radar-hub 1.3.1: repair self-signed TLS without a Hub upgrade

[nadaverell]

Summary

The published radar-hub chart 1.3.0 exposes a self-signed TLS mode, but its default Web 1.2.2 image has no certificate-generation entrypoint and does not listen on :8443. The workload becomes Ready on HTTP while the chart's HTTPS Service endpoint refuses connections.

Chart 1.3.1 repairs that path with the smallest already-published compatible image change. It deliberately keeps the Hub application and migration binary on 1.2.2 rather than bundling the unrelated Hub/Web 1.3.0 release.

What changes

• appVersion remains 1.2.2, so the Hub server and migration image do not change.
• The default Web image is pinned to 1.2.3, the first published Web image that contains the gated :8443 self-signed listener.
• When web.tls.selfSigned=true, the Web readiness probe checks HTTPS on the named https port. Kubelet skips certificate verification for HTTPS probes, so the intentionally self-signed certificate is supported. Liveness remains on HTTP :8080.
• ci/selfsigned-values.yaml makes chart-testing install the self-signed configuration. The HTTPS readiness gate rejects the exact chart/image mismatch that escaped the 1.3.0 test path.

The readiness gate also protects explicit image overrides: a custom Web image that does not implement the chart's :8443 contract will stall the rollout instead of producing a Ready workload with a dead public endpoint.

Scope and compatibility

This is not a coordinated Hub application release and does not introduce a Hub schema migration. It changes the Web workload for every chart upgrade from 1.3.0, including installations that do not use self-signed TLS, because 1.2.3 is the narrowest TLS-capable Web image already published.

Web 1.2.3 was built from source revision bd219ef; compared with the Web 1.2.2 source revision f98f1e3, its runtime delta contains the TLS entrypoint/config plus frontend-only self-hosting documentation links and signup-intent UI changes. It adds no new frontend API paths and remains compatible with Hub 1.2.2. Both selected images have linux/amd64 and linux/arm64 manifests, although the chart's existing default node selector still pins workloads to amd64.

Validation

• ct lint --target-branch main
• helm lint with ci/test-values.yaml
• helm lint with ci/selfsigned-values.yaml
• rendered default, self-signed, and explicitly old-Web configurations and asserted the selected Hub/Web images and HTTP/HTTPS readiness behavior
• visual test skipped: this is Helm workload wiring; the PR's Install & Upgrade Test exercises the live pods in kind

The first chart release that adds ci/selfsigned-values.yaml gets fresh-install coverage for that values case; subsequent releases also inherit it as an upgrade-values case. The normal 1.3.0-to-1.3.1 upgrade path remains covered by the existing test values.

Publication boundary

Updating this branch publishes nothing. Merging it to main would trigger chart-releaser and publish radar-hub-1.3.1; that merge and publication require separate explicit approval naming that artifact and version.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 30749f2. Configure here.}