CP-41221: add chart-wide env injection via defaults.env

helm/templates/_helpers.tpl

@@ -1015,6 +1015,76 @@ annotations:
 {{- end -}}
 {{- end -}}
 
+{{/*
+Generate a container env block by merging a list of env-entry sources.
+
+Parameters (dict):
+- env:  List of env-entry lists to merge (required).
+
+Each list element is itself a list of env-entry dicts ({name, value} or
+{name, valueFrom}). Sources can come from:
+  - an inline list of dicts built with `(list (dict "name" "..." "value" ...))`
+  - the output of an env-emitting helper, parsed via `fromYamlArray`:
+      (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+  - a list value from values.yaml: `.Values.defaults.env`
+
+Merge behavior:
+- Later sources override earlier sources by `name` (last wins).
+- First-seen wins for ordering; overrides retain the entry's original position.
+- Nil/empty sources are skipped.
+- Entries without a `name` field are skipped (defensive only — the
+  `.Values.defaults.env` schema rejects them at render time via the
+  io.k8s.api.core.v1.EnvVar ref).
+
+Output:
+- If at least one entry survives the merge, emits an `env:` key followed by
+  the merged list as YAML.
+- If the merged list is empty, emits nothing — caller's container ends up
+  with no env block, preserving the chart's default rendering.
+
+Source-list precedence convention (lowest → highest):
+  1. `.Values.defaults.env` — chart-wide user override; lowest priority.
+  2. Component-specific user env (e.g. `.Values.server.env`) — overrides
+     chart-wide user env on collision but loses to chart-emitted entries.
+  3. Chart-emitted helper output (`validatorEnv` etc.).
+  4. Chart-emitted hardcoded literals (`SERVER_PORT`, `NODE_NAME`,
+     `HOSTNAME`) — highest priority; these are load-bearing for the
+     chart's correctness and must not be overridable.
+
+Example:
+  {{- include "cloudzero-agent.generateEnv" (dict
+      "env" (list
+        .Values.defaults.env
+        .Values.server.env
+        (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+        (list (dict "name" "SERVER_PORT" "value" (printf "%d" (int .Values.aggregator.shipper.port))))
+      )
+    ) | nindent 10 }}
+*/}}
+{{- define "cloudzero-agent.generateEnv" -}}
+{{- $sources := .env | default (list) -}}
+{{- $byName := dict -}}
+{{- $order := list -}}
+{{- range $list := $sources -}}
+  {{- range $entry := $list -}}
+    {{- if and $entry $entry.name -}}
+      {{- if not (hasKey $byName $entry.name) -}}
+        {{- $order = append $order $entry.name -}}
+      {{- end -}}
+      {{- $_ := set $byName $entry.name $entry -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- if $order -}}
+{{- $result := list -}}
+{{- range $name := $order -}}
+  {{- $result = append $result (index $byName $name) -}}
+{{- end -}}
+env:
+{{- $result | toYaml | nindent 2 -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Generate affinity sections
 */}}
@@ -1530,6 +1600,7 @@ Returns: The Istio cluster ID string (explicit or fallback to clusterName)
 {{- .Values.integrations.istio.clusterID | default .Values.clusterName -}}
 {{- end -}}
 
+
 {{/*
 Validator Stage Helper
 

helm/templates/agent-daemonset.yaml

@@ -65,11 +65,12 @@ spec:
             - /bin/sh
             - -c
             - sed "s/\${NODE_NAME}/$NODE_NAME/g" /etc/config/prometheus/configmaps/unprocessed/prometheus.yml.in > /etc/config/prometheus/configmaps/processed/prometheus.yml
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (list (dict "name" "NODE_NAME" "valueFrom" (dict "fieldRef" (dict "fieldPath" "spec.nodeName"))))
+              )
+            ) | nindent 10 }}
           {{- include "cloudzero-agent.generateResources" (include "cloudzero-agent.mergeStringOverwrite" (list
               (.Values.components.agent.reloader.resources | default (dict))
               (.Values.configmapReload.prometheus.resources | default (dict))
@@ -91,6 +92,11 @@ spec:
             - --watched-dir=/etc/config
             - --reload-url=http://127.0.0.1:9090/-/reload
             - --listen-address=:8080
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+              )
+            ) | nindent 10 }}
           ports:
             - containerPort: 8080
           livenessProbe:
@@ -128,14 +134,13 @@ spec:
         {{- end }}
         - name: {{ template "cloudzero-agent.name" . }}-server
           {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.prometheus.image "compat" (dict "repository" .Values.server.image.repository "tag" (include "cloudzero-agent.Values.components.prometheus.image.tag" .) "digest" .Values.server.image.digest "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            {{- if .Values.server.env }}
-            {{- toYaml .Values.server.env | indent 12}}
-            {{- end }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                .Values.server.env
+                (list (dict "name" "NODE_NAME" "valueFrom" (dict "fieldRef" (dict "fieldPath" "spec.nodeName"))))
+              )
+            ) | nindent 10 }}
           args:
             - --config.file=/etc/config/prometheus.yml
             - --web.enable-lifecycle

