jklein
ee9ae8a724
Install-test / Install-test apache-tika (pull_request) Successful in 1m21s
Install-test / Install-test bentopdf (pull_request) Successful in 1m16s
Install-test / Install-test cyberchef (pull_request) Successful in 1m6s
Install-test / Install-test gotenberg (pull_request) Successful in 1m32s
Install-test / Install-test outline (pull_request) Failing after 1m16s
Install-test / Install-test rss-bridge (pull_request) Successful in 1m1s
Install-test / Install-test searxng (pull_request) Successful in 1m13s
Validate Helm Charts / Install-test (pull_request) Failing after 9m57s
Install-test / Install-test ytdlp-web-player (pull_request) Successful in 1m11s
Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s
Validate Helm Charts / Resource quantities (pull_request) Failing after 18s
Validate Helm Charts / HTTPRoute match (pull_request) Failing after 13s
Validate Helm Charts / Selector match (pull_request) Failing after 17s
Validate Helm Charts / Bump level (pull_request) Successful in 8s
Validate Helm Charts / YAML scalars (pull_request) Failing after 16s
Validate Helm Charts / NetworkPolicy (pull_request) Failing after 9s
Validate Helm Charts / Build apache-tika (pull_request) Successful in 5s
Validate Helm Charts / Trivy config apache-tika (pull_request) Successful in 13s
Validate Helm Charts / Build bentopdf (pull_request) Successful in 5s
Validate Helm Charts / Build cyberchef (pull_request) Successful in 6s
Validate Helm Charts / Build outline (pull_request) Successful in 5s
Validate Helm Charts / Build template-chart (pull_request) Successful in 5s
Validate Helm Charts / Trivy config outline (pull_request) Failing after 12s
Validate Helm Charts / Trivy config searxng (pull_request) Successful in 15s
Validate Helm Charts / Trivy config template-chart (pull_request) Successful in 14s
Validate Helm Charts / Build gotenberg (pull_request) Successful in 5s
Validate Helm Charts / Build rss-bridge (pull_request) Successful in 5s
Validate Helm Charts / Build searxng (pull_request) Successful in 5s
Validate Helm Charts / Build ytdlp-web-player (pull_request) Successful in 5s
Validate Helm Charts / Trivy config bentopdf (pull_request) Successful in 14s
Validate Helm Charts / Trivy config cyberchef (pull_request) Successful in 13s
Validate Helm Charts / Trivy config gotenberg (pull_request) Successful in 13s
Validate Helm Charts / Trivy config rss-bridge (pull_request) Successful in 14s
Validate Helm Charts / Trivy config ytdlp-web-player (pull_request) Successful in 15s
bentopdf, apache-tika, gotenberg, rss-bridge, searxng, ytdlp-web-player. One major each, networkPolicy.enabled defaults to true. Three of them differ from the simple case in ways worth naming: GOTENBERG gets DNS-only egress as a deliberate, documented trade. It drives a headless Chromium, and 3000 is its probe port - so it is reachable from the whole cluster by default, and an egress rule for 80/443 would turn a service anyone can POST to into a way of fetching arbitrary URLs. The price is the remote-asset half of HTML conversion: inline content converts, images the page would have fetched silently do not. That degrades a PDF instead of failing a pod, so nothing alerts on it, which is why it is in the template header, in values.yaml and in NOTES.txt, with extraPorts: [80, 443] named as the knowing opt-in. RSS-BRIDGE, SEARXNG and YTDLP-WEB-PLAYER get the open internet on their web ports, because reaching other people's servers IS the application and this object cannot name a host. Said plainly in each, so none of them reads stricter than it is. What the cap still buys is real: no other outbound port, so a compromised pod reaches no database, no mail server and no SSH anywhere. APACHE-TIKA and GOTENBERG render no Ingress - their consumers are other pods, in other namespaces here - so neither gets an ingressController value and both say in NOTES.txt that narrowing probeSources means listing the consumers' namespaces in allowedNamespaces in the same change, or extraction and conversion stop. YTDLP-WEB-PLAYER names the gap this convention has: its oauth2-proxy subchart renders its own Deployment with its own labels and ships no policy, so with the proxy enabled the pod that actually faces the Ingress is unrestricted in both directions. Nothing in this chart can change that - an upstream chart is consumed as it comes - so it is written down instead. ci/outline/test-values.yaml gains egress.extraPorts: [5556]. The CI dex runs there rather than on 443, and Outline fetches the discovery document at boot - so this is the chart's documented escape hatch used for exactly the case it was written for, and the one place in the repo where the cap's upgrade risk is actually exercised. Part of #5
54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
apiVersion: v2
|
|
name: ytdlp-web-player
|
|
description: A Helm chart to deploy ytdlp_web_player on Kubernetes, with an optional oauth2-proxy in front of it
|
|
icon: https://raw.githubusercontent.com/matszwe02/ytdlp_web_player/main/src/static/favicon.svg
|
|
|
|
type: application
|
|
|
|
version: 2.0.0+upv1.2.0
|
|
appVersion: "v1.2.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|
|
|
|
# The first chart in this repo with a dependency. The rule it breaks used to
|
|
# read "charts have no dependencies (charts/ directories are empty)" and was
|
|
# removed from CLAUDE.md and README.md in the same PR that added this chart -
|
|
# see README "Chart style guidelines" for when a dependency is admissible and
|
|
# what it costs.
|
|
#
|
|
# Why one here: the app ships no authentication of any kind, so anyone who
|
|
# reaches its URL can drive it. The proxy is the answer, and it belongs into
|
|
# this chart rather than next to it, because the two are only useful wired to
|
|
# each other: the proxy's upstream is this release's Service, and the wiring is
|
|
# the part that goes wrong silently.
|
|
dependencies:
|
|
- name: oauth2-proxy
|
|
# KEEP THIS VERSION MOVING - it is the only path a proxy update has.
|
|
#
|
|
# In the cluster the proxy used to be a Helm release of its own, and the
|
|
# update automation read its chart version straight out of fleet.yaml. As a
|
|
# subchart it is invisible there: Fleet only ever sees the version of
|
|
# ytdlp-web-player, and what this Chart.yaml declares is baked into the
|
|
# packaged .tgz. So a new oauth2-proxy release - a security fix included -
|
|
# reaches an operator ONLY when this line is raised and a new
|
|
# ytdlp-web-player version is published. Nothing reports the gap; the proxy
|
|
# simply stays where it is.
|
|
#
|
|
# Renovate's built-in helmv3 manager reads this block and opens the PR
|
|
# (verified by dry-run, see the PR for #214); ci/renovate-bump-chart.sh then
|
|
# bumps this chart's patch version, which is what actually ships it. That
|
|
# chain is the whole safety net - if it is ever switched off, this line
|
|
# needs a human on a calendar instead.
|
|
#
|
|
# The subchart version is independent of appVersion: raising it is a minor
|
|
# or patch bump of this chart, never tied to the app image.
|
|
version: "10.7.1"
|
|
repository: "https://oauth2-proxy.github.io/manifests"
|
|
# Off by default, so a plain install renders nothing of it at all. Helm
|
|
# splits a condition on dots only, so the dash in the chart name needs no
|
|
# escaping here - but every read of the same key inside a template does
|
|
# need index .Values "oauth2-proxy", because .Values.oauth2-proxy parses as
|
|
# a subtraction.
|
|
condition: oauth2-proxy.enabled
|