helm: reject a networkPolicy.components key that names no component

The component names are not guessable - objectstorage-provisioner,
seaweedfs-all-in-one, volume-<name> - and a typo silently dropped the rules
it was carrying. Check against every component the chart can produce, not
the enabled ones, so a values file shared across releases can still hold
overrides for a component this one leaves off.

.github/workflows/helm_ci.yml

@@ -1109,6 +1109,12 @@ jobs:
           else:
               print("volume-resize-hook policy tracks its Job rather than rendering always")
 
+          # A components key that names nothing reads as "these rules are applied"
+          # and silently does not apply them.
+          expect_failure(dict(on, **{"networkPolicy.components.filerr.extraIngress[0].ports[0].port": "1"}),
+                         '"filerr" is not a component of this chart',
+                         "a misspelled networkPolicy.components key fails the render")
+
           # The bucket hook is post-install, so the release manifest is already applied;
           # its policy must be a plain resource that uninstall cleans up.
           if "helm.sh/hook" in (pols["bucket-hook"]["metadata"].get("annotations") or {}):

k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml

@@ -127,6 +127,21 @@
 {{-   $targets = append $targets (dict "component" "volume-resize-hook" "ports" (list) "apiserver" true "hook" "pre-install,pre-upgrade" "hookWeight" "-10") }}
 {{- end }}
 
+{{- /* A key under networkPolicy.components that names no component would be
+       read as "these rules are applied" and silently do nothing. Check against
+       every component the chart can produce rather than the ones enabled here,
+       so one values file can still carry overrides for a component this release
+       leaves off. */}}
+{{- $known := list "master" "filer" "s3" "sftp" "admin" "worker" "volume" "bucket-hook" "volume-resize-hook" "objectstorage-provisioner" "seaweedfs-all-in-one" }}
+{{- range $vname, $_ := (.Values.volumes | default dict) }}
+{{-   $known = append $known (trimSuffix "-" (printf "volume-%s" $vname)) }}
+{{- end }}
+{{- range $name, $_ := $overrides }}
+{{-   if not (has $name $known) }}
+{{-     fail (printf "networkPolicy.components: %q is not a component of this chart, so its rules would never be applied. Known components: %s." $name (join ", " (sortAlpha $known))) }}
+{{-   end }}
+{{- end }}
+
 {{- range $target := $targets }}
 {{- $component := $target.component }}
 {{- $override := get $overrides $component | default dict }}