jklein
a37588c2fe
Retrofits the repo-wide groundwork that #59 deliberately left out to keep the reviewed scope. Chart 2.0.0+up1.0.0 - a major, because seccompProfile changes runtime behaviour; appVersion stays the freely chosen marker 1.0.0. values.schema.json (#68). The largest schema in the repo: nine app blocks with probes, resources, security contexts, env and image. additionalProperties is false on every chart-owned level; the objects that go verbatim into the pod spec stay open. It rejects a mistyped app name, a mistyped key at any depth and ingress.domain - the key #59 removed, which until now would have been accepted in silence. Null safety (#99), both halves, because they cover different cases. The defaultedDict helper catches a key WITH a chart default, where Helm's coalescing deletes the null before the schema ever sees it; the widened ["object","null"] types catch a key WITHOUT one, where the null survives into validation. Measured on the old chart: radarr.securityContext: null rendered "securityContext: null" - the whole hardening gone - and securityContext.capabilities: null dropped the capability block entirely, so the container kept every default capability instead of dropping ALL. Both render green. The fallback table reproduces THIS chart's defaults including its deviations: the five linuxserver.io containers keep runAsNonRoot unset and a writable root filesystem so their s6 init can drop to PUID/PGID, flaresolverr keeps its numerically pinned uid, gluetun keeps NET_ADMIN, and recyclarr keeps its exec probes. Restoring the "clean" standard there would put the linuxserver containers back on the image's uid 911 - the failure calibre-web-automated hit. The sync between table and values.yaml is not left to discipline: rendering with every block of the silent class explicitly set to null is byte-identical to rendering the defaults, which is how a drift shows up. seccompProfile RuntimeDefault (#84) in the pod context, so it covers the init container too. Trivy's KSV-0104 drops from ten findings to none. NOTES.txt (#43) covering what actually bites: the pod is not Ready until the tunnel is up, the two fields the 1Password item needs, the warning when firewallOutboundSubnets is unset, the immutable volumeClaimTemplates, and the measured fact that imports do not hardlink across the media categories. Also, from point 5 of the plan: checksum/config does not apply - the chart has no ConfigMap - but checksum/secret-ref does, and was missing. Helm never sees the secret's contents, yet it does see which op:// item the OnePasswordItem points at, so repointing secrets.gluetunSecretRef now restarts the pod instead of leaving the old credentials running. README: the #43 status line was stale (it still claimed only homeassistant ships NOTES.txt), and the mandatory-icon rule now records freesailarr as a documented exception - #59 dropped the icon and did not amend the rule.
25 lines
1.2 KiB
YAML
25 lines
1.2 KiB
YAML
apiVersion: v2
|
|
name: freesailarr
|
|
description: A Helm chart to deploy a Wireguard-tunneled media automation stack on Kubernetes - a VPN gateway with indexer, downloader, library managers, subtitle fetcher and request front end in one pod, all reaching the internet only through the tunnel
|
|
# No icon on purpose: the stack has no single upstream, and every other chart's
|
|
# icon is its one project's logo. Picking any of the nine here would suggest
|
|
# the same false "main app" the versioning deliberately avoids. The field is
|
|
# optional, so it is omitted rather than filled with an arbitrary choice.
|
|
|
|
type: application
|
|
|
|
version: 2.0.0+up1.0.0
|
|
# The chart's own version marker, freely chosen and tied to no upstream. The
|
|
# stack bundles nine independently versioned projects, so there is no single
|
|
# "app version" to track here.
|
|
#
|
|
# It is NOT the source of any image tag: all nine images are pinned in
|
|
# values.yaml, where Renovate's helm-values manager proposes them. Nothing
|
|
# rewrites this field automatically - the chart has no app-version block in
|
|
# renovate.json5 and is not in the change-app-version.yml choice list. Raise it
|
|
# by hand when you want to mark a new edition of the chart as a whole.
|
|
appVersion: "1.0.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|