jklein
6b0d8c9232
Deploys matszwe02/ytdlp_web_player, a Flask app that fetches videos with
yt-dlp, transcodes them with ffmpeg and serves them as HLS. It ships no
authentication of any kind, so the chart carries a preconfigured oauth2-proxy
as an optional subchart, in the data path in front of the app.
This is the first chart in the repo with a dependency, so the rule "charts
have no dependencies" falls here. It is replaced in CLAUDE.md and README.md by
a bar: a dependency has to be optional and off by default, upstream's chart is
consumed as it comes (documented where it falls short of our conventions,
never patched), and the price is written down - above all that a subchart is
invisible to everything downstream watching Helm release versions, so a new
proxy release only reaches a cluster when this chart is republished.
CI learns the dependency in five places, not the three the plan expected:
helm lint, package, template and install all exit 1 while charts/ is unfilled,
so ci/helm-dependencies.sh runs before lint and package in validate-charts.yml,
before package in publish-helm-chart.yml, and inside run-install-test.sh,
run-trivy-config.sh and run-quantity-render-test.sh - the last of which renders
every chart on every PR and would have gone red first.
Notable chart decisions, each measured rather than assumed:
- The image has no USER and runs as root by default, but not by necessity: it
runs under an arbitrary uid with readOnlyRootFilesystem and the full
hardening baseline. Only the pinned uid is a deviation, and it is documented.
- Two emptyDirs, each justified separately. /data holds the video cache
(DATA_PATH). /tmp is NOT mounted - measured across metadata extraction, HLS
transcoding, sprite generation and audio extraction, the image never writes
there. What it does write is $HOME/.cache, so /cache is mounted with HOME and
XDG_CACHE_HOME pointed at it; without it yt-dlp re-downloads its JavaScript
challenge-solver from github.com on every extraction.
- The proxy is wired through config.configFile, the only value the subchart
passes through tpl - config.upstreams is emitted with toJson and would carry
a literal {{ .Release.Name }} into the manifest.
- Rendering aborts when this chart's Ingress and the proxy's claim the same
host: ingress-nginx rejects the second one and a Fleet bundle then sits in
ErrApplied until forceSyncGeneration is bumped.
Fixes #214
54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
apiVersion: v2
|
|
name: ytdlp-web-player
|
|
description: A Helm chart to deploy ytdlp_web_player on Kubernetes, with an optional oauth2-proxy in front of it
|
|
icon: https://raw.githubusercontent.com/matszwe02/ytdlp_web_player/main/src/static/favicon.svg
|
|
|
|
type: application
|
|
|
|
version: 1.0.0+upv1.2.0
|
|
appVersion: "v1.2.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|
|
|
|
# The first chart in this repo with a dependency. The rule it breaks used to
|
|
# read "charts have no dependencies (charts/ directories are empty)" and was
|
|
# removed from CLAUDE.md and README.md in the same PR that added this chart -
|
|
# see README "Chart style guidelines" for when a dependency is admissible and
|
|
# what it costs.
|
|
#
|
|
# Why one here: the app ships no authentication of any kind, so anyone who
|
|
# reaches its URL can drive it. The proxy is the answer, and it belongs into
|
|
# this chart rather than next to it, because the two are only useful wired to
|
|
# each other: the proxy's upstream is this release's Service, and the wiring is
|
|
# the part that goes wrong silently.
|
|
dependencies:
|
|
- name: oauth2-proxy
|
|
# KEEP THIS VERSION MOVING - it is the only path a proxy update has.
|
|
#
|
|
# In the cluster the proxy used to be a Helm release of its own, and the
|
|
# update automation read its chart version straight out of fleet.yaml. As a
|
|
# subchart it is invisible there: Fleet only ever sees the version of
|
|
# ytdlp-web-player, and what this Chart.yaml declares is baked into the
|
|
# packaged .tgz. So a new oauth2-proxy release - a security fix included -
|
|
# reaches an operator ONLY when this line is raised and a new
|
|
# ytdlp-web-player version is published. Nothing reports the gap; the proxy
|
|
# simply stays where it is.
|
|
#
|
|
# Renovate's built-in helmv3 manager reads this block and opens the PR
|
|
# (verified by dry-run, see the PR for #214); ci/renovate-bump-chart.sh then
|
|
# bumps this chart's patch version, which is what actually ships it. That
|
|
# chain is the whole safety net - if it is ever switched off, this line
|
|
# needs a human on a calendar instead.
|
|
#
|
|
# The subchart version is independent of appVersion: raising it is a minor
|
|
# or patch bump of this chart, never tied to the app image.
|
|
version: "10.7.0"
|
|
repository: "https://oauth2-proxy.github.io/manifests"
|
|
# Off by default, so a plain install renders nothing of it at all. Helm
|
|
# splits a condition on dots only, so the dash in the chart name needs no
|
|
# escaping here - but every read of the same key inside a template does
|
|
# need index .Values "oauth2-proxy", because .Values.oauth2-proxy parses as
|
|
# a subtraction.
|
|
condition: oauth2-proxy.enabled
|