fix(datanode): raise default data volume so search cache fits; document data tiering

[monrax]

Summary

The default datanode.config.nodeSearchCacheSize (10gb) exceeded the default Data Node data volume (8Gi, ~7gb usable). Since node_search_cache_size reserves space on the Data Node data volume (disk, not memory), enabling an S3 (or path_repo) snapshot repository makes the Data Node fail preflight with not enough usable space for the node search cache and crash-loop. Plain installs are unaffected as the cache validation only runs when a repository is configured. This PR aligns the defaults and documents data tiering setup.

Details

• values.yaml: datanode.persistence.data.size 8Gi -> 20Gi so the default 10gb cache fits alongside hot index data.
• NOTES.txt: install/upgrade-time warning when data tiering is enabled and the cache does not fit the data volume (skipped when an existingClaim is used).
• README.md: new Enable Data Tiering usage section (S3 client config, AWS https/path_style_access=false overrides, cache-vs-volume sizing note); ToC entries for Geolocation and Data Tiering; fixed a broken TLS anchor; repo doc links switched to absolute URLs so they resolve on ArtifactHub.
• docs/data-tiering.md: new guide with AWS S3 and MinIO walkthroughs, linking to go2docs for the Enterprise warm-tier UI workflow.

PR Checklist

Please check the items that apply to your change.

• Tests added/updated
• Documentation updated
• This PR includes a new feature
• This PR includes a bugfix
• This PR includes a refactor

Testing Checklist

Static Validation

• Linter check passes: helm lint ./charts/graylog
• Helm renders local template sucessfully: helm template graylog ./charts/graylog --validate

Installation

• Fresh installation completes successfully: helm install graylog ./charts/graylog
• All pods reach Running state: kubectl rollout status statefulset/graylog
• Helm tests pass: helm test graylog

Functional (if applicable)

• Web UI accessible and login works
• DataNodes visible in System > Cluster Configuration
• Inputs can be created and receive data

Upgrade (if applicable)

• Upgrade from previous release succeeds
• Scaling up/down works correctly
• Configuration changes apply correctly

Specific to this PR

• Reproduced the Data Node CrashLoopBackOff on the old 8Gi default + 10gb cache (not enough usable space... only 7gb available)
• Confirmed the Data Node reaches 1/1 Running on the new 20Gi default
• Confirmed the NOTES warning fires only when cache >= data volume (validated across scenarios via --dry-run=client)
• Verified the full hot->warm lifecycle (repo verified, snapshot to bucket, searchable warm index) against real AWS S3
• Verified the full hot->warm lifecycle against in-cluster MinIO
• All testing done on EKS with a Graylog Enterprise license

Notes for reviewers

• Verify all applicable tests above pass
• Validate that the linked issues are no longer reproducible, if applicable
• Sync up with the author before merging
• The commit history should be preserved - use rebase-merge or standard merge options when applicable

🤖 Generated with Claude Code