jklein
6b0d8c9232
Deploys matszwe02/ytdlp_web_player, a Flask app that fetches videos with
yt-dlp, transcodes them with ffmpeg and serves them as HLS. It ships no
authentication of any kind, so the chart carries a preconfigured oauth2-proxy
as an optional subchart, in the data path in front of the app.
This is the first chart in the repo with a dependency, so the rule "charts
have no dependencies" falls here. It is replaced in CLAUDE.md and README.md by
a bar: a dependency has to be optional and off by default, upstream's chart is
consumed as it comes (documented where it falls short of our conventions,
never patched), and the price is written down - above all that a subchart is
invisible to everything downstream watching Helm release versions, so a new
proxy release only reaches a cluster when this chart is republished.
CI learns the dependency in five places, not the three the plan expected:
helm lint, package, template and install all exit 1 while charts/ is unfilled,
so ci/helm-dependencies.sh runs before lint and package in validate-charts.yml,
before package in publish-helm-chart.yml, and inside run-install-test.sh,
run-trivy-config.sh and run-quantity-render-test.sh - the last of which renders
every chart on every PR and would have gone red first.
Notable chart decisions, each measured rather than assumed:
- The image has no USER and runs as root by default, but not by necessity: it
runs under an arbitrary uid with readOnlyRootFilesystem and the full
hardening baseline. Only the pinned uid is a deviation, and it is documented.
- Two emptyDirs, each justified separately. /data holds the video cache
(DATA_PATH). /tmp is NOT mounted - measured across metadata extraction, HLS
transcoding, sprite generation and audio extraction, the image never writes
there. What it does write is $HOME/.cache, so /cache is mounted with HOME and
XDG_CACHE_HOME pointed at it; without it yt-dlp re-downloads its JavaScript
challenge-solver from github.com on every extraction.
- The proxy is wired through config.configFile, the only value the subchart
passes through tpl - config.upstreams is emitted with toJson and would carry
a literal {{ .Release.Name }} into the manifest.
- Rendering aborts when this chart's Ingress and the proxy's claim the same
host: ingress-nginx rejects the second one and a Fleet bundle then sits in
ErrApplied until forceSyncGeneration is bumped.
Fixes #214
61 lines
2.8 KiB
Bash
Executable File
61 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch a chart's declared dependencies into its charts/ directory.
|
|
#
|
|
# WHY THIS EXISTS (issue #214)
|
|
#
|
|
# Until ytdlp-web-player every chart here was dependency-free, so no pipeline
|
|
# ever ran "helm dependency update" - and none of them tolerates a chart that
|
|
# needs it. All three of the commands this repo builds on refuse to work while
|
|
# a declared dependency is missing from charts/, each with its own wording:
|
|
#
|
|
# helm lint --strict [WARNING] chart directory is missing these dependencies: <name>
|
|
# helm package Error: found in Chart.yaml, but missing in charts/ directory: <name>
|
|
# helm template Error: An error occurred while checking for chart dependencies. ...
|
|
#
|
|
# All three exit 1, which is why this call sits in FIVE places rather than the
|
|
# three the plan expected: the two build steps of validate-charts.yml, the
|
|
# publish workflow - and the three ci/ scripts that render or install a chart
|
|
# (install-test, quantity-render, trivy-config). The quantity-render one is the
|
|
# easiest to overlook and the one that would have gone red first: it runs over
|
|
# EVERY chart on EVERY pull request, so a dependency-carrying chart breaks it
|
|
# from a PR that does not touch that chart at all.
|
|
#
|
|
# WHY "update" AND NOT "build"
|
|
#
|
|
# "helm dependency build" installs what Chart.lock names and fails when the
|
|
# lock disagrees with Chart.yaml. Renovate rewrites the version in Chart.yaml
|
|
# and cannot regenerate the lock, so every dependency PR would arrive red.
|
|
# "update" resolves from Chart.yaml and writes the lock itself, which is also
|
|
# why neither the lock nor the fetched .tgz is committed (see .gitignore).
|
|
#
|
|
# WHAT IT COSTS, NAMED HERE SO NOBODY HAS TO REDISCOVER IT
|
|
#
|
|
# A network fetch from a third-party Helm repository in every job that renders
|
|
# the chart. That repository going away, or serving a version that no longer
|
|
# exists, turns into a red pipeline on a PR that changed nothing related. This
|
|
# is the price of the dependency, and it is the reason the README asks for one
|
|
# to be justified rather than assumed.
|
|
#
|
|
# Charts without a "dependencies:" block are skipped without a word, so this is
|
|
# safe to call unconditionally for every chart.
|
|
|
|
set -euo pipefail
|
|
|
|
CHART_DIR="${1:?usage: ci/helm-dependencies.sh <chart-directory>}"
|
|
|
|
if [ ! -f "$CHART_DIR/Chart.yaml" ]; then
|
|
echo "ci/helm-dependencies.sh: $CHART_DIR/Chart.yaml not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Deliberately a grep for the top-level key rather than a YAML parse: the
|
|
# runners have no yq and no pyyaml (the same constraint ci/run-trivy-config.sh
|
|
# and ci/run-quantity-render-test.sh work under). A commented-out block does
|
|
# not match, because the anchor requires the key in column one.
|
|
if ! grep -q '^dependencies:' "$CHART_DIR/Chart.yaml"; then
|
|
exit 0
|
|
fi
|
|
|
|
echo "==> helm dependency update $CHART_DIR"
|
|
helm dependency update "$CHART_DIR"
|