jlab-cluster/helm-charts
3
0 Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Wiki Activity
360 Commits 5 Branches 0 Tags
00ea301e332eb64d022322016272c929ee1869ee
Commit Graph
69 Commits
Author SHA1 Message Date
jklein 1ae5e1a7c3 CI: report Trivy misconfiguration findings for changed charts 
Adds a trivy-config job to the PR pipeline that renders each changed chart
with Helm and runs `trivy config` over the rendered manifests. Reporting
only - TRIVY_CONFIG_MODE=report always exits 0, so the job never blocks a PR.

Rendered manifests rather than the chart directory: `trivy config <chart-dir>`
renders with default values, which fails on every chart here because of their
required() values - and Trivy does not fail with it, it logs "Skipping chart"
and prints an empty, green report.

Values come from the install-test fixtures (ci/<chart>/test-values.yaml), the
only committed per-chart values in the repo; none of them touches
securityContext, images or capabilities, so the scan sees the chart's own
hardening. Charts without fixtures get ci/trivy/values/<chart>.yaml.

Exceptions live in ci/trivy/trivyignore.yaml in Trivy's native ignore-file
schema, each with a statement - the script refuses to run without one and
reports suppressed findings with their reason instead of hiding them.
AVD-KSV-0125 is configured instead of excepted: ci/trivy/data/ksv0125.yaml
lists the trusted registries, so the check stays able to flag a genuinely
foreign source.

Refs #84.
 2026-08-23 23:14:12 +02:00
jklein a68192e5fb Import minecraft-server chart for Fleet migration stage 1 (java8 line) 
Imports the chart from cluster-config functionally unchanged, wires it into
the publish/validate/install-test pipelines and publishes it as the first of
three Java lines (0.4.0+upjava8).

The only deviation from the source chart is the chart-global scaleDown flag
plus a server.replicas value, following the satisfactory pattern: two of the
three servers stand at 0 replicas in the cluster, which the chart could not
express, and Fleet would otherwise start them on reconcile. The default
(scaleDown: false) still renders replicas: 1, so the rendering of the running
server is unchanged - verified byte-identical against the three real values
files for all three Java lines.

Known deficiencies (hardening, probes, naming scheme, hardcoded values,
missing icon, the misleading mc-router auto-discovery annotations) are left
untouched on purpose and are scheduled for stage 2.
 2026-08-23 15:57:17 +02:00
jklein 3be5111630 Import minecraft-router chart unchanged (Fleet migration stage 1) 
Takes the existing mc-router chart over from cluster-config as-is so the
deployment can move to Fleet without any change to the rolled-out state.
Convention alignment follows in stage 2, the app update in stage 3.

The only deviation from "unchanged": Chart.yaml carried name:
minecraft-server (copy-paste from the sister chart). The publish job pushes
by the glob <directory>-*.tgz while helm package names the archive after the
Chart.yaml name, so without this correction the push finds no file.

Version 0.1.1+up1.25.1 - chart semver stays at 0.1.1, the +up suffix is repo
policy and does not affect rendering.

Also wires up CI: publish workflow, change-app-version choice list,
install-test values (CI-only node-port override, since 25565 is outside the
k3d default range) and the README chart table.
 2026-08-23 12:58:21 +02:00
jklein c668780fd3 Fix satisfactory publish workflow name 2026-08-22 15:15:21 +02:00
jklein cc6084ca58 Add install-test stage to the PR pipeline (k3d) 
New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.
 2026-08-21 23:12:38 +02:00
jklein ded2f59020 Rename detect job output to any-chart-changed for clarity 2026-08-21 17:03:22 +02:00
jklein 79f9260f56 Add PR pipeline validating changed helm charts 
On every pull request, detect which chart directories were touched and
run helm lint --strict, helm package, and a chart-version bump check
for exactly those charts. PRs without chart changes skip the build.

Fixes #5
 2026-08-21 16:55:47 +02:00
jklein 3c7e7f8e00 Remove unused music-assistant-skill chart 
The chart is no longer needed. Removes the chart directory, its publish
workflow, and its row in the README chart table. Already published
versions remain in the registry.

Fixes #7
 2026-08-21 16:50:43 +02:00
jklein 1b56c4bdb2 Upgrade actions/checkout from v2 to v4 
Fixes #6
 2026-08-21 16:47:29 +02:00
jklein 3bed5a1717 Merge pull request #13 from jk-cluster/fix/publish-branch-filter 
Restrict publish workflows to pushes on main
 2026-08-21 16:42:21 +02:00
jkleinandClaude Fable 5 62d2caae66 Restrict publish workflows to pushes on main 
Without a branch filter, any push on any branch touching a chart
directory packaged and published the chart to the registry.

