jklein
4c3e970bfe
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render. Port half only: this chart offers no networkPolicy.probeSources - its probes put no packet on the network - so there is no redirected probe to allow and an ipBlock for one would match nothing while making the rule look like it did something. ci/run-networkpolicy-test.sh ties that exemption to the absence of probeSources, not to a chart name.
34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
apiVersion: v2
|
|
name: valkey
|
|
description: A Helm chart to deploy a single Valkey instance (cache or queue backend) for one application on Kubernetes
|
|
icon: https://avatars.githubusercontent.com/u/164458127
|
|
|
|
type: application
|
|
|
|
# appVersion is the exact image tag, "9.1.2-alpine" - the version AND the base
|
|
# flavour, so the "+up" suffix carries both with the dash normalized to a dot.
|
|
#
|
|
# Why "-alpine" and not the fully numbered "-alpine3.24" (Gitea #46, third plan
|
|
# comment): neither tag is immutable. Upstream rebuilds the whole tag matrix
|
|
# periodically, and the build timestamps prove it - "9.1-alpine" and
|
|
# "9.0.6-alpine3.24" were pushed within minutes of each other on 2026-09-21
|
|
# although 9.0.6 is the older release line. Only a digest is immutable. So the
|
|
# choice was never "immutable vs. moving" but between two equally moving tags
|
|
# with different Renovate behaviour, and "-alpine" is the better one: docker
|
|
# versioning splits at the first dash, reads 9.1.2 as the version and "alpine"
|
|
# as the compatibility suffix, so the suffix stays constant forever and the
|
|
# update path can never freeze. With "-alpine3.24" it would: upstream builds
|
|
# exactly one Alpine base per Valkey release, so the next base arrives as
|
|
# "9.1.3-alpine3.25" - a candidate a suffix-bound rule never offers, and
|
|
# "no update" looks identical to a working rule.
|
|
#
|
|
# The price, named rather than discovered: a rebuild of 9.1.2-alpine changes the
|
|
# running image with no change in this repository and nothing reports it. The
|
|
# remedy if that ever matters is pinDigests for this one image - see the valkey
|
|
# block in renovate.json5.
|
|
version: 2.1.0+up9.1.2.alpine
|
|
appVersion: "9.1.2-alpine"
|
|
|
|
maintainers:
|
|
- name: jklein
|