jklein
e4b41577ae
Group 3 of the #114 sweep, last chart - and the one that carried the group-2 pattern this sweep was told to look for. It reads ingress.enabled OUTSIDE its Ingress template, in ytdlp-web-player.validate, and in Gateway mode ingress.enabled is false by construction, so that guard would have gone silent. Fixed with ytdlp-web-player.published = ingress.enabled OR httpRoute.enabled - the freesailarr.published / sure.publishedOverTls shape, identical to ingress.enabled while httpRoute.enabled is false, which is why it changes no existing render. AND THE GUARD IS NEEDED MORE IN GATEWAY MODE, NOT LESS. It refuses to publish the application and the oauth2-proxy on the same host: - In INGRESS mode the consequence of ignoring it is loud: ingress-nginx's admission webhook rejects the second Ingress and the Fleet bundle goes to ErrApplied. - In GATEWAY mode THE WEBHOOK NEVER FIRES. It compares Ingress objects with Ingress objects, and an HTTPRoute is a different kind - so nothing rejects anything, both objects stay valid, and one hostname is served over two data paths that are NOT equivalent: the proxy's Ingress goes through AUTHENTICATION and this chart's HTTPRoute goes straight to the application. Which one a client reaches depends on what DNS resolves to. That is an authentication bypass that comes and goes with a DNS record and that no Kubernetes object reports. So the Gateway-mode abort has its own message saying exactly that. Both messages exercised, plus the collision reached through httpRoute.hostnames rather than through the ingress.domain fallback, and the guard still firing when only the Deployment is rendered. THE SUBCHART HAS NO GATEWAY SUPPORT, and this chart cannot give it one - upstream's chart is consumed as it comes (README, "Chart dependencies"). It renders an Ingress or nothing. So in the RECOMMENDED configuration, where the proxy sits in the data path and owns the host, the publishing object is the SUBCHART'S INGRESS in both of this chart's modes, and turning httpRoute on buys nothing. The route is for the proxy-disabled case, or for the application on a host of its own - which is the documented unauthenticated bypass. Said in the template header, in values.yaml, in the schema and in the proxy branch of NOTES.txt, because someone migrating hosts will otherwise set the value and wonder why nothing moved. The 16k proxy-buffer-size this chart recommends is NOT lost by this switch, and that needed stating rather than assuming: it belongs on the PROXY's Ingress (oauth2-proxy.ingress.annotations) as the second half of the 4kB session-cookie trap, and the subchart keeps rendering an Ingress. This chart's own ingress.annotations default is {} and it sets nothing but the cert-manager annotation, so there is no chart-side annotation loss to name. CORRECTED CLAIM: values.yaml and the schema both said that everything the Ingress needs is read only inside its template, so switching it off freed BOTH ingress.domain and ingress.clusterIssuer. clusterIssuer is still freed; domain is now read by the HTTPRoute, so it is freed only with both modes off. The reason the claim was made still holds and is kept - the application has no base-URL setting and builds no absolute links. NOTHING WAS MEASURED ON A LIVE INGRESS OF THIS CHART, because there is none. Measured 2026-10-12: the release runs in namespace jlab-player with both Deployments Ready, and NOT ONE of the cluster's 23 Ingress objects is in that namespace - neither this chart's nor the subchart's. What publishes it instead could not be determined: this workspace's identity may not list httproutes or secrets, so neither a hand-written HTTPRoute nor the release's Helm values are readable. Recorded as the open question it is, in values.yaml and in the overlay, rather than guessed at. Minor: additive, defaults unchanged. Empty helm template diff against origin/main with ci/ytdlp-web-player/test-values.yaml. Part of #114
54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
apiVersion: v2
|
|
name: ytdlp-web-player
|
|
description: A Helm chart to deploy ytdlp_web_player on Kubernetes, with an optional oauth2-proxy in front of it
|
|
icon: https://raw.githubusercontent.com/matszwe02/ytdlp_web_player/main/src/static/favicon.svg
|
|
|
|
type: application
|
|
|
|
version: 1.1.0+upv1.2.0
|
|
appVersion: "v1.2.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|
|
|
|
# The first chart in this repo with a dependency. The rule it breaks used to
|
|
# read "charts have no dependencies (charts/ directories are empty)" and was
|
|
# removed from CLAUDE.md and README.md in the same PR that added this chart -
|
|
# see README "Chart style guidelines" for when a dependency is admissible and
|
|
# what it costs.
|
|
#
|
|
# Why one here: the app ships no authentication of any kind, so anyone who
|
|
# reaches its URL can drive it. The proxy is the answer, and it belongs into
|
|
# this chart rather than next to it, because the two are only useful wired to
|
|
# each other: the proxy's upstream is this release's Service, and the wiring is
|
|
# the part that goes wrong silently.
|
|
dependencies:
|
|
- name: oauth2-proxy
|
|
# KEEP THIS VERSION MOVING - it is the only path a proxy update has.
|
|
#
|
|
# In the cluster the proxy used to be a Helm release of its own, and the
|
|
# update automation read its chart version straight out of fleet.yaml. As a
|
|
# subchart it is invisible there: Fleet only ever sees the version of
|
|
# ytdlp-web-player, and what this Chart.yaml declares is baked into the
|
|
# packaged .tgz. So a new oauth2-proxy release - a security fix included -
|
|
# reaches an operator ONLY when this line is raised and a new
|
|
# ytdlp-web-player version is published. Nothing reports the gap; the proxy
|
|
# simply stays where it is.
|
|
#
|
|
# Renovate's built-in helmv3 manager reads this block and opens the PR
|
|
# (verified by dry-run, see the PR for #214); ci/renovate-bump-chart.sh then
|
|
# bumps this chart's patch version, which is what actually ships it. That
|
|
# chain is the whole safety net - if it is ever switched off, this line
|
|
# needs a human on a calendar instead.
|
|
#
|
|
# The subchart version is independent of appVersion: raising it is a minor
|
|
# or patch bump of this chart, never tied to the app image.
|
|
version: "10.7.1"
|
|
repository: "https://oauth2-proxy.github.io/manifests"
|
|
# Off by default, so a plain install renders nothing of it at all. Helm
|
|
# splits a condition on dots only, so the dash in the chart name needs no
|
|
# escaping here - but every read of the same key inside a template does
|
|
# need index .Values "oauth2-proxy", because .Values.oauth2-proxy parses as
|
|
# a subtraction.
|
|
condition: oauth2-proxy.enabled
|