Remove duplicate containerSecurityContext key in memcached values

Summary

Fixes the chart/values.yaml half of #299 (closed), plus one defect found while reviewing that fix.

1. A duplicate containerSecurityContext: key under memcached: made the file invalid YAML, which broke Renovate's helm-values manager (YAMLParseError: DUPLICATE_KEY at the old line 3797) and caused it to silently extract 0 dependencies for Loki.
2. The surviving block carried fsGroup: 10001, which is not a field on v1.Container.securityContext. Same for memcachedExporter.containerSecurityContext.

Root cause (duplicate key)

c1580bb9 (Renovate/Ironbank, Dec 2025 — the wholesale resync against the upstream memcached values block) inserted a second, partial containerSecurityContext ahead of the pre-existing one instead of merging into it. YAML is last-key-wins, so the newer partial block was already inert; the block actually in effect was the older one (07be6323, May 2024) carrying Big Bang's hardened non-root uid/gid 10001 overrides. This MR removes the newer duplicate and keeps the hardened original, so rendered output is unchanged by that commit — verified below.

Root cause (fsGroup)

fsGroup is a PodSecurityContext field. v1.Container.securityContext has twelve properties and fsGroup is not one of them:

allowPrivilegeEscalation, appArmorProfile, capabilities, privileged, procMount,
readOnlyRootFilesystem, runAsGroup, runAsNonRoot, runAsUser, seLinuxOptions,
seccompProfile, windowsOptions

chart/templates/memcached/_memcached-statefulset.tpl:131 and :172 render these values straight into containers[].securityContext, where the API server discards the unknown field — or rejects the object outright under fieldValidation=Strict. It has never had any effect. Volume ownership is, and always was, governed by memcached.podSecurityContext.fsGroup: 11211.

Also included

• chart/Chart.yaml: 6.55.0-bb.3 → 6.55.0-bb.4
• CHANGELOG.md entry, per CONTRIBUTING.md step 4
• README.md regenerated with helm-docs v1.14.2 and the gluon templates. The pre-fix README carried both duplicate memcached.containerSecurityContext rows — the generated docs still contained the very duplicate this MR removes.

Validation

A note on tests/test-values.yaml, since it is the obvious thing to reach for: it is a Big Bang umbrella values file, not a chart values file. helm template chart -f tests/test-values.yaml merges loki.enabled / strategy / values into the chart's own unrelated loki: config block, and renders zero memcached containers, because resultsCache.enabled and chunksCache.enabled both default to false. It cannot exercise anything this MR changes. Every render below therefore enables the memcached paths explicitly:

helm template loki chart \
  --set chunksCache.enabled=true \
  --set resultsCache.enabled=true \
  --set memcachedExporter.enabled=true

Check	Result
yamllint -d '{rules: {key-duplicates: enable}}' chart/values.yaml	clean; 1 error at line 3790 before the fix
yaml@2.8.1 with uniqueKeys: true — the parser Renovate's helm-values manager uses	parses cleanly, 57 top-level keys
helm lint chart	0 failures
helm unittest -f 'unittests/*_test.yaml' chart	6/6 pass
helm-docs regeneration vs the committed README.md	byte-identical
Rendered manifests: main vs the duplicate-key fix alone	byte-identical — confirms the removed block was inert
Rendered manifests: main vs this branch	4 fsGroup lines removed, helm.sh/chart label bumped, nothing else
Rendered container securityContext vs the v1.32 strict StatefulSet schema	4 invalid fields → 0

The helm-docs toolchain was confirmed reproducible before being trusted: regenerating on unmodified main reproduces the committed README.md byte-for-byte, so the diff here is a real regeneration and not a hand-edit of generated output.

Upgrade Notices

No action required. This is a bugfix-only release:

• The invalid fsGroup field is removed from memcached.containerSecurityContext and memcachedExporter.containerSecurityContext — it belongs on podSecurityContext, not containerSecurityContext, and was silently discarded (or rejected under strict field validation) by the API server. Volume ownership was never governed by this field; memcached.podSecurityContext.fsGroup: 11211 already sets it correctly, so this has no operational effect.
• The duplicate containerSecurityContext key removed from chart/values.yaml was already dead (YAML is last-key-wins); rendered output is unchanged by that part of the fix.

Scope note (issue #299 (closed))

Issue #299 (closed) also asked to look at renovate/ironbank branch state, MR !362 (closed), and the dashboard. That part turned out to already be resolved by normal repo activity:

• The manual migration work that used to live on the old renovate/ironbank branch (MR !362 (closed)) is preserved on loki-migration — it was never lost, just moved off Renovate's branch. That branch is intentionally unmerged/frozen pending epic 672 (big-bang&672; see the renovate.json package rule pinning Loki <7.0.0).
• MR !362 (closed) is closed with its branch deleted (force_remove_source_branch); Renovate cleanly regenerated renovate/ironbank and it merged as !371 (merged), closing the dependency dashboard issue (#296 (closed)). No conflicting state remains.

🤖 Generated with Claude Code