helm/templates/agent-deploy.yaml

@@ -61,8 +61,12 @@ spec:
       initContainers:
         - name: {{ .Values.validator.name }}-copy
           {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.agent.image "compat" .Values.validator.image) | nindent 10 }}
-          env:
-            {{- include "cloudzero-agent.validatorEnv" . | nindent 12 }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+              )
+            ) | nindent 10 }}
           command:
             - /app/cloudzero-agent-validator
             - install
@@ -84,8 +88,12 @@ spec:
               mountPath: /checks/config/
         - name: {{ .Values.validator.name }}-run
           {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.agent.image "compat" .Values.validator.image) | nindent 10 }}
-          env:
-            {{- include "cloudzero-agent.validatorEnv" . | nindent 12 }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+              )
+            ) | nindent 10 }}
           command:
             - /checks/bin/cloudzero-agent-validator
             - diagnose
@@ -115,6 +123,11 @@ spec:
             - --watched-dir=/etc/config
             - --reload-url=http://127.0.0.1:9090/-/reload
             - --listen-address=:8080
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+              )
+            ) | nindent 10 }}
           ports:
             - containerPort: 8080
           livenessProbe:
@@ -161,11 +174,13 @@ spec:
               "tag" (include "cloudzero-agent.Values.components.prometheus.image.tag" .)
               "digest" .Values.server.image.digest
               "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
-          {{- if .Values.server.env }}
-          env:
-{{ toYaml .Values.server.env | indent 12}}
-            {{- include "cloudzero-agent.validatorEnv" . | nindent 12 }}
-          {{- end }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                .Values.server.env
+                (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+              )
+            ) | nindent 10 }}
           lifecycle:
             postStart:
               exec:
@@ -252,12 +267,13 @@ spec:
             - --cluster.enabled=true
             - --cluster.name={{ .Values.clusterName }}
             {{- end }}
-          env:
-            - name: HOSTNAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            {{- include "cloudzero-agent.validatorEnv" . | nindent 12 }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+                (list (dict "name" "HOSTNAME" "valueFrom" (dict "fieldRef" (dict "fieldPath" "metadata.name"))))
+              )
+            ) | nindent 10 }}
           lifecycle:
             postStart:
               exec:

helm/templates/aggregator-deploy.yaml

@@ -80,9 +80,12 @@ spec:
             - name: port-collector
               containerPort: {{ .Values.aggregator.collector.port }}
           command: ["/app/cloudzero-collector", "-config", "{{ .Values.aggregator.mountRoot }}/config/config.yml"]
-          env:
-            - name: SERVER_PORT
-              value: "{{ .Values.aggregator.collector.port }}"
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (list (dict "name" "SERVER_PORT" "value" (printf "%d" (int .Values.aggregator.collector.port))))
+              )
+            ) | nindent 10 }}
           volumeMounts:
             {{- include "cloudzero-agent.apiKeyVolumeMount" . | nindent 12 }}
             - name: aggregator-config-volume
@@ -126,9 +129,12 @@ spec:
             - name: port-shipper
               containerPort: {{ .Values.aggregator.shipper.port }}
           command: ["/app/cloudzero-shipper", "-config", "{{ .Values.aggregator.mountRoot }}/config/config.yml"]
-          env:
-            - name: SERVER_PORT
-              value: "{{ .Values.aggregator.shipper.port }}"
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (list (dict "name" "SERVER_PORT" "value" (printf "%d" (int .Values.aggregator.shipper.port))))
+              )
+            ) | nindent 10 }}
           volumeMounts:
             {{- include "cloudzero-agent.apiKeyVolumeMount" . | nindent 12 }}
             - name: aggregator-config-volume

helm/templates/backfill-job.yaml

@@ -155,6 +155,11 @@ spec:
                 - -config
                 - "{{ include "cloudzero-agent.insightsController.configurationMountPath" $ }}/server-config.yaml"
                 - -backfill
+              {{- include "cloudzero-agent.generateEnv" (dict
+                  "env" (list
+                    $.Values.defaults.env
+                  )
+                ) | nindent 14 }}
               {{- include "cloudzero-agent.generateResources" (include "cloudzero-agent.mergeStringOverwrite" (list
                     ($.Values.components.webhookServer.backfill.resources | default (dict))
                     ($.Values.insightsController.resources | default (dict))

helm/templates/config-loader-job.yaml

@@ -56,8 +56,12 @@ spec:
       containers:
         - name: run-validator
           {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.agent.image "compat" .Values.validator.image) | nindent 10 }}
-          env:
-            {{- include "cloudzero-agent.validatorEnv" . | nindent 12 }}
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+                (include "cloudzero-agent.validatorEnv" . | fromYamlArray)
+              )
+            ) | nindent 10 }}
           command:
             - /app/cloudzero-cluster-config
             - load

helm/templates/helmless-job.yaml

@@ -61,6 +61,11 @@ spec:
             - /etc/config/values/values.yaml
             - --output
             - "-"
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+              )
+            ) | nindent 10 }}
           {{- include "cloudzero-agent.generateResources" .Values.components.miscellaneous.helmless.resources | nindent 10 }}
           {{- include "cloudzero-agent.generateContainerSecurityContext" (mergeOverwrite
                 (.Values.defaults.securityContext | default (dict))

helm/templates/init-cert-job.yaml

@@ -62,6 +62,11 @@ spec:
           {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.agent.image "compat" .Values.initCertJob.image) | nindent 10 }}
           command: ["/app/cloudzero-certifik8s"]
           workingDir: /var/tmp
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+              )
+            ) | nindent 10 }}
           {{- include "cloudzero-agent.generateResources" .Values.components.miscellaneous.initCert.resources | nindent 10 }}
           {{- include "cloudzero-agent.generateContainerSecurityContext" (mergeOverwrite
               (.Values.defaults.securityContext | default (dict))

helm/templates/webhook-deploy.yaml

@@ -118,6 +118,11 @@ spec:
           args:
             - -config
             - "{{ include "cloudzero-agent.insightsController.configurationMountPath" . }}/server-config.yaml"
+          {{- include "cloudzero-agent.generateEnv" (dict
+              "env" (list
+                .Values.defaults.env
+              )
+            ) | nindent 10 }}
           ports:
             - containerPort: 8443
           {{- include "cloudzero-agent.generateResources" (include "cloudzero-agent.mergeStringOverwrite" (list