Stop passing the removed --mode flag to the sentinel

.github/workflows/ci.yaml

@@ -50,9 +50,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: azure/setup-helm@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
       - name: Helm lint + template
         run: |
           helm lint charts/understudy
           helm template smoke charts/understudy > /dev/null
       - name: Chart metadata tracks appVersion
         run: make chart-check
+      - name: Binaries accept the chart's args
+        run: make chart-args-check

Makefile

@@ -112,6 +112,10 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 chart-check: ## Verify the chart's Artifact Hub metadata tracks appVersion
 	./hack/check-chart-metadata.sh
 
+.PHONY: chart-args-check
+chart-args-check: ## Verify every binary accepts the args the chart passes it
+	./hack/check-chart-args.sh
+
 .PHONY: release
 release: ## Push the multi-arch image and the chart for VERSION, from a tagged clean tree.
 	./hack/release.sh $(VERSION)

charts/understudy/templates/sentinel.yaml

@@ -65,7 +65,6 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: ["/sentinel"]
           args:
-            - --mode=sentinel
             - --cloud={{ .Values.sentinel.cloud }}
             - --surge-on-rebalance={{ .Values.sentinel.surgeOnRebalance }}
           env:

hack/check-chart-args.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Every binary must accept the args the chart passes it: a flag removed from a
+# binary but still rendered by the chart crash-loops that workload on install.
+
+chart="charts/understudy"
+bin="$(mktemp -d)"
+trap 'rm -rf "$bin"' EXIT
+
+go build -o "$bin/manager" cmd/main.go
+go build -o "$bin/sentinel" cmd/sentinel/main.go
+
+rendered_args() {
+  helm template smoke "$chart" --set sentinel.enabled=true --show-only "$1" |
+    awk '/^ *args:/ { in_args = 1; next }
+         in_args && /^ *- / { sub(/^ *- /, ""); gsub(/^"|"$/, ""); print; next }
+         { in_args = 0 }'
+}
+
+status=0
+for pair in templates/deployment.yaml:manager templates/sentinel.yaml:sentinel; do
+  template="${pair%%:*}"
+  binary="${pair#*:}"
+  if ! rendered="$(rendered_args "$template")"; then
+    echo "error: could not render args from $template" >&2
+    status=1
+    continue
+  fi
+  if [[ -z "$rendered" ]]; then
+    echo "error: $template rendered no args for $binary" >&2
+    status=1
+    continue
+  fi
+  args=()
+  while IFS= read -r arg; do args+=("$arg"); done <<< "$rendered"
+  if ! output="$("$bin/$binary" "${args[@]}" -h 2>&1)"; then
+    echo "error: $template passes $binary args it does not accept: ${args[*]}" >&2
+    echo "$output" | head -n 1 >&2
+    status=1
+  fi
+done
+
+exit "$status"