fix(helm): harden mTLS cert volume defaultMode 0644→0440 (chart 0.4.1)

[bborbe]

Summary

Follow-up to #34. Hardens the mTLS cert volume defaultMode 420 (0644) → 288 (0440) in the shared agent.kafkaCertVolumes helper — drops world-read on the mounted client key. Keeps group-read so a non-root pod (runAsUser+fsGroup) can still read it; 0400 would deny it (secret files are owned root:fsGroup). Chart 0.4.0 → 0.4.1. Matches the parallel bborbe/maintainer chart fix (#69).

Default render byte-identical to master (mTLS off); only affects clusters that opt into kafkaUser.enabled: true.

Test plan

• helm template (enabled): defaultMode: 288 on all 9 cert volumes
• helm lint clean; make precommit green
• default render unchanged vs master

[ben-s-pull-request-reviewer]

All 9 cert volumes confirmed (3 volumes × 3 components: executor, controller, recurring-task-creator), all correctly using defaultMode: 288. The review is complete.

---

PR Review Summary

PR: fix(helm): harden mTLS cert volume defaultMode 0644→0440 (chart 0.4.1)
Base: master → Head: fix/chart-mtls-defaultmode (25a9ce7)

Findings

Scope: 3 files changed — CHANGELOG.md, helm/Chart.yaml, helm/templates/_helpers.tpl

Area	File	Assessment
Security	_helpers.tpl	✅ defaultMode: 288 (decimal) = 0440 octal. Removes world-read bit, retains group-read so fsGroup-based non-root pods can still read certs/key. Correct hardening.
Correctness	_helpers.tpl	✅ All 9 volumes (3 cert types × 3 components: executor, controller, recurring-task-creator) call the same hardened agent.kafkaCertVolumes helper — change is consistent across the board.
Versioning	Chart.yaml	✅ version: 0.4.0 → 0.4.1 matches patch-level scope.
Changelog	CHANGELOG.md	✅ ## Unreleased section added with accurate description of the security fix and chart version bump.
Documentation	_helpers.tpl	✅ Clear inline comment explaining why 0440 was chosen (owner+group read, no world read, 0400 would break fsGroup access).

Toolchain notes: ast-grep-runner and selector-mode guide are not accessible in this environment (/home/node/.claude/... path out of allowed scope). This is non-blocking — the diff touches only Helm templates (no Go/Python code), and all judgment rules were manually verified.

precommit (selector mode): Skipped — CI covers lint+test for this Helm-only change.

Verdict

{
  "verdict": "approve",
  "summary": "Clean Helm security hardening: correctly changes 9 mTLS cert volume defaultModes from 0644 to 0440 (octal), dropping world-read while preserving fsGroup-based group-read for non-root pods. Chart version, CHANGELOG, and inline comments are all accurate and consistent.",
  "comments": [],
  "concerns_addressed": [
    "security: mTLS cert volume defaultMode hardened from 0644 to 0440 — world-read removed, group-read retained for fsGroup access — verified in _helpers.tpl:49,56,63",
    "correctness: 288 decimal = 0440 octal — verified all 9 cert volumes (3 types × 3 components) use updated helper consistently",
    "correctness: Chart version bump 0.4.0→0.4.1 matches patch scope — verified in Chart.yaml:6"
  ]
}