README.md gains a comprehensive 'Chart style guidelines' section - the
binding end state of the conventions overhaul (#32, batches 0-4) for all
current and future charts: naming (incl. the PVC-name exception and the
StatefulSet migration pattern), versioning scheme and semver rules,
image pinning, the ingress standard (domain + clusterIssuer strictly
required without defaults, className default nginx, annotations merge,
TLS secret name, homeassistant exception), security hardening with
mandatory documentation of deviations, probes, the auto-limits scheme,
the secrets.<name>SecretRef convention, tpl-rendered env blocks,
scaling, and the icon/lint/CI-fixture/no-dependencies rules.
The Versioning section now points there and documents that app-version
updates go through PRs. CLAUDE.md's conventions section is aligned as a
compact summary referencing the README guide.
Per the maintainer decision (option a: ingress.clusterIssuer strictly
required in ALL charts) the two remaining defaults are removed as well:
- cyberchef: drop the letsencrypt default; bump raised from minor to
major (6.0.0+up11.4.0) as this is a breaking values change.
- urlaubsverwaltung: drop the letsencrypt-issuer default; major bump
to 6.0.0+up6.7.0.
- CI test-values for both charts now set clusterIssuer explicitly.
A repo-wide grep confirms no chart carries a clusterIssuer default
anymore.
- apache-tika, gotenberg, cyberchef, homeassistant, patchmon: additive env
value blocks rendered through tpl (value, secretKeyRef and configMapKeyRef
forms), following the template-chart/outline pattern; patchmon gets separate
blocks for the server container and the guacd sidecar.
- homeassistant: ingress.className now defaults to nginx; an empty className
omits ingressClassName from the rendered Ingress, so the flexible upstream
ingress style stays intact.
- outline, paperless-ngx: remove the ingress.clusterIssuer defaults
(letsencrypt / letsencrypt-issuer) - the value is now strictly required,
consistent with the repo-wide ingress standard; CI test-values set it
explicitly.
Chart bumps: apache-tika 7.2.0, gotenberg 4.2.0, cyberchef 5.2.0,
patchmon 5.2.0, homeassistant 4.2.0 (minor); outline 5.0.0,
paperless-ngx 10.0.0 (major).
Batch-3 major PR for paperless-ngx (issue #32):
- secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/
databaseSecretRef/paperlessSecretRef (consistent with the other
SecretRef values in the same block); CI fixtures updated
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
(domain no longer part of the name)
- busybox init/cronjob image pinned via paperless.busybox.image
values, default bumped 1.28 -> 1.38.0
- probes values-configurable (defaults unchanged, incl. the 600s
startup budget); consume CronJob deliberately stays probe-less
- ingress standard: ingress.className (default nginx) and
ingress.annotations merge; domain/clusterIssuer stay required
- additive paperless.env block rendered through tpl (value,
secretKeyRef, configMapKeyRef forms)
- disabled scripts ConfigMap renamed to ...-configmap; PVC names kept
as documented naming-scheme exception (comments in the templates)
- chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)
- Rename all resources from <chart>-<release>-uv-<kind> to the repo
standard <release>-<chart>-<kind> (deployment, service, ingress, both
OnePasswordItem secrets); drop the uv infix. No PVCs in this chart, so
no storage migration is needed.
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
(was tls-<chart>-<release>-ingress).
- Probes lifted into values (urlaubsverwaltung.livenessProbe/
readinessProbe/startupProbe); defaults are exactly the previously
hardcoded, issue-#9-calibrated settings.
- Repo-standard flexible ingress: ingress.className (default nginx),
ingress.annotations merged with the cert-manager annotation,
ingress.enabled flag; domain/clusterIssuer stay required.
- Additive urlaubsverwaltung.env block rendered through tpl with
value/secretKeyRef/configMapKeyRef forms.
- CI fixtures updated to the new secret names.
Major bump 4.1.2+up6.7.0 -> 5.0.0+up6.7.0 (resource renames).
- Values-driven securityContext for the Synapse pod/container with hardened
defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu
drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all
capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID
env vars are removed (the securityContext controls the user).
- Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment,
ConfigMap to ...-delegation-nginx-configmap (references and service selector
updated).
