Add opt-in Brainstore startup gate for API pods

[Alexey Soldatchenko (soldatchenko)]

Helm can start a new API before Brainstore supports its query behavior. This adds an opt-in init container that waits for compatible Brainstore capacity, allowing a single Helm upgrade without customer-side sequencing steps.

Behavior

• api.brainstoreStartupGate.enabled defaults to false and applies to every API pool.
• Checks reader, writer, and fastreader readiness and release tags. Incompatible pods, including terminating pods, block startup. Two successful checks release the gate; failures and timeouts keep the API stopped for Kubernetes to retry.
• Each API pod keeps its own minimum version, defaulting to its API release tag. Newer Brainstore releases in the same major are accepted, allowing older APIs to restart during later compatible rollouts.
• Uses namespace-scoped read-only RBAC and a restricted helper container. Only the init container mounts the Kubernetes API token; custom sidecars needing API access must project their own.

Requires stable release tags, API rolling updates with zero unavailable replicas and nonzero surge, sufficient surge capacity, and Kubernetes API access. Application owners must confirm the assumed release compatibility. Rollback sequencing is not covered; Brainstore downgrades can temporarily cause query errors.

Validation

• 33 Python tests, 342 Helm tests, provider renders, and lint passed; CI is green.
• Gate-enabled provider/isolation renders and packaged-chart checks passed.
• No cluster canary yet. Keep this draft and disabled by default until real queries, upgrade/retry behavior, older API restarts, rollback convergence, and fresh installation are tested.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T19:33:45.424738Z	afe6af8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Kevin Green (KevinGreen)]

Suggested change

	{{- $defaults := dict
	"enabled" false
	{{- $defaults := dict
	"enabled" true

I guess this might need to be bumped too?