From 5db12e655660667bfb2efa1dd8c1493f7e1f2945 Mon Sep 17 00:00:00 2001
From: Michalis Kargakis <kargakis@protonmail.com>
Date: Sat, 17 Oct 2026 21:29:36 +0200
Subject: [PATCH 1/2] Stop passing the removed --mode flag to the sentinel, and
 check chart args in CI

---
 .github/workflows/ci.yaml                 |  5 ++++
 Makefile                                  |  4 +++
 charts/understudy/templates/sentinel.yaml |  1 -
 hack/check-chart-args.sh                  | 34 +++++++++++++++++++++++
 4 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100755 hack/check-chart-args.sh

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3293ee5..449c840 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -50,9 +50,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: azure/setup-helm@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
       - name: Helm lint + template
         run: |
           helm lint charts/understudy
           helm template smoke charts/understudy > /dev/null
       - name: Chart metadata tracks appVersion
         run: make chart-check
+      - name: Binaries accept the chart's args
+        run: make chart-args-check
diff --git a/Makefile b/Makefile
index 43e161f..92d2cbd 100644
--- a/Makefile
+++ b/Makefile
@@ -112,6 +112,10 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 chart-check: ## Verify the chart's Artifact Hub metadata tracks appVersion
 	./hack/check-chart-metadata.sh
 
+.PHONY: chart-args-check
+chart-args-check: ## Verify every binary accepts the args the chart passes it
+	./hack/check-chart-args.sh
+
 .PHONY: release
 release: ## Push the multi-arch image and the chart for VERSION, from a tagged clean tree.
 	./hack/release.sh $(VERSION)
diff --git a/charts/understudy/templates/sentinel.yaml b/charts/understudy/templates/sentinel.yaml
index 04fdf95..10c88ea 100644
--- a/charts/understudy/templates/sentinel.yaml
+++ b/charts/understudy/templates/sentinel.yaml
@@ -65,7 +65,6 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: ["/sentinel"]
           args:
-            - --mode=sentinel
             - --cloud={{ .Values.sentinel.cloud }}
             - --surge-on-rebalance={{ .Values.sentinel.surgeOnRebalance }}
           env:
diff --git a/hack/check-chart-args.sh b/hack/check-chart-args.sh
new file mode 100755
index 0000000..b6b4848
--- /dev/null
+++ b/hack/check-chart-args.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Every binary must accept the args the chart passes it: a flag removed from a
+# binary but still rendered by the chart crash-loops that workload on install.
+
+chart="charts/understudy"
+bin="$(mktemp -d)"
+trap 'rm -rf "$bin"' EXIT
+
+go build -o "$bin/manager" cmd/main.go
+go build -o "$bin/sentinel" cmd/sentinel/main.go
+
+rendered_args() {
+  helm template smoke "$chart" --set sentinel.enabled=true --show-only "$1" |
+    awk '/^ *args:/ { in_args = 1; next }
+         in_args && /^ *- / { sub(/^ *- /, ""); gsub(/^"|"$/, ""); print; next }
+         { in_args = 0 }'
+}
+
+status=0
+for pair in templates/deployment.yaml:manager templates/sentinel.yaml:sentinel; do
+  template="${pair%%:*}"
+  binary="${pair#*:}"
+  args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(rendered_args "$template")
+  if ! output="$("$bin/$binary" "${args[@]}" -h 2>&1)"; then
+    echo "error: $template passes $binary args it does not accept: ${args[*]}" >&2
+    echo "$output" | head -n 1 >&2
+    status=1
+  fi
+done
+
+exit "$status"

From 6f3601fa1506716a688e3e7f6f39b5988d49108d Mon Sep 17 00:00:00 2001
From: kylan11 <francesco.lauritano1@protonmail.com>
Date: Mon, 19 Oct 2026 11:04:02 +0200
Subject: [PATCH 2/2] Fail chart argument checks when rendering fails

---
 hack/check-chart-args.sh | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hack/check-chart-args.sh b/hack/check-chart-args.sh
index b6b4848..fe52a90 100755
--- a/hack/check-chart-args.sh
+++ b/hack/check-chart-args.sh
@@ -22,8 +22,18 @@ status=0
 for pair in templates/deployment.yaml:manager templates/sentinel.yaml:sentinel; do
   template="${pair%%:*}"
   binary="${pair#*:}"
+  if ! rendered="$(rendered_args "$template")"; then
+    echo "error: could not render args from $template" >&2
+    status=1
+    continue
+  fi
+  if [[ -z "$rendered" ]]; then
+    echo "error: $template rendered no args for $binary" >&2
+    status=1
+    continue
+  fi
   args=()
-  while IFS= read -r arg; do args+=("$arg"); done < <(rendered_args "$template")
+  while IFS= read -r arg; do args+=("$arg"); done <<< "$rendered"
   if ! output="$("$bin/$binary" "${args[@]}" -h 2>&1)"; then
     echo "error: $template passes $binary args it does not accept: ${args[*]}" >&2
     echo "$output" | head -n 1 >&2