Fixes #4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-21 16:40:20 +02:00
jkleinandClaude Fable 5 04283df8c4 Remove non-functional dependabot config 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-21 16:20:49 +02:00
jklein 41e1f62ede feat(voucher-vault): added publish workflow 2026-04-13 20:15:32 +02:00
jklein 81743b23ed feat(dependabot): update appVersion in Helm Charts 2026-04-08 19:33:57 +02:00
jklein ab78e0f9e7 feat(dependabot): changes 2026-04-08 17:56:21 +02:00
jklein 4c74d13866 feat(dependabot): changed directory to only update homeassistant 2026-04-08 17:48:32 +02:00
jklein 0d6bd05db2 feat(dependabot): Fixed directory search pattern 2026-04-08 17:41:44 +02:00
jklein c9634bca91 feat(dependabot): enabled version-updates for helm-charts 
Added support for Helm updates with daily checks.
 2026-04-08 17:37:11 +02:00
jklein ce0ecc66e5 feat(rallly): fixed path in publish-workflow 2026-04-08 15:44:01 +02:00
jklein 106dd5cf62 feat(rallly): fixed path in publish-workflow 2026-04-08 15:08:22 +02:00
jklein b01946f755 feat(rallly): added publish-workflow 2026-04-08 15:04:54 +02:00
jklein 627b841e61 feat(patchmon): added publish workflow 2026-04-03 19:26:59 +02:00
jklein 48db701078 feat(paperless-ngx): added to update version script 2026-03-23 19:06:49 +01:00
jklein 69d16c2112 feat(paperless-ngx): added to update version script 2026-03-23 17:48:59 +01:00
jklein 8d0f3eaf96 feat(paperless-ngx): added publish workflow 2026-03-23 17:42:01 +01:00
jklein 332a370c4b feat(outline): added publish workflow 2026-03-19 13:33:25 +01:00
jklein 0a9d7dfa5a feat(deployment): moved to fleet-cd deployment 2026-03-19 11:50:23 +01:00
jklein 146bf6ef9a feat(change-version): fixed chart versioning 2026-03-18 12:30:28 +01:00
jklein e60ccb7d34 feat(matrix-synapse): fixed publish workflow 2026-03-17 22:08:50 +01:00
jklein 8495540551 feat(matrix-synapse): added publish workflow 2026-03-17 22:07:23 +01:00
jklein eefc9345cf feat(cyberchef): added publish workflow 2026-03-17 17:33:33 +01:00
jklein 952088b3fb feat(satisfactory): added publish workflow 2026-03-16 21:20:33 +01:00
jklein 3ff932dc1f feat(charts): moved to other chart-version format 2026-03-09 23:15:16 +01:00
jklein 329b7ab22b feat(homeassistant): added publish-workflow 2026-03-03 18:03:04 +01:00
jklein 20ead042cb feat(music-assistant-skill): added publish-workflow 2026-02-25 20:56:36 +01:00
jklein e8c963c7d5 feat(gotenberg): added publish/deploy workflow 2026-02-23 16:33:03 +01:00
jklein cddd723f5a feat(apache-tika): added release/deployment workflow 2026-02-23 16:20:28 +01:00
jklein 16aff2ab3c feat(deployment-workflow): added auto-deployment after publishing 2026-02-23 15:09:44 +01:00
jklein 49fd2236be feat(deployment-workflow): added auto-deployment after publishing 2026-02-23 15:09:13 +01:00
jklein c2f24eb9c6 feat(publish-workflow): removed dry-run 2026-02-23 14:22:18 +01:00
jklein f84f14d4da feat(publish-workflow): fixes 2026-02-23 14:18:27 +01:00
jklein 2d3f30d867 feat(publish-workflow): fixes 2026-02-23 14:15:55 +01:00
jklein 6b293b5221 feat(publish-workflow): fixes 2026-02-23 14:11:35 +01:00
jklein dce78560d3 feat(publish-workflow): fixes 2026-02-23 14:07:54 +01:00
jklein 124a4526d4 feat(publish-workflow): fixes 2026-02-23 14:05:07 +01:00
jklein 7b77dc3e27 feat(publish-workflow): fixes 2026-02-23 13:32:48 +01:00
jklein d2fc0f0474 feat(publish-workflow): fixes 2026-02-23 13:06:03 +01:00
jklein 80ace982d4 feat(zipline): added automatic deployment 2026-02-23 13:00:21 +01:00
jklein 1ac6a8519f feat(chart publishing): added auth to registry 2026-02-23 12:10:02 +01:00
jklein 76e1766fcf feat(chart publishing): fixes 2026-02-23 11:58:43 +01:00