feat: roll HyperDX pods on config changes

[bsosnader]

Summary

• add chart-owned pod-template checksums for the rendered HyperDX ConfigMap and optional Secret
• preserve existing user annotation merge precedence while reserving scoped checksum keys
• document automatic rollout behavior and external Secret limitations
• add focused Helm unit coverage for deterministic, content-sensitive checksums

Motivation

HyperDX consumes clickstack-config and clickstack-secret through envFrom. Kubernetes resolves those environment variables when a pod starts, so changing only the ConfigMap or Secret during helm upgrade leaves existing HyperDX pods with stale startup configuration unless the Deployment pod template also changes.

This follows Helm's documented include ... | sha256sum rollout pattern. The ConfigMap and Secret manifests now share canonical named renderers with the Deployment checksums, ensuring the hashed content cannot drift from the resources Helm applies.

No new values API is needed: these are chart-managed resources with deterministic rollout behavior. Arbitrary template paths or tpl evaluation in user values would be less safe and would not improve this owned-resource case.

Backward compatibility

Existing hyperdx.deployment.annotations and hyperdx.deployment.podAnnotations values remain merged with the same precedence. The generated checksum/clickstack-config and checksum/clickstack-secret keys are chart-reserved and override caller values so stale hashes cannot disable rollouts.

checksum/clickstack-secret is omitted when hyperdx.secrets: null, matching Secret rendering and envFrom behavior. Externally managed Secret changes still require an explicit rollout because Helm cannot hash resources it does not render.

The first upgrade containing this change intentionally performs a one-time HyperDX rollout because the generated annotations are added to the pod template.

Tests

• helm unittest -f tests/hyperdx-rollout-checksums_test.yaml charts/clickstack
• helm unittest charts/clickstack — 31 suites, 257 tests
• helm lint --strict charts/clickstack
• default chart render
• ALB ingress, API-only, and OTEL custom-config example renders
• git diff --check

[changeset-bot]

🦋 Changeset detected

Latest commit: fa92f63

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
helm-charts	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[CLAassistant]

All committers have signed the CLA.