DND-1418: document jclouds compatibility plan + guard b2/atmos past 3.3.0

README: replace the compatibility note with our actual plan. Frame the jclouds
sunset as upstream's announced intent (only Atmos and B2 are explicitly named;
no jclouds-free release has shipped yet), stop over-claiming that rackspace
breaks (it is Swift-compatible and may be served by openstack-swift-sdk), and
state the plan: support through 3.3.0 on 0.x, hard-fail if a no-successor
jclouds backend is used past 3.3.0, and move the chart to 1.x.x when S3Proxy
ships its first jclouds-free release.

configmap.yaml: add a render-time guardrail. If b2 (or atmos, if ever added) is
enabled while the effective S3Proxy version (image.tag, else appVersion) parses
as semver and is > 3.3.0, fail with an actionable message. Non-semver tags
(master, sha-*) are not version-checked; 3.3.0 and earlier are allowed.

Verified: default renders clean; b2 + image.tag=3.4.0 fails with the message;
b2 on 3.3.0 / non-semver tags / non-jclouds backends all render; helm lint,
kubeconform (all test-values), and helm-polish (0 errors) clean.

Author: CRThaze

charts/s3proxy/README.md.gotmpl

@@ -23,12 +23,18 @@
 
 The chart tracks S3Proxy (`andrewgaul/s3proxy`) through `appVersion` (currently `{{ template "chart.appVersion" . }}`); override it with `image.tag`. Minimum supported version is `2.7.0`.
 
-S3Proxy `3.0.0` deprecated the Apache jclouds storage backends (`s3`, `aws-s3`, `azureblob`, `filesystem`, `transient`) in favor of SDK / NIO2 providers, and `3.3.0` is the last release to bundle jclouds. The jclouds providers still function on 3.x but are deprecated upstream:
+S3Proxy `3.0.0` deprecated the Apache jclouds storage backends (`s3`, `aws-s3`, `azureblob`, `filesystem`, `transient`) in favor of SDK / NIO2 providers. Upstream has announced that `3.3.0` is the last release to bundle jclouds and that future releases "will lack its Atmos and B2 storage backends" (no jclouds-free release has shipped yet; `3.3.0` remains the latest). The jclouds providers still work on 3.x, but are deprecated:
 
-- `filesystem` / `transient`: default to the non-deprecated `*-nio2` variants (`nio2: true`).
+- `filesystem` / `transient`: already default to the non-deprecated `*-nio2` variants (`nio2: true`).
 - `azureblob`: prefer `provider: azureblob-sdk` (the jclouds `azureblob` provider is deprecated and mis-signs against custom endpoints such as Azurite).
-- `s3`, `googleCloudStorage`, `openstackSwift`: SDK providers exist upstream (`aws-s3-sdk`, `google-cloud-storage-sdk`, `openstack-swift-sdk`); migrating the chart defaults to them is tracked separately.
-- `b2`, `rackspaceCloudfiles`: jclouds-only with no SDK successor; they will stop working on S3Proxy releases after `3.3.0`.
+- `s3`, `googleCloudStorage`, `openstackSwift`: SDK providers exist upstream (`aws-s3-sdk`, `google-cloud-storage-sdk`, `openstack-swift-sdk`). `rackspaceCloudfiles` is OpenStack-Swift-compatible and may be served by `openstack-swift-sdk`. Migrating the chart defaults to the SDK providers is tracked separately.
+- `b2` (and Atmos, if ever added) are jclouds-only with **no SDK successor**. These are the backends upstream has said future releases will drop.
+
+### Our compatibility plan
+
+- **Through S3Proxy `3.3.0` (chart `0.x`):** all current backends, including the jclouds-only `b2`, are supported. This is where the chart sits today.
+- **Guardrail:** the chart **hard-fails at render time** if `b2` (or `atmos`) is enabled while the effective S3Proxy version (`image.tag`, else `appVersion`) is greater than `3.3.0`, so an upgrade past the jclouds sunset cannot silently ship a broken backend. Pin `image.tag` to `3.3.0` or earlier, or disable the backend.
+- **When S3Proxy ships its first jclouds-free release:** the chart moves to `1.x.x` (major bump), migrates the remaining backends to their SDK providers, and drops `b2`/`atmos`. Tracked in the SDK-migration follow-up.
 
 ## Installation
 

charts/s3proxy/templates/configmap.yaml

@@ -60,6 +60,25 @@ s3proxy.sharded-blobstore.levels=2
 s3proxy.large-object-mocking=true
   {{- end }}
 {{- end }}
+{{- /*
+  Guardrail (DND-1418): the jclouds-only backends below have no SDK successor, and
+  upstream has announced they are dropped after S3Proxy 3.3.0. Fail the render if
+  one is enabled while the effective S3Proxy version (image.tag, else appVersion)
+  parses as semver and is greater than 3.3.0, so upgrading past the jclouds sunset
+  cannot silently ship a broken backend. Non-semver tags (master, sha-*) are not
+  version-checked. When S3Proxy ships a jclouds-free release the chart moves to
+  1.x.x and migrates/removes these backends.
+*/}}
+{{- $s3pVersion := .Values.image.tag | default .Chart.AppVersion -}}
+{{- if regexMatch "^v?[0-9]+\\.[0-9]+\\.[0-9]+" $s3pVersion }}
+  {{- if semverCompare "> 3.3.0" (trimPrefix "v" $s3pVersion) }}
+    {{- range $backend := list "b2" "atmos" }}
+      {{- if dig $backend "enabled" false $.Values.config.backends }}
+        {{- fail (printf "config.backends.%s is enabled, but the %q S3Proxy backend relies on Apache jclouds, which is dropped after 3.3.0 (resolved image version %s). Pin image.tag to 3.3.0 or earlier, or disable config.backends.%s. See the chart README 'S3Proxy version compatibility' notes." $backend $backend $s3pVersion $backend) }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata: