react 👍/👎 to teach the reviewer