fix(helm): give the server Deployment its own component selector

[lusoris]

Summary

The chart's server Deployment and StatefulSet selected only name and instance, so they also matched the operator and node Pods (T-HELM-SERVER-DEPLOYMENT-SELECTOR-OVERLAP-2026-09-27). Kubernetes does not support overlapping selectors, and kubectl logs deployment/vmafx printed the operator's log in the E2E run. Both selectors now include app.kubernetes.io/component: server. The Services, ServiceMonitor, PDBs and NetworkPolicy already selected by component.

Upgrade note for rc.1 installs: a selector is immutable, so a plain helm upgrade from 1.0.0-rc.1 fails with spec.selector: ... field is immutable. Per your 2026-09-27 decision (recorded as ADR-1353), there is no chart major bump; the upgrade guide documents delete-and-reinstall. The tested path is:

kubectl delete deployment,statefulset -n <ns> --cascade=orphan \
  -l app.kubernetes.io/instance=<release>,app.kubernetes.io/component=server
helm upgrade <release> deploy/helm/vmafx -n <ns>

On a kind cluster (Kubernetes v1.37.0, Helm 4.2.4, rc.1 chart and published rc.1 images), the new Deployment adopts the running Pod without a restart. The StatefulSet keeps its Pod and PVC.

• New gate: scripts/ci/check-helm-selector-isolation.py fails if any workload selector matches another component's Pods, or if a Service or PDB spans components. It runs in helm-chart.yml over Deployment, StatefulSet and Job renders, with 19 unit tests.
• Docs: docs/development/k8s-deployment.md gains "Upgrading from 1.0.0-rc.1", including uninstall/reinstall and Argo CD/Flux notes. docs/k8s/integration-tests.md gains a troubleshooting entry.
• Chart version stays 0.1.0: the release guide keeps it packaging-only, and release-please owns appVersion.

Type

• fix — bug fix

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• make format && make lint is green locally. Partly: ruff, black, strict mypy, actionlint, shellcheck, reuse lint, markdownlint and mkdocs build --strict pass; some Windows-host hooks need ninja/LF.
• Unit tests pass: python3 scripts/ci/run_meson_test.py -- -C build. Not applicable: chart and CI change only.

Bug-status hygiene (ADR-0165)

• docs/state.md: the row moves to Recently closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: the upgrade-path decision and its evidence are in ADR-1353.
• Decision matrix — ADR-1353 ## Alternatives considered.
• AGENTS.md invariant note — deploy/helm/vmafx/AGENTS.md and scripts/ci/AGENTS.md.
• Reproducer / smoke-test command — see below.
• CHANGELOG fragment — changelog.d/fixed/helm-server-selector.md.
• Rebase note — new entry in docs/rebase-notes.md.

Reproducer

helm template t deploy/helm/vmafx --set operator.enabled=true --set node.enabled=true > /tmp/rendered.yaml
python3 scripts/ci/check-helm-selector-isolation.py /tmp/rendered.yaml   # passes; the rc.1 chart fails
python3 -m pytest scripts/ci/tests/test_check_helm_selector_isolation.py -q   # 19 passed

The existing E2E builds a fresh cluster on each run, so it only ever installs. The one-time rc.1 upgrade was exercised manually on kind, as described above, rather than added to CI.

🤖 Generated with Claude Code