- matrix.configSecretRef moved to secrets.configSecretRef (repo standard).
- Probes for Synapse and the delegation nginx are values-configurable;
defaults are the previous hardcoded settings.
- Flexible ingress standard: ingress.className (default nginx) and
ingress.annotations merged with the cert-manager annotation.
- Additive matrix.env block rendered through tpl (value/secretKeyRef/
configMapKeyRef forms).
- CI fixtures: secret ref moved, seed job image synced to appVersion.
- Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).
Repo-standard flexible ingress (required clusterIssuer instead of the
hardcoded letsencrypt-issuer, domain moved from config.domain to
ingress.domain, className value, annotations merge, standard TLS secret
name), secrets.<name>SecretRef structure, core secret renamed to the
standard -secret name, additive tpl-rendered env block, documented PVC
naming exception. Major bump 4.1.2+up4.7.0 -> 5.0.0+up4.7.0.
All audit findings for the calibre-web-automated chart (#32) in one major
bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6:
- Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the
inverted <chart>-<release>-cwa-<kind> scheme to
<release>-<chart>-<kind>; spec.serviceName and all references follow.
Both PVCs deliberately keep their historical names (documented naming
exception; renaming would orphan the data).
- TLS secret renamed to the standard tls-<release>-<chart>-ingress.
- Ingress on the repo standard: ingress.className (default nginx),
ingress.annotations merged with the chart-managed annotations,
ingress.clusterIssuer now required (was silently defaulted to
"letsencrypt-issuer").
- Security hardening, values-configurable via securityContext.pod /
securityContext.container: allowPrivilegeEscalation false, all
capabilities dropped except the minimal set the s6-overlay init needs
(CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented
deviations: the image must start as root (s6 drops to PUID 1000) and
readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID
remapping upstream and breaks the ImageMagick policy setup).
- Additive env value rendered through tpl (value / secretKeyRef /
configMapKeyRef forms).
- CI fixtures: secret renamed to the new scheme, clusterIssuer added to
test-values.
Part of #32.
Enable readOnlyRootFilesystem and drop all capabilities by default. The
paths the image writes at runtime are covered by emptyDirs (/tmp,
/opt/app/logs and STATIC_ROOT /opt/app/myapp/static); an init container
seeds the static volume with the assets shipped in the image because the
directory doubles as the app's static source. The ephemeral-storage
request covers the ~90Mi static emptyDir.
Move the Ingress to the repo-standard flexible style: ingress.className
value (default nginx) instead of a hardcoded ingressClassName, and
ingress.annotations merged with the cert-manager annotation. domain and
clusterIssuer stay required; the TLS secret name was already standard.
Major bump 3.1.2+up1.30.1 -> 4.0.0+up1.30.1 (hardening changes runtime
behavior). App version unchanged. Part of #32.
All audit findings from #32 for the satisfactory chart in one major PR:
- StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service
to ...-service (standard scheme); template file satisfactory-server.sfs.yaml
renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name
(documented naming exception; renaming would orphan the data).
- Hardened, values-configurable security contexts (securityContext.pod /
securityContext.container): runAsNonRoot with the image's steam user
(uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs
mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make
the read-only root filesystem work; all other writes go to the PVC.
- Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults
exactly the previously hardcoded values.
- Additive env value rendered through tpl with value/secretKeyRef/
configMapKeyRef forms (template-chart pattern).
Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames +
hardening); appVersion unchanged.
- Rename the Deployment (and its labels/selector/pod template/container)
to {{ .Release.Name }}-{{ .Chart.Name }}-deployment per the naming
scheme; the Service selector follows.
- Move the hardcoded pod/container security contexts into values
(rallly.securityContext.pod / .container), defaults unchanged; the
bogus null entry under capabilities.add becomes an empty list.
- Ingress standard: ingress.className value (default nginx) and
ingress.annotations merged with the cert-manager annotation;
domain/clusterIssuer stay required, TLS secret name already conformed.
- Add the tpl-rendered rallly.env value (value/secretKeyRef/
configMapKeyRef forms), appended to the built-in env.
- Major bump 3.1.2+up4.12.3 -> 4.0.0+up4.12.3 (deployment rename
replaces the Deployment on upgrade: selector is immutable).
Batch-3 major PR for teamspeak-server (issue #32):
- Rename service and StatefulSet to the repo naming scheme
({{ .Release.Name }}-{{ .Chart.Name }}-service / -sfs); the PVC keeps
its historical name (documented naming exception, data preservation).
- NodePorts configurable via server.voicePort / server.fileTransferPort
(defaults 30987/30033, satisfactory pattern); ports are also passed to
the server via TSSERVER_DEFAULT_PORT / TSSERVER_FILE_TRANSFER_PORT.
- Hardened, values-configurable security contexts
(securityContext.pod/container): non-root uid/gid 9987,
readOnlyRootFilesystem, all capabilities dropped.
- Probes values-configurable (defaults unchanged).
- Additive env value rendered through tpl (value/secretKeyRef/
configMapKeyRef forms).
- Chart 3.1.2 -> 4.0.0 (+up6.0.0.beta12.1).
- Add securityContext.pod/container values with hardened defaults; the
dockur/samba image requires root and a writable root filesystem, so the
remaining deviations from the baseline are documented in values.yaml
(caps reduced to CHOWN, DAC_OVERRIDE, FOWNER, NET_BIND_SERVICE, SETGID,
SETUID; allowPrivilegeEscalation: false)
- Make the NodePorts configurable (samba.smbNodePort/netbiosNodePort,
defaults 30445/30139 as published before)
- Rename secrets.sambaUsersRef to secrets.sambaUsersSecretRef (breaking)
- Rename the ConfigMap from -config-cfm to -configmap
- Add the tpl-rendered env value convention (value, secretKeyRef,
configMapKeyRef forms)
- Fix the CI users.conf fixture to the username:uid:groupname:gid:password
format the pinned image actually parses
- Bump chart to 4.0.0+up4.23.10
Part of #32
- Pod and container securityContext are now values-configurable
(outline.securityContext.pod/container) with hardened defaults:
runAsNonRoot (uid/gid 1001, the upstream image's nodejs user),
readOnlyRootFilesystem, allowPrivilegeEscalation false, all
capabilities dropped. /tmp is mounted as an emptyDir for Outline's
import/export scratch files.
- Probes moved to values (outline.livenessProbe/readinessProbe/
startupProbe); defaults are exactly the previously hardcoded ones.
- Ingress raised to the repo standard: ingress.className (default
nginx), ingress.annotations merged with the always-set annotations,
ingress.enabled flag; domain/clusterIssuer stay required and the
TLS secret name was already conform.
- Additive outline.env block rendered through tpl with value/
secretKeyRef/configMapKeyRef forms; chart-managed env stays in the
template.
Major bump 3.1.1+up1.9.2 -> 4.0.0+up1.9.2 (runtime behavior changes
through hardening).
Part of #32
Establish the flexible ingress standard from #32 in template-chart and
document it in README/CLAUDE.md: ingress.domain and ingress.clusterIssuer
stay required, new ingress.className value (default nginx) replaces the
hardcoded ingressClassName, new optional ingress.annotations are merged
with the cert-manager cluster-issuer annotation, TLS secret name
unchanged (tls-<release>-<chart>-ingress).
Apply the standard to cyberchef and patchmon (the two charts without an
own batch-3 major PR) and make the patchmon probes values-configurable
(server + guacd, rendered through tpl so the default Host header keeps
following ingress.domain). Defaults render semantically identical to the
previous hardcoded output.
cyberchef 5.0.1 -> 5.1.0, patchmon 5.0.1 -> 5.1.0 (minor, additive).
- Add icon: to all 17 Chart.yaml (official project icons); removes the
last helm lint --strict INFO finding across the repo
- Rename template files to the <app>.<kind>.yaml scheme (apache-tika,
gotenberg, teamspeak-server PVC, paperless-ngx configmap) - pure
git mv, no content changes
- template-chart: fix missing space in {{ .Chart.Name}} and rename the
ConfigMap resource -config-map -> -configmap (chart is never published)
- rallly: fix typos in required messages (rallySecret -> ralllySecret,
databseSecret -> databaseSecret)
- README: document the deliberate PVC-name exception from the naming
scheme (renames would provision new empty volumes)
- Patch-bump all 16 published charts
Rendered resources are byte-identical for all published charts (only
helm's '# Source:' comments change for the renamed files); the only
render change is the template-chart ConfigMap name.
Part of #32
The delegation nginx image was hardcoded as nginx:1.28.3 in the
deployment template. It is now rendered from the new values
matrix.delegation.image.repository / matrix.delegation.image.tag,
defaulting to nginx:1.30.4 (current stable line, tag verified against
Docker Hub). README documents that auxiliary/sidecar images are pinned
via values and reviewed with every app-version update round.
Chart version: 4.1.1+upv1.159.0 -> 4.2.0+upv1.159.0 (minor: additive
values change).
Chart rewrite for the 2.x single-server architecture: one stateless
server deployment (frontend embedded, /api served by the same process),
no PVC, single service and ingress path, optional guacd sidecar
(disabled by default), 2.x env vocabulary (TRUST_PROXY, readonly role),
probes send the public hostname as Host header.
Fixes#29: all three reported spots (PVC storageClass guard, RWX assets
PVC, frontend nginx 'backend' hostname) are removed by this rewrite.
Major app jump 2.20.15 -> 3.0.5. Chart major bump (7.1.1 -> 8.0.0):
the paperless.files.barcodes.scanner value is removed (pyzbar and
PAPERLESS_CONSUMER_BARCODE_SCANNER were removed upstream), the
paperless.ocr.mode default changes from the removed "skip" to "auto",
and the startup probe budget is raised to 600s for the one-time
Whoosh -> Tantivy index rebuild. New optional values:
paperless.ocr.archiveFileGeneration, paperless.files.deleteDuplicates,
oidc.provider.tokenAuthMethod.
Major jump 10.22.1 -> 11.4.0: the upstream image switched to
nginxinc/nginx-unprivileged (serving port 80 -> 8080, pid/temp dirs
under /tmp). Adjust container port, writable-volume mounts and the
pod security context (sysctl net.ipv4.ip_unprivileged_port_start no
longer needed). Chart major bump 4.1.0 -> 5.0.0 accordingly.
Nine non-critical app-version bumps, each with a chart patch bump:
- apache-tika 3.2.3.0-full -> 3.3.1.0-full
- gotenberg 8.26.0 -> 8.36.0
- matrix-synapse v1.149.1 -> v1.159.0
- rallly 4.8.1 -> 4.12.3
- samba 4.23.5 -> 4.23.10
- urlaubsverwaltung 6.5.0 -> 6.7.0
- voucher-vault 1.27.4 -> 1.30.1
- zipline 4.6.4 -> 4.7.0
- teamspeak-server v6.0.0-beta8 -> 6.0.0-beta12.1 (new tag format has no v prefix)
Release notes of every chart were checked for environment-variable
changes; none of the charts needs an env adjustment.
The teamspeak-server install-test is reactivated: beta12.1 ships a
valid default license, so the exclusion is removed, CI fixtures are
added under ci/teamspeak-server/, and the install-test was verified
in a local k3d cluster. README list of excluded charts updated.
Every Deployment/StatefulSet now takes its replica count from a replicas
value (default 1, explicit 0 allowed) via a new per-chart <chart>.replicas
helper; the helper uses a kindIs "invalid" nil check so an explicit 0 is
not swallowed by Helm's default function. A chart-global scaleDown flag
(default false) takes precedence: it renders every workload with
replicas: 0 and suspends the paperless-ngx consume CronJob, stopping the
app without uninstalling it (PVCs, Secrets, Services and Ingress remain).
Defaults leave the rendered manifests byte-identical to main, so all
published charts get a minor version bump; the template-chart carries the
reference helper implementation and stays unversioned.
Fixes#25
Every chart now renders its container resources through a duplicated
_helpers.tpl helper (reference implementation in template-chart): requests
ship as chart defaults, missing memory and ephemeral-storage limits are
computed as resources.limitFactor x the request (default 3, satisfactory
keeps 2 to preserve its previously published 8Gi limit), an explicitly set
limit always wins, and a CPU limit is only rendered when set explicitly.
Fixed limit defaults are removed from all values.yaml files; teamspeak-server
gains a values-driven resources block instead of hardcoded template values.
Major version bump for all published charts.
jklein