feat(geo-ip): Setting up side car geoip update, working downloads

[alix-graylog]

Summary

Migrate GeoIP database updates from a standalone Kubernetes CronJob to a sidecar container on the Graylog StatefulSet pods. The CronJob mounted Graylog's ReadWriteOnce PVC from a separate pod, causing Multi-Attach errors on multi-node clusters and breaking helm install/upgrade. Running geoipupdate as a sidecar in the same pod eliminates the attach conflict and refreshes the database on a schedule without pod restarts.

Details

• New sidecar container (_geoip-sidecar.tpl) added to the Graylog StatefulSet, rendered only when geolocation.enabled and geolocation.sidecar.enabled are true and credentials are available.
• New entrypoint ConfigMap (config/geoip-sidecar-entrypoint.yaml) providing the in-pod cron scheduling script; mounted read-only at /geoip-scripts, with a geoip-tmp emptyDir at /tmp and the shared data volume at /usr/share/data/geolocation.
• Removed the legacy CronJob: deleted templates/workload/cronjobs/geoip.yaml and the graylog.geoip.job.spec helper in _helpers.tpl.
• Values changes (values.yaml, values.schema.json):
  • Added graylog.config.geolocation.sidecar.{enabled,image,schedule,resources,securityContext}.
  • Added graylog.config.geolocation.maxmindGeoIp.editionIds (parametrized; was hardcoded).
  • Pinned the updater image to maxmindinc/geoipupdate:7.1.1 (was latest).
  • Removed obsolete maxmindGeoIp.cronSchedule and maxmindGeoIp.postInstallRun.
• Secrets: MaxMind credentials use consistent keys GEO_IP_MAXMIND_ACCOUNT_ID / GEO_IP_MAXMIND_LICENSE_KEY, compatible with global.existingSecretName. Template fails with a clear message if credentials are missing while the sidecar is enabled.
• Docs: added docs/GeoIP_Sidecar_Deployment_Guide.md.
• Tests/CI fixes: moved the sidecar named-template into a _*.tpl partial so helm-unittest's scoped templates: suites can resolve the include, and removed the obsolete geoip_cronjob_test.yaml suite that targeted the deleted CronJob template.

Linked issues

This fixes #101

PR Checklist

• Tests added/updated
• Documentation updated
• This PR includes a new feature
• This PR includes a bugfix
• This PR includes a refactor

Testing Checklist

Static Validation

• Linter check passes: helm lint ./charts/graylog
• Helm renders local template successfully: helm template graylog ./charts/graylog (geolocation on and off both render, exit 0)

Installation

• Fresh installation completes successfully: helm install graylog ./charts/graylog
• All pods reach Running state: kubectl rollout status statefulset/graylog
• Helm tests pass: helm test graylog

Specific to this PR

• Unit tests pass: helm unittest charts/graylog → 6 suites / 54 tests passing (helm-unittest v1.0.3, helm v3.17)
• Sidecar downloads databases on schedule and Graylog reads updated GeoIP data
• Multi-node cluster deploys without Multi-Attach errors (the original bug)
• global.existingSecretName path works with the required GEO_IP_MAXMIND_* keys

Notes for reviewers

• Verify all applicable tests above pass
• Validate that the linked issues are no longer reproducible, if applicable
• Sync up with the author before merging
• The commit history should be preserved - use rebase-merge or standard merge options when applicable

Reviewer note: charts/graylog/tests/unit/geolocation_sidecar_test.yaml is not executed by CI — the plugin glob is tests/*_test.yaml (non-recursive), so nothing under tests/unit/ runs. If moved into tests/ as-is it would fail (missing config/graylog.yaml in its templates: list, and off-by-one env-index assertions: editionIds is env[2] not [3], schedule is env[5] not [6]). Suggested follow-up: fix and relocate it to restore the sidecar coverage previously provided by the deleted CronJob suite.