[B-03] Helm name helpers truncate base before appending suffixes, creating DNS-invalid names exceeding 63 characters

[alix-graylog]

Summary

Name helper functions in _helpers.tpl truncate resource names to 63 characters before appending suffixes (e.g., -sa, -init-cm). This causes derived resource names to exceed
the 63-character Kubernetes DNS label limit. A 53-character release name can produce Service and ConfigMap names of 77–88 characters.

Details

The issue occurs across multiple helper functions that append suffixes to graylog.fullname:

• graylog.cm.init.name (line 60): include "graylog.fullname" . | printf "%s-init-cm"
• graylog.serviceAccountName (line 69): include "graylog.fullname" . | printf "%s-sa"
• graylog.mongodb.serviceAccountName (line 80): include "graylog.fullname" . | printf "%s-mongo-sa"

The graylog.fullname helper (lines 13-24) truncates to 63 characters on lines 15, 19, and 21. When suffixes are appended afterward, the final resource name exceeds 63
characters, violating the Kubernetes DNS naming spec.

Example: Release name my-very-long-release-name-that-is-fifty-three-chars-long (53 chars):

• Truncated fullname: 63 chars (already at limit)
• After appending -init-cm: 71 chars (exceeds DNS label limit)
• After appending -mongo-sa: 72 chars (exceeds DNS label limit)

Reference: B-03 (Production Readiness Review)

Impact

Resource creation fails with DNS label validation errors when long release names are used, preventing deployments on clusters with strict validation. This is particularly
problematic in CI/CD environments where release names may be auto-generated with timestamps or environment identifiers.

How to Reproduce?

Environment

• Helm chart version: v4.2.0 or later
• Kubernetes version: any (this is a naming constraint issue)

Pre-flight checks

• helm lint ./graylog passes
• Checked existing issues for duplicates

Steps to reproduce the issue:

1. Use a long release name (at or near 53 characters):

   helm template my-very-long-release-name-that-is-fifty-three-characters-long ./graylog
   

2. Inspect the generated ServiceAccount and ConfigMap names in the output:
   helm template my-very-long-release-name-that-is-fifty-three-characters-long ./graylog | grep -E "name:|kind:" | head -30
3. Count characters in derived names like graylog-init-cm and graylog-mongo-sa.

Expected behavior
All generated resource names should be 63 characters or fewer to comply with the Kubernetes DNS naming specification.

Actual behavior
ConfigMap names, ServiceAccount names, and other derived resources exceed 63 characters, violating DNS label constraints and potentially causing validation failures during helm
install or helm upgrade.

Notes for maintainers

The fix requires refactoring the naming helpers to truncate the complete derived name after all suffixes are appended, rather than truncating the base fullname before appending.

Current pattern (wrong):
{{- include "graylog.fullname" . | trunc 63 | printf "%s-init-cm" }}

Corrected pattern:
{{- include "graylog.fullname" . | printf "%s-init-cm" | trunc 63 | trimSuffix "-" }}

This ensures that:

1. The base fullname is calculated
2. The suffix is appended
3. The complete name is truncated to 63 characters
4. Trailing hyphens are removed if truncation occurred mid-suffix

Apply this fix consistently across all helpers that append suffixes (lines 60, 69, 80, and any others in service/ingress/pdb/pvc templates).