Inject HyperDX dnsConfig via kustomize helmCharts inflation
Date: 2026-06-30 Status: Accepted Decision: hl-hssw Deciders: Sean Brandt
Context
Section titled “Context”The ClickStack chart 3.0.0 (latest published) has no dnsConfig passthrough, so the ndots:1 fix needed to unblock HyperDX alert-webhook DNS resolution (musl getaddrinfo search-domain short-circuit on fzymgc.house, hl-qjh3.12) could not be expressed as chart values. hl-qjh3.12 shipped an interim: a live-only kubectl dnsConfig patch on the cs-clickstack-app Deployment plus an ArgoCD ignoreDifferences entry on /spec/template/spec/dnsConfig — a bidirectional GitOps blind spot (no self-heal of the field, no detection of a malicious dnsConfig mutation). The repo had no precedent for kustomize Helm-chart inflation, and enabling it requires a global, Terraform-managed ArgoCD config change (argocd-cm kustomize.buildOptions) plus restructuring the clickstack Application from a plain Helm source into a multi-source kustomize+helmCharts source.
Decision
Section titled “Decision”Enable kustomize Helm-chart inflation (—enable-helm via kustomize.buildOptions in argocd-cm, set in tf/cluster-bootstrap/argocd.tf) and convert the clickstack Application’s primary source to a kustomize helmCharts: source carrying a strategic-merge dnsConfig (ndots:1) patch on the cs-clickstack-app Deployment — rather than forking the chart or waiting on an upstream PR. A byte-level render diff (helm template vs kustomize build —enable-helm) gates the change; the interim ignoreDifferences entry + manual patch are removed once the field is Git-sourced.
Rationale
Section titled “Rationale”- Resolves the bidirectional ignoreDifferences blind spot (no self-heal, no drift detection) immediately, rather than after weeks of upstream merge+release+targetRevision lead time.
- Avoids the maintenance/drift burden of vendoring a multi-subchart umbrella chart (mongodb + clickhouse + otel-collector) for a single pod-spec field.
- Establishes a reusable, repo-wide mechanism for future chart-passthrough gaps instead of a one-off escape hatch; the chart stays pinned upstream.
Alternatives Considered
Section titled “Alternatives Considered”- A — ArgoCD kustomize helmCharts inflation (—enable-helm) + strategic-merge dnsConfig patch (chosen): fixes the live blind spot now, chart stays pinned, reusable pattern; costs a global TF-applied ArgoCD setting + a two-PR ordering dependency + a new render path with residual fidelity risk (mitigated by the render-diff gate).
- B — upstream chart PR adding dnsConfig passthrough (rejected): idiomatic and has repo precedent, but gated on external maintainer merge + release + targetRevision bump, leaving the security blind spot live for weeks. Not precluded; may still be pursued independently.
- C — vendor/fork the umbrella chart in-repo (rejected): self-contained with no global change, but clickstack is an umbrella chart whose subcharts would all be vendored — a large surface and ongoing drift-tracking burden for a one-field fix.
Consequences
Section titled “Consequences”- Positive: removes the live security blind spot (a malicious dnsConfig mutation now self-heals); establishes the first repo precedent for kustomize helmCharts, reusable for future passthrough gaps.
- Negative: couples this fix to a global, Terraform-applied ArgoCD setting (kustomize.buildOptions) with a hard PR-ordering dependency (—enable-helm must be live before the restructured Application syncs); adds a new render path (helm template via kustomize) whose fidelity must be diff-verified per use.
- Neutral: chart stays pinned upstream; option B (upstream PR) remains open. Relates-to (does not supersede) epic ADRs hl-toju, hl-lil1, hl-hpbv.