jklein
fef9034862
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render.
37 lines
1.8 KiB
YAML
37 lines
1.8 KiB
YAML
apiVersion: v2
|
|
name: bulwark
|
|
description: A Helm chart to deploy Bulwark Webmail, a JMAP webmail client (mail, calendar, contacts, files) for a Stalwart mail server
|
|
icon: https://avatars.githubusercontent.com/u/266882946
|
|
|
|
type: application
|
|
|
|
# appVersion is the exact image tag of ghcr.io/bulwarkmail/webmail.
|
|
#
|
|
# THE SUFFIX-FREE FORM, AND THAT IS A CHOICE RATHER THAN THE ONLY OPTION. This
|
|
# registry publishes every release TWICE - 1.12.0 and v1.12.0 are the same image
|
|
# under two names (counted 2026-10-05 against the ghcr.io tags API: 315 tags, and
|
|
# both families run the whole way back to 1.3.9). So unlike stalwart, garage,
|
|
# matrix-synapse and calibre-web-automated, where the "v" IS the tag and
|
|
# therefore part of appVersion and of the "+up" suffix, here it is optional and
|
|
# this chart pins the form without it. Do not "normalize" it to v1.12.0 later:
|
|
# that would rewrite appVersion and the chart version for an identical image.
|
|
#
|
|
# The tag census, Renovate's handling of each shape and the three dry-run
|
|
# fixtures that prove it are in renovate.json5's bulwark block rather than
|
|
# duplicated here. The short version: eight tag shapes, six of them things
|
|
# nobody should pin, and plain `docker` versioning excludes all six - so that
|
|
# block deliberately carries NO versioningTemplate.
|
|
version: 2.1.0+up1.12.0
|
|
appVersion: "1.12.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|
|
|
|
# NO DEPENDENCIES, and nothing here wants one. Bulwark is a client: it holds no
|
|
# mail, has no database, no cache and no broker. The mail server it talks to is
|
|
# the `stalwart` chart (Gitea #65), a SEPARATE RELEASE reached over the network
|
|
# by the URL in bulwark.jmapServerUrl - not a subchart, because the two are
|
|
# installed, scaled, upgraded and backed up independently and a JMAP endpoint is
|
|
# an address rather than a bundled component. README, "Chart dependencies", for
|
|
# the bar a dependency has to clear.
|