The bundled Helm chart's web pod has no way to address the registry

[mgoldsborough]

deploy/kubernetes/helm/mpak/templates/web-deployment.yaml sets no env, and values.yaml has no web.env. The web pod's registry address therefore comes entirely from the image default, http://mpak-registry:3200.

That happens to be correct for helm install mpak …, the command in README.md, because mpak.fullname resolves to mpak and the Service is mpak-registry. Any other release name breaks it: helm install foo … renders foo-mpak-registry, the default still points at mpak-registry, and every server-rendered route 503s while /health stays green — it deliberately does not touch the registry, so the rollout looks healthy.

A self-hoster has no values knob to correct it.

Fix — derive the address from the template that names the Service:

env:
  - name: MPAK_API_URL
    value: http://{{ include "mpak.fullname" . }}-registry:{{ .Values.registry.service.port }}

That makes the chart correct for any release name and stops the image default being load-bearing for anyone, at which point the ENV line in apps/web/Dockerfile can go.

While in there: the same chart's web.podSecurityContext.runAsUser: 101 # nginx-unprivileged UID and readOnlyRootFilesystem: false # nginx needs to write tmp files describe a runtime that no longer exists — the web image has been a Node server running as USER node (uid 1000) since #164.

Found while reviewing